AbuseIPDB

Overview

AbuseIPDB aggregates IP abuse reports from the community — check an IP’s abuse confidence score, report malicious IPs, and get blocklist data. Requires a free API key (an invalid key returns 401 — verified).

Quick Start

Check an IP (replace YOUR_KEY):

curl "https://api.abuseipdb.com/api/v2/check?ipAddress=8.8.8.8" \
  -H "Key: YOUR_KEY" \
  -H "Accept: application/json"

{
  "data": {
    "ipAddress": "8.8.8.8",
    "abuseConfidenceScore": 0,
    "countryCode": "US",
    "usageType": "Data Center/Web Hosting/Transit",
    "isp": "Google LLC",
    "domain": "google.com",
    "isWhitelisted": true,
    "totalReports": 0
  }
}

Report an IP:

curl -X POST "https://api.abuseipdb.com/api/v2/report" \
  -H "Key: YOUR_KEY" -H "Accept: application/json" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "ip=1.2.3.4&categories=18&comment=Port scan"

Blacklist:

curl "https://api.abuseipdb.com/api/v2/blacklist?confidenceMinimum=90" \
  -H "Key: YOUR_KEY" -H "Accept: application/json"

Authentication

• Register at abuseipdb.com → free API key (in account settings).
• Send it as the Key header (an invalid key returns 401 — verified).

Rate Limits & Notes

• Free tier: 1,000 requests/day (daily refreshed); paid tiers scale.
• abuseConfidenceScore (0-100) is the community abuse score — the core signal.
• Category codes (18 = port scan, 21 = brute force, 15 = web attack…) are in the docs.
• The blacklist endpoint returns CIDR ranges with scores — useful for blocking.

FAQ

Is AbuseIPDB free? Free tier: 1,000 requests/day; more is paid.

How do I get a key? Register at abuseipdb.com — the key is in your account settings.

What’s the abuse confidence score? A 0-100 community-derived score of how likely an IP is abusive.