aid: abuseipdb name: AbuseIPDB description: >- AbuseIPDB is a community-driven project to help system administrators, webmasters, and security analysts check the reputation of IP addresses and report malicious activity. The free APIv2 surface lets developers query a single IP, check a CIDR block, retrieve paginated reports, download a curated blacklist, submit single or bulk abuse reports, and clear their own past reports for an address. AbuseIPDB underpins fail2ban, UFW, Cloudflare WAF, Wazuh, Splunk SOAR, and dozens of other firewall and SIEM integrations across the security community. url: https://docs.abuseipdb.com/ humanURL: https://www.abuseipdb.com/ baseURL: https://api.abuseipdb.com/api/v2/ accessModel: pricing: paid onboarding: self-serve trial: false try_now: false public: false label: Paid · Self-serve signup confidence: high source: - plans - authentication generated: '2026-07-22' method: derived image: https://www.abuseipdb.com/img/abuseipdb-logo.svg specificationVersion: '0.20' type: Index access: 3rd-Party created: '2026-05-28' modified: '2026-05-30' x-source: public-apis/public-apis x-category: Anti-Malware x-tier: 3 x-tier-reason: bulk-registered-from-public-apis tags: - Anti Malware - Blacklist - Cyber Security - IP Reputation - Network Security - Public APIs - Threat Intelligence apis: - aid: abuseipdb:abuseipdb-blacklist-api name: AbuseIPDB Blacklist API description: Endpoints for downloading the community blacklist. humanURL: https://docs.abuseipdb.com/ baseURL: https://api.abuseipdb.com/api/v2/ tags: - Blacklist properties: - type: OpenAPI url: openapi/abuseipdb-blacklist-api-openapi.yml - type: Documentation url: https://docs.abuseipdb.com/ - type: APIReference url: https://docs.abuseipdb.com/#check-endpoint - type: APIReference url: https://docs.abuseipdb.com/#reports-endpoint - type: APIReference url: https://docs.abuseipdb.com/#blacklist-endpoint - type: APIReference url: https://docs.abuseipdb.com/#report-endpoint - type: APIReference url: https://docs.abuseipdb.com/#bulk-report-endpoint - type: APIReference url: https://docs.abuseipdb.com/#check-block-endpoint - type: APIReference url: https://docs.abuseipdb.com/#clear-address-endpoint - type: Authentication url: https://docs.abuseipdb.com/#authentication - type: RateLimits url: https://docs.abuseipdb.com/#rate-limit-headers - type: ErrorCodes url: https://docs.abuseipdb.com/#error-handling - type: CodeExamples url: https://docs.abuseipdb.com/#api-clients - type: JSONSchema url: json-schema/abuseipdb-check-response-schema.json - type: JSONSchema url: json-schema/abuseipdb-report-schema.json - type: JSONSchema url: json-schema/abuseipdb-blacklist-entry-schema.json - type: JSONStructure url: json-structure/abuseipdb-check-response-structure.json - type: JSONStructure url: json-structure/abuseipdb-report-structure.json - type: JSONStructure url: json-structure/abuseipdb-blacklist-entry-structure.json - type: JSONLD url: json-ld/abuseipdb-context.jsonld - type: Examples url: examples/abuseipdb-check-example.json - type: Examples url: examples/abuseipdb-report-example.json - type: Examples url: examples/abuseipdb-blacklist-example.json - type: Examples url: examples/abuseipdb-check-block-example.json - type: Examples url: examples/abuseipdb-reports-example.json - type: Examples url: examples/abuseipdb-bulk-report-example.json - aid: abuseipdb:abuseipdb-management-api name: AbuseIPDB Management API description: Endpoints for managing your own reports. humanURL: https://docs.abuseipdb.com/ baseURL: https://api.abuseipdb.com/api/v2/ tags: - Management properties: - type: OpenAPI url: openapi/abuseipdb-management-api-openapi.yml - type: Documentation url: https://docs.abuseipdb.com/ - type: APIReference url: https://docs.abuseipdb.com/#check-endpoint - type: APIReference url: https://docs.abuseipdb.com/#reports-endpoint - type: APIReference url: https://docs.abuseipdb.com/#blacklist-endpoint - type: APIReference url: https://docs.abuseipdb.com/#report-endpoint - type: APIReference url: https://docs.abuseipdb.com/#bulk-report-endpoint - type: APIReference url: https://docs.abuseipdb.com/#check-block-endpoint - type: APIReference url: https://docs.abuseipdb.com/#clear-address-endpoint - type: Authentication url: https://docs.abuseipdb.com/#authentication - type: RateLimits url: https://docs.abuseipdb.com/#rate-limit-headers - type: ErrorCodes url: https://docs.abuseipdb.com/#error-handling - type: CodeExamples url: https://docs.abuseipdb.com/#api-clients - type: JSONSchema url: json-schema/abuseipdb-check-response-schema.json - type: JSONSchema url: json-schema/abuseipdb-report-schema.json - type: JSONSchema url: json-schema/abuseipdb-blacklist-entry-schema.json - type: JSONStructure url: json-structure/abuseipdb-check-response-structure.json - type: JSONStructure url: json-structure/abuseipdb-report-structure.json - type: JSONStructure url: json-structure/abuseipdb-blacklist-entry-structure.json - type: JSONLD url: json-ld/abuseipdb-context.jsonld - type: Examples url: examples/abuseipdb-check-example.json - type: Examples url: examples/abuseipdb-report-example.json - type: Examples url: examples/abuseipdb-blacklist-example.json - type: Examples url: examples/abuseipdb-check-block-example.json - type: Examples url: examples/abuseipdb-reports-example.json - type: Examples url: examples/abuseipdb-bulk-report-example.json - aid: abuseipdb:abuseipdb-reports-api name: AbuseIPDB Reports API description: Endpoints for submitting and retrieving abuse reports. humanURL: https://docs.abuseipdb.com/ baseURL: https://api.abuseipdb.com/api/v2/ tags: - Reports properties: - type: OpenAPI url: openapi/abuseipdb-reports-api-openapi.yml - type: Documentation url: https://docs.abuseipdb.com/ - type: APIReference url: https://docs.abuseipdb.com/#check-endpoint - type: APIReference url: https://docs.abuseipdb.com/#reports-endpoint - type: APIReference url: https://docs.abuseipdb.com/#blacklist-endpoint - type: APIReference url: https://docs.abuseipdb.com/#report-endpoint - type: APIReference url: https://docs.abuseipdb.com/#bulk-report-endpoint - type: APIReference url: https://docs.abuseipdb.com/#check-block-endpoint - type: APIReference url: https://docs.abuseipdb.com/#clear-address-endpoint - type: Authentication url: https://docs.abuseipdb.com/#authentication - type: RateLimits url: https://docs.abuseipdb.com/#rate-limit-headers - type: ErrorCodes url: https://docs.abuseipdb.com/#error-handling - type: CodeExamples url: https://docs.abuseipdb.com/#api-clients - type: JSONSchema url: json-schema/abuseipdb-check-response-schema.json - type: JSONSchema url: json-schema/abuseipdb-report-schema.json - type: JSONSchema url: json-schema/abuseipdb-blacklist-entry-schema.json - type: JSONStructure url: json-structure/abuseipdb-check-response-structure.json - type: JSONStructure url: json-structure/abuseipdb-report-structure.json - type: JSONStructure url: json-structure/abuseipdb-blacklist-entry-structure.json - type: JSONLD url: json-ld/abuseipdb-context.jsonld - type: Examples url: examples/abuseipdb-check-example.json - type: Examples url: examples/abuseipdb-report-example.json - type: Examples url: examples/abuseipdb-blacklist-example.json - type: Examples url: examples/abuseipdb-check-block-example.json - type: Examples url: examples/abuseipdb-reports-example.json - type: Examples url: examples/abuseipdb-bulk-report-example.json - aid: abuseipdb:abuseipdb-reputation-api name: AbuseIPDB Reputation API description: Endpoints for looking up the abuse data of an IP or CIDR network. humanURL: https://docs.abuseipdb.com/ baseURL: https://api.abuseipdb.com/api/v2/ tags: - Reputation properties: - type: OpenAPI url: openapi/abuseipdb-reputation-api-openapi.yml - type: Documentation url: https://docs.abuseipdb.com/ - type: APIReference url: https://docs.abuseipdb.com/#check-endpoint - type: APIReference url: https://docs.abuseipdb.com/#reports-endpoint - type: APIReference url: https://docs.abuseipdb.com/#blacklist-endpoint - type: APIReference url: https://docs.abuseipdb.com/#report-endpoint - type: APIReference url: https://docs.abuseipdb.com/#bulk-report-endpoint - type: APIReference url: https://docs.abuseipdb.com/#check-block-endpoint - type: APIReference url: https://docs.abuseipdb.com/#clear-address-endpoint - type: Authentication url: https://docs.abuseipdb.com/#authentication - type: RateLimits url: https://docs.abuseipdb.com/#rate-limit-headers - type: ErrorCodes url: https://docs.abuseipdb.com/#error-handling - type: CodeExamples url: https://docs.abuseipdb.com/#api-clients - type: JSONSchema url: json-schema/abuseipdb-check-response-schema.json - type: JSONSchema url: json-schema/abuseipdb-report-schema.json - type: JSONSchema url: json-schema/abuseipdb-blacklist-entry-schema.json - type: JSONStructure url: json-structure/abuseipdb-check-response-structure.json - type: JSONStructure url: json-structure/abuseipdb-report-structure.json - type: JSONStructure url: json-structure/abuseipdb-blacklist-entry-structure.json - type: JSONLD url: json-ld/abuseipdb-context.jsonld - type: Examples url: examples/abuseipdb-check-example.json - type: Examples url: examples/abuseipdb-report-example.json - type: Examples url: examples/abuseipdb-blacklist-example.json - type: Examples url: examples/abuseipdb-check-block-example.json - type: Examples url: examples/abuseipdb-reports-example.json - type: Examples url: examples/abuseipdb-bulk-report-example.json common: - type: AgenticAccess url: agentic-access/abuseipdb-agentic-access.yml - type: DomainSecurity url: security/abuseipdb-domain-security.yml - type: Authentication url: authentication/abuseipdb-authentication.yml - type: PostmanWorkspace url: https://www.postman.com/kinlaneapi/abuseipdb/overview - type: Arazzo url: arazzo/abuseipdb-blacklist-triage-workflow.yml name: AbuseIPDB Blacklist Triage - type: Arazzo url: arazzo/abuseipdb-block-scan-and-check-workflow.yml name: AbuseIPDB Block Scan And Check - type: Arazzo url: arazzo/abuseipdb-bulk-report-then-verify-workflow.yml name: AbuseIPDB Bulk Report Then Verify - type: Arazzo url: arazzo/abuseipdb-check-then-report-workflow.yml name: AbuseIPDB Check Then Report - type: Arazzo url: arazzo/abuseipdb-clear-false-positive-workflow.yml name: AbuseIPDB Clear False Positive - type: Arazzo url: arazzo/abuseipdb-investigate-ip-workflow.yml name: AbuseIPDB Investigate IP - type: Arazzo url: arazzo/abuseipdb-report-then-verify-workflow.yml name: AbuseIPDB Report Then Verify - type: Website url: https://www.abuseipdb.com/ - type: Documentation url: https://docs.abuseipdb.com/ - type: Signup url: https://www.abuseipdb.com/register - type: Login url: https://www.abuseipdb.com/login - type: DeveloperPortal url: https://www.abuseipdb.com/account/api name: API Key Dashboard description: Account-level UI for issuing, rotating, and revoking AbuseIPDB API keys. - type: Pricing url: https://www.abuseipdb.com/pricing description: >- Four tiers — Individual (free, 1,000 checks/day), Basic ($25/mo or $228/yr, 10,000 checks/day), Premium ($99/mo or $1,068/yr, 50,000 checks/day), and Enterprise (custom direct-data access). - type: Plans url: plans/abuseipdb-plans-pricing.yml - type: RateLimits url: rate-limits/abuseipdb-rate-limits.yml - type: SpectralRules url: rules/abuseipdb-rules.yml - type: Vocabulary url: vocabulary/abuseipdb-vocabulary.yml - type: FinOps url: finops/abuseipdb-finops.yml - type: Plans url: https://www.abuseipdb.com/account/plans name: Account Plans - type: Blog url: https://www.abuseipdb.com/blog - type: FAQ url: https://www.abuseipdb.com/faq.html - type: Support url: https://www.abuseipdb.com/contact - type: Contact url: https://www.abuseipdb.com/contact - type: TermsOfService url: https://www.abuseipdb.com/terms-of-service - type: PrivacyPolicy url: https://www.abuseipdb.com/privacy-policy - type: GitHubOrganization url: https://github.com/AbuseIPDB description: >- Official AbuseIPDB org. Hosts `laravel` (Laravel AbuseIPDB middleware package) and `ip-lib` (forked PHP IPv4/IPv6 range library). - type: SDKs url: https://github.com/AbuseIPDB/laravel name: AbuseIPDB Laravel Package description: Official Laravel middleware that scores incoming requests against AbuseIPDB. - type: SDKs url: https://github.com/nickurt/laravel-abuseipdb name: laravel-abuseipdb (community) description: Community Laravel 11.x/12.x/13.x plugin for AbuseIPDB. - type: SDKs url: https://github.com/falegk/abuseipdb-rb name: abuseipdb-rb (Ruby gem) description: Community Ruby client gem for the AbuseIPDB API. - type: SDKs url: https://github.com/meatyite/python-abuseipdb name: python-abuseipdb description: Object-oriented Python wrapper for AbuseIPDB v2 API. - type: SDKs url: https://github.com/streanger/abuseipdb-wrapper name: abuseipdb-wrapper (Python) description: Python wrapper for the AbuseIPDB API. - type: CLI url: https://github.com/kristuff/abuseipdb-cli name: abuseipdb-cli description: CLI tool to check, report, and download the AbuseIPDB blacklist from the command line. - type: Integrations data: - name: Fail2Ban description: Pre-packaged AbuseIPDB action ships with fail2ban; reports banned offenders directly to AbuseIPDB. - name: UFW (Uncomplicated Firewall) description: >- Multiple community projects (sefinek/UFW-AbuseIPDB-Reporter, jseutens/ufw-abuseipdb) ingest UFW logs and report or ingest the AbuseIPDB blacklist. - name: Cloudflare WAF description: sefinek/Cloudflare-WAF-To-AbuseIPDB streams Cloudflare WAF events into AbuseIPDB reports. - name: Splunk SOAR description: Official splunk-soar-connectors/abuseipdb connector enriches Splunk SOAR playbooks with AbuseIPDB reputation. - name: Wazuh description: >- marciuscosta/abuseipdb-wazuh-integration wires AbuseIPDB enrichment into Wazuh with a local cache and multi-key support. - name: CrowdSec description: goremykin/crowdsec-abuseipdb-blocklist converts CrowdSec data into AbuseIPDB blocklists. - name: Endlessh description: elhenro/endlessh-auto-report-abuseipdb auto-reports SSH tarpit visitors to AbuseIPDB. - name: Nginx description: tmiland/abuseipdb-php-nginx-blacklist-create generates an Nginx-ready blocklist file from AbuseIPDB. - name: Zen Cart description: CcMarc/AbuseIPDB plugs AbuseIPDB into the Zen Cart e-commerce platform. - name: TheHive description: AbuseIPDB enrichment is used by SOAR/IR pipelines like malwarekid/SOAR-Flow alongside Wazuh and TheHive. - name: IPinfo description: AbuseIPDB sources its IP geolocation, ISP, usage type, and domain data from IPinfo. - type: Features data: - name: IP Reputation Lookups description: >- Query any IPv4 or IPv6 address for its abuse confidence score, total reports, distinct reporters, and country/ISP metadata. - name: Community-Sourced Blacklist description: >- Downloadable daily blacklist of high-confidence abusive IPs, with configurable confidence threshold, country filters, IP version, and result limit. - name: Abuse Reporting description: >- Submit single or bulk abuse reports tagged with one or more standard category IDs (e.g. SSH Brute-Force, DDoS, Web App Attack). - name: CIDR Block Checking description: >- Score whole subnets in one call via the CHECK-BLOCK endpoint, with subscriber tiers supporting up to /16 networks. - name: Categorised Abuse Taxonomy description: >- 23 standard report categories (DNS Compromise, Open Proxy, Brute-Force, Phishing, etc.) for consistent classification. - name: Self-Service Report Clearing description: Remove your own reports for a given IP via the CLEAR-ADDRESS endpoint if a report was made in error. - name: Standard Rate-Limit Headers description: Every response carries X-RateLimit-Limit / Remaining / Reset and Retry-After, simplifying back-off in clients. - name: Whitelist Awareness description: Responses include an `isWhitelisted` flag so consumers can avoid blocking known-good infrastructure. - type: UseCases data: - name: SSH / RDP Brute-Force Defence description: Auto-block and report SSH/RDP brute-force sources via fail2ban, UFW, or endlessh integrations. - name: WAF Augmentation description: Enrich Cloudflare / Nginx / custom WAF rulesets with the AbuseIPDB blacklist for IP-based pre-filtering. - name: SIEM / SOC Enrichment description: Add AbuseIPDB context to Splunk SOAR, Wazuh, and TheHive alerts for analyst triage. - name: Bot and Crawler Filtering description: Score request source IPs before serving e-commerce or login pages to block known-abusive infrastructure. - name: Threat Hunting and OSINT description: >- Combine AbuseIPDB with VirusTotal, Shodan, GreyNoise and similar feeds (e.g. malwoverview) during incident response. - name: Bulk Reporting from Edge Logs description: Convert nightly access logs into CSV bulk reports to feed the AbuseIPDB community blacklist. - type: Solutions data: - name: Individual (Free) description: 1,000 checks/day, 100 block checks, 5 blacklist downloads. Aimed at hobby admins and home labs. - name: Basic description: $25/mo. 10,000 checks/day, 1,000 block checks, 100 bulk reports, customisable blacklist up to 100,000 IPs. - name: Premium description: $99/mo. 50,000 checks/day, 5,000 block checks, 500 bulk reports, customisable blacklist up to 500,000 IPs. - name: Enterprise description: Custom-priced direct data access for ISPs and large security organisations. maintainers: - FN: Kin Lane email: kin@apievangelist.com