aid: sniffcat
name: SniffCat
description: 'SniffCat is a privacy-focused IP abuse database and OSINT threat-intelligence platform built
  by Polish developer Sefinek, positioned as a community-moderated AbuseIPDB alternative. Sysadmins, hosting
  providers, ISPs and security researchers report malicious IP addresses against a published 27-term abuse-category
  vocabulary, and consume the resulting reputation data through a free, versioned REST API at api.sniffcat.com:
  abuse-confidence lookups, per-IP report history, and score-ordered blocklist feeds in JSON or plain
  text for direct firewall ingestion. Entitlement is role-based rather than paid, with published daily
  quotas per operation and trust levels that weight how much each reporter moves an IP''s score. The platform
  is in Early Access / open beta and publishes no machine-readable contract.'
url: https://sniffcat.apievangelist.com/apis.yml
created: '2026-08-19'
modified: '2026-08-19'
specificationVersion: '0.21'
tags:
- Threat Intelligence
- IP Reputation
- abuse-database
- Cybersecurity
- OSINT
- Network Security
- sysadmin-tools
- Blocklist
- abuse-reporting
- ip-blocklist
- IP Intelligence
- Threat Feeds
tags_raw:
- threat-intelligence
- ip-reputation
- abuse-database
- cybersecurity
- osint
- network-security
- sysadmin-tools
- blocklist
- abuse-reporting
- ip-blocklist
- ip-intelligence
- threat-feeds
apis:
- name: SniffCat REST API
  description: Documented, versioned REST API (/api/v1/*) for checking IPs, retrieving blacklist feeds
    and report history, and submitting abuse reports. Uses X-Secret-Token header authentication with role-based
    rate limits.
  humanURL: https://sniffcat.com/documentation/api
  baseURL: https://api.sniffcat.com
  tags:
  - Threat Intelligence
  - IP Reputation
  - abuse-database
  - Cybersecurity
  - OSINT
  - Network Security
  - sysadmin-tools
  - Blocklist
  tags_raw:
  - threat-intelligence
  - ip-reputation
  - abuse-database
  - cybersecurity
  - osint
  - network-security
  - sysadmin-tools
  - blocklist
  properties:
  - type: Documentation
    url: https://sniffcat.com/documentation
  - type: APIReference
    url: https://sniffcat.com/documentation/api
  - type: GettingStarted
    url: https://sniffcat.com/documentation/api
  - type: Authentication
    url: authentication/sniffcat-authentication.yml
  - type: Conventions
    url: conventions/sniffcat-conventions.yml
  - type: ErrorCatalog
    url: errors/sniffcat-problem-types.yml
  - type: RateLimits
    url: rate-limits/sniffcat-rate-limits.yml
  - type: DataModel
    url: data-model/sniffcat-data-model.yml
  - type: Vocabulary
    url: vocabulary/sniffcat-report-categories.yml
  - type: Sandbox
    url: sandbox/sniffcat-sandbox.yml
  x-evidence:
    verified: '2026-08-19'
    method: live probe + published reference
    docs: https://sniffcat.com/documentation/api documents five endpoints with full parameter, response
      and error tables.
    endpoint_check: GET https://api.sniffcat.com/ -> 200 {"success":true,"status":200,"version":"0.1.5"};
      GET https://api.sniffcat.com/api/v1/check?ip=1.1.1.1 -> 403 "Missing API token in request headers."
      with live RateLimit headers.
    machine_readable_contract: none published (openapi.json/swagger.json/api-docs/redoc all 404 on api.sniffcat.com
      and sniffcat.com)
maintainers:
- FN: Sefinek
  email: support@sniffcat.com
  url: https://sefinek.net
generated:
  by: apis.io/add
  model: claude-opus-4-8
  confidence: 88
  at: '2026-08-19T02:43:05.010Z'
common:
- type: VulnerabilityDisclosure
  url: security/sniffcat-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/sniffcat-domain-security.yml
- type: DeveloperPortal
  url: https://sniffcat.com/documentation
- type: Documentation
  url: https://sniffcat.com/documentation
- type: APIReference
  url: https://sniffcat.com/documentation/api
- type: GettingStarted
  url: https://sniffcat.com/documentation/api
- type: Support
  url: https://sniffcat.com/tickets
- type: HelpCenter
  url: https://discord.gg/S7NDzCzQTg
- type: GitHubOrganization
  url: https://github.com/SniffCatDB
- type: SignUp
  url: https://sniffcat.com/register
- type: Login
  url: https://sniffcat.com/login
- type: TermsOfService
  url: https://sniffcat.com/terms-of-use
- type: StatusPage
  url: https://status.sniffcat.com/
- type: Integrations
  url: https://sniffcat.com/documentation/integrations
- type: Lifecycle
  url: lifecycle/sniffcat-lifecycle.yml
- type: Authentication
  url: authentication/sniffcat-authentication.yml
- type: Conventions
  url: conventions/sniffcat-conventions.yml
- type: ErrorCatalog
  url: errors/sniffcat-problem-types.yml
- type: RateLimits
  url: rate-limits/sniffcat-rate-limits.yml
- type: Plans
  url: plans/sniffcat-plans-pricing.yml
- type: Packages
  url: packages/sniffcat-packages.yml
- type: SDKs
  url: packages/sniffcat-packages.yml
- type: Vocabulary
  url: vocabulary/sniffcat-report-categories.yml
- type: DataModel
  url: data-model/sniffcat-data-model.yml
- type: Sandbox
  url: sandbox/sniffcat-sandbox.yml
- type: Conformance
  url: conformance/sniffcat-conformance.yml
- type: WellKnown
  url: well-known/sniffcat-well-known.yml
- type: SecurityTxt
  url: well-known/sniffcat-security.txt
- type: Security
  url: security/sniffcat-vulnerability-disclosure.yml
- type: LLMsTxt
  url: llms/sniffcat-llms.txt
image: https://sniffcat.com/images/og-preview.jpg
x-enrichment:
  date: '2026-08-19'
  status: enriched
  artifacts_added: 17
  pass: local-v1
x-evidence:
  round: '2026-08-19'
  admitted_from: Add-API gate auto-publish 2026-08-19 02:45 UTC, confidence 88.
  slug: No rename needed — sniffcat.com already yields sniffcat under the domain rule.
  split_surface:
    api.sniffcat.com: root 200 returning {"success":true,"status":200,"version":"0.1.5"}, invented path
      404 — discriminates. /api/v1 is the real surface.
    sniffcat.com: USER-AGENT FILTERED, not blocked. A default curl/SDK/agent UA gets a 5,511b Cloudflare
      "Attention Required" 403. The same URL with an ordinary Chrome UA returns 200 — the API documentation
      page is 10,853b of real HTML. Any agent, SDK or crawler sending its own UA is refused; a browser
      is not. An agent-readiness gap, and cheap for them to close.
    no_llms_txt: 'Established only after the UA correction: with a browser UA, /llms.txt and /openapi.json
      both return honest 404s. The 403 had masked their absence.'
  no_openapi: None published on either host. The pipeline deliberately derived none — there is no openapi/
    directory here.
  no_mcp_server_and_none_claimed: 'mcp/sniffcat-mcp.yml is status: candidate, published_by_provider: false.
    It records that /mcp 404s on both hosts, no MCP package exists on npm or PyPI, and no MCP server appears
    in the docs or the GitHub org. The tool set in it is an API Evangelist PROPOSAL and no MCPServer pointer
    is wired, because that pointer would assert an agent surface SniffCat does not serve.'
  correction: 'I first checked github.com/sniffcat — an org with 0 public repos — and concluded there
    was no ecosystem. Wrong org. The real one is github.com/SniffCatDB: 4 repos including a Python SDK
    (sniffcat.py) and three integration tools (Cloudflare-WAF-To-SniffCat, T-Pot-To-SniffCat, UFW-SniffCat-Reporter),
    all pushed 2026-08-18.'