IP Reputation & Abuser Database

The IP to Abuser Database lists the IP addresses that are attacking the Internet right now: they guess passwords, scan for vulnerable services, send spam or belong to a botnet. It contains 17,874,122 abusive IP addresses, aggregated from 54 vetted threat intelligence sources, including honeypots we run ourselves, and states for every address how many sources report it. Use it to block or challenge abusive traffic before it reaches your login, signup or checkout.

• IPv4 and IPv6 addresses, each with the number of sources that report it (sourceCount)
• Only sources that observe abuse themselves and let their entries expire: no stale lists, no lists of lists
• The current Tor exit nodes, in a separate file
• Rebuilt every day, because attackers change addresses quickly
• CSV for bulk imports, MMDB for fast lookups from any programming language
• The same data as the is_abuser field of the ipapi.is API

{
  "is_abuser": true,
  "company": {
    "name": "Vlad Cojuhari",
    "abuser_score": "0.1641 (High)",
    "domain": "zerolimit-servers.cool",
    "type": "business",
    "network": "138.226.239.0 - 138.226.239.255",
    "netname": "Vertex"
  },
  "asn": {
    "asn": 403092,
    "abuser_score": "0.1641 (High)",
    "org": "HOSTRAM LLC"
  },
  "abuse": {
    "name": "Vlad Cojuhari",
    "address": "Constantin Brancusi St 3",
    "email": "ban-me-please@zerolimit-servers.cool",
    "phone": "+248"
  }
}

# Use Cases

Most automated attacks come from a comparatively small set of addresses that attack many targets at once. Whoever has been attacked elsewhere today can be recognized at your door:

# Purchase Database

Create a free account, subscribe in your dashboard with a card or PayPal, and download the database right away, in every format it comes in. The subscription is billed monthly and can be canceled at any time. Updates are included: your personal download link always serves the latest release, so one scheduled command keeps your copy current. See pricing and the terms.

Need more than one database? The Business plan includes all seven databases ($563 per month if bought separately), the largest standard API plan and the right to run the API on your own servers, for $200 per month.

# Database Format

The database consists of two files, each in CSV and MMDB format: abuser with the abusive IP addresses and tor with the current Tor exit nodes. IPv4 and IPv6 records are in the same file. Each record covers the range from startIp to endIp; most records are single addresses. The abuser file has these columns:

The tor file has the columns startIp, endIp, ipVersion and isTor.

An excerpt of the CSV file:

startIp,endIp,ipVersion,isAbuser,sourceCount,totalSources
138.226.239.233,138.226.239.233,4,true,25,54
35.210.176.28,35.210.176.28,4,true,24,54
193.32.162.15,193.32.162.15,4,true,24,54
2.57.122.209,2.57.122.209,4,true,23,54
45.148.10.61,45.148.10.61,4,true,23,54
107.150.123.48,107.150.123.48,4,true,23,54
176.120.22.61,176.120.22.61,4,true,23,54
195.178.110.227,195.178.110.227,4,true,23,54
196.189.236.67,196.189.236.67,4,true,23,54
92.118.39.14,92.118.39.14,4,true,22,54
103.159.2.113,103.159.2.113,4,true,22,54
125.130.102.172,125.130.102.172,4,true,22,54

# How to Use the IP to Abuser Database

Download the MMDB sample:

curl -O https://ipapi.is/data/samples/Abuser-Database-Sample.mmdb

Look up an IP address with mmdbctl:

mmdbctl read -f json-pretty 138.226.239.233 Abuser-Database-Sample.mmdb

which outputs:

{
  "ip": "138.226.239.233",
  "ipVersion": "4",
  "isAbuser": "true",
  "network": "138.226.239.233-138.226.239.233",
  "sourceCount": "25",
  "totalSources": "54"
}

The MMDB format can be read by the MaxMind DB reader library of every major programming language. In Python:

import maxminddb  # pip install maxminddb

reader = maxminddb.open_database('Abuser-Database-Sample.mmdb')
record = reader.get('203.0.113.7')
if record:
    print('Abuser, reported by', record['sourceCount'], 'sources')
else:
    print('Not known for abuse')

# How the Data is Collected

Every address in the database was recently reported by a source we trust. The sources are chosen and checked continuously:

• Threat intelligence feeds: we evaluate public blocklists that permit commercial use and keep the ones that observe abuse themselves, with honeypots, sensor networks or spam traps. Aggregators that republish other feeds are not used, because they make a single observation look like several.
• Our own sensors: a network of honeypot servers records who logs in with guessed credentials or delivers malware, and our own infrastructure reports failed SSH logins, blocked connections and addresses that repeatedly abuse our API.
• Measured against real attacks: for every feed we measure how many of its addresses attacked our own servers in the same month. For the feeds we use, it is 50 to 90 percent. Lists that never remove an entry score under 5 percent and are dropped.
• Confidence tiers: a source of high or medium confidence flags an address on its own, a source of lower confidence needs a second one to agree. Shared infrastructure such as the public DNS resolvers 8.8.8.8 and 1.1.1.1 is never flagged, however many lists include it.

Which networks harbor the most abusers? See the most abusive networks and the most abusive ASNs of the Internet. The IP to Company Database and the IP to ASN Database also rate every network by its share of abusive addresses (abuser_score).

# Frequently Asked Questions

# More IP Databases

All seven databases are also part of the Business plan, together with the API.