# AbuseIPDB

> AbuseIPDB is a crowdsourced IP address reputation database run by Marathon Studios Inc. Webmasters, system administrators, and security teams report IP addresses involved in malicious activity (brute-force, port scans, spam, web app attacks, DDoS, and more). Anyone can check an IP, CIDR block, ASN, or domain against those reports. Programmatic access goes through the free REST API (APIv2), which requires an account and API key, with paid plans for higher limits.

Key facts:

- Every IP lookup returns an **Abuse Confidence Score** from 0 to 100%, the number of reports, the number of distinct reporters, and ISP, usage type, domain, and country data.
- Each report names one or more numbered **categories** (e.g. 18 = Brute-Force, 14 = Port Scan, 22 = SSH, 21 = Web App Attack). The full list is at https://www.abuseipdb.com/categories.
- APIv2 is served from `https://api.abuseipdb.com/api/v2/` and authenticated with a `Key` header.
- Report comments are public. Reporters should strip personally identifiable information and include only relevant log lines.
- An IP page lives at `https://www.abuseipdb.com/check/{ip}`. CIDR blocks, ASNs (`/check/AS{number}`), and domains use the same path.

## API

- [APIv2 Documentation](https://docs.abuseipdb.com/): Full reference for the current API, covering authentication, endpoints, parameters, response formats, and error codes
- [CHECK endpoint](https://docs.abuseipdb.com/#check-endpoint): Look up one IPv4/IPv6 address and get its confidence score, report count, and optionally the individual reports
- [REPORT endpoint](https://docs.abuseipdb.com/#report-endpoint): Report an abusive IP with category IDs and an optional comment
- [BLACKLIST endpoint](https://docs.abuseipdb.com/#blacklist-endpoint): Download the most-reported IPs, filtered by confidence score, for firewall blocking
- [CHECK-BLOCK endpoint](https://docs.abuseipdb.com/#check-block-endpoint): Check every reported address inside a CIDR network
- [BULK-REPORT endpoint](https://docs.abuseipdb.com/#bulk-report-endpoint): Submit many reports at once from a CSV file
- [Daily rate limits](https://docs.abuseipdb.com/#api-daily-rate-limits): Per-endpoint daily quotas by plan
- [Pricing](https://www.abuseipdb.com/pricing): Free and paid API plans and what each includes

## Using the website

- [Check an IP, domain, or subnet](https://www.abuseipdb.com/check): Look up reputation and report history
- [Report an IP](https://www.abuseipdb.com/report): Submit a single abuse report through the web form
- [Bulk report](https://www.abuseipdb.com/bulk-report): Upload a CSV of reports
- [Report categories](https://www.abuseipdb.com/categories): Category IDs, names, and descriptions used in reports and the API
- [Reporting policy](https://www.abuseipdb.com/reporting-policy.html): What may and may not be reported
- [FAQ](https://www.abuseipdb.com/faq.html): How confidence scores, reports, accounts, and removals work
- [Statistics](https://www.abuseipdb.com/statistics): Reporting volume and trends across the database

## Integrations

- [Integrations directory](https://www.abuseipdb.com/integrations): First-party and community integrations, SDKs, and plugins
- [AbuseIPDB MCP](https://www.abuseipdb.com/tutorial/abuseipdb-mcp): First-party Model Context Protocol server (`mcp-server-abuseipdb` on PyPI). It gives AI assistants such as Claude, Cursor, VS Code Copilot, and Codex read-only IP lookups
- [Fail2Ban](https://www.abuseipdb.com/fail2ban.html): Report IPs automatically from Fail2Ban bans
- [CSF](https://www.abuseipdb.com/csf.html): Report from ConfigServer Security & Firewall
- [Suricata](https://www.abuseipdb.com/suricata.html): Use AbuseIPDB data with the Suricata IDS
- [Splunk](https://www.abuseipdb.com/splunk.html): Enrich Splunk searches with AbuseIPDB lookups
- [OpenCTI](https://www.abuseipdb.com/opencti.html): Import AbuseIPDB data into OpenCTI
- [Fortinet](https://www.abuseipdb.com/fortinet.html): Use the AbuseIPDB blacklist on Fortinet firewalls

## Optional

- [About](https://www.abuseipdb.com/about.html): Mission and sponsors
- [Bulk Checker tutorial](https://www.abuseipdb.com/tutorial/bulk-check): Check large lists of IPs from the web interface
- [Range Alerts tutorial](https://www.abuseipdb.com/tutorial/range-alerts): Get notified when IPs in your own network ranges are reported
- [Download API logs tutorial](https://www.abuseipdb.com/tutorial/download-api-logs): Export your account's API request history
- [Polarity Community Edition](https://www.abuseipdb.com/polarityce.html): Polarity integration
- [IP address converter](https://www.abuseipdb.com/tools/ip-address-converter): Convert between IP notations
- [Subnet calculator](https://www.abuseipdb.com/tools/subnetcalc): CIDR and subnet calculations
- [Contact](https://www.abuseipdb.com/contact): Support and general inquiries
- [Enterprise contact](https://www.abuseipdb.com/contact/enterprise): Enterprise plans and data licensing
- [Privacy policy](https://www.abuseipdb.com/privacy.html)
- [Legal / Terms](https://www.abuseipdb.com/legal.html)