STIX/TAXII threat intelligence feeds

AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, such as brute-force logins, port scans, spam and web attacks. Its STIX/TAXII feeds deliver those addresses as STIX 2.1 indicators over TAXII 2.1, so your SIEM or threat intelligence platform can match your logs against reported IP addresses and use their scores and context during investigation. Setup depends on your platform: some have a built-in TAXII client, others need an extra component, such as Google's ingestion script for Google Security Operations; see the client setup guides. During the beta, accounts on a paid API plan get one free feed to try it; see Plans.

Every indicator carries the address's AbuseIPDB confidence score: a 0–100 rating of how confident AbuseIPDB is, based on user reports, that the address is malicious (how it is calculated). Addresses scoring 75 or more also carry the abuseipdb:blacklisted label.

Already use AbuseIPDB? Free and Paid feeds draw from the same blacklist that the blacklist endpoint serves, and Enterprise feeds can include every reported address. Instead of a plain IP list or CSV, a feed delivers each address as a STIX indicator that your SIEM or threat intelligence platform imports and keeps up to date by itself, so you need a TAXII 2.1 client: a supported platform or your own script. Feeds don't replace or change the API: your check and blacklist calls, API keys and API plan limits work as before, and polling a feed doesn't use your API daily limits. STIX/TAXII feeds are bought separately from your API plan; during the beta, accounts on a paid API plan can try one free feed first (see Plans).

What are STIX and TAXII?

STIX 2.1 is a standard JSON format for sharing threat intelligence. In AbuseIPDB's feeds, each reported IP address becomes one STIX indicator: a record that says “treat traffic from this address as suspicious”, with its confidence score and context. TAXII 2.1 is the standard HTTPS protocol security tools use to fetch those records on a schedule. AbuseIPDB runs a TAXII 2.1 server: your SIEM or threat intelligence platform polls it for new indicators and can, optionally, push your own reports back.

In these docs, a feed is your own selection of AbuseIPDB indicators, with optional filters such as a minimum confidence score. TAXII calls each feed a collection. Depending on the client, you identify it by its Collection ID, its full collection URL or its title; each platform guide says which. The feed's output format decides what arrives with each IP: labels, linked graph objects, structured extension fields, or recent reports.

Get started

1. Check that you have a SIEM, threat intelligence platform or other client that can poll TAXII 2.1 collections. If yours has a guide under Client setup guides, open it now; it lists everything you need.
2. On My TAXII Feeds, create a feed and pick its output format. Not sure which? Choose IP threat indicators: every client guide uses it, and it is the only format on the Free and Paid plans.
3. Have an API key ready. Your TAXII client logs in with your AbuseIPDB account email as the username and the API key as the password.
4. Follow the guide for your platform under Client setup guides.
5. After the first poll, check that the feed's Last accessed date on My TAXII Feeds shows today, then confirm the indicators arrived in your platform. If they did not, see Errors.

Plans

During the beta, accounts on a paid API plan can create one free feed, using the IP threat indicators output format – open My TAXII Feeds to set it up. It's a limited sample for trying the feed, not a copy of the paid feed:

• Capped at 10,000 indicator objects per day, shared across your feeds. An indicator served again counts again.
• Only indicators at the maximum confidence score (100) are included; country filtering is not available on this plan.
• You can't choose a start point or backfill: AbuseIPDB remembers how far each feed has got and ignores any added_after or next your client sends. Each UTC day the feed starts again from the addresses added to the AbuseIPDB blacklist earliest and serves forward until the daily cap is reached. Addresses you already hold come back with the same IDs, so your client updates them in place. While more addresses qualify than the daily cap, the ones added to the blacklist most recently are not served.
• The AbuseIPDB identity object is included once per UTC day, on your first successful pull, rather than on every page.

The Paid plan raises the daily cap, serves indicators from a lower confidence score (see the table), and adds country filtering plus the usage type, ISP, whitelist and report-count labels. Paid feeds work like the free feed: AbuseIPDB keeps your place, each UTC day the feed starts again from the addresses added to the blacklist earliest, and while more addresses qualify than the daily cap, the most recently added ones are not served. The Enterprise plan removes the daily cap, opens all four output formats, lets you set any minimum confidence, and lets your TAXII client choose where each poll starts (for backfills and replays).

STIX/TAXII plans are bought separately from your API plan: an API subscription doesn't include a Paid or Enterprise feed, and a feed doesn't change your API limits. Any of your existing API keys signs your TAXII client in. Try the free feed first; to upgrade, contact us.

	Free	Paid	Enterprise
Indicators per day	10,000	100,000	Unlimited
Lowest confidence score served	100 only	95 and up	Your choice, 0–100
Country filter	No	Yes	Yes
Output formats	IP threat indicators only	IP threat indicators only	All four
Individual reports (IP threat indicators with reports)	No	No	Yes
Feeds per account	1	3	10
Usage type, ISP, whitelist and report-count labels	No	Yes	Yes
Backfill past indicators	No	No	Yes, up to 60 days
	Set up a free feed (needs a paid API plan during the beta)	Upgrade	Contact us

Choosing an output format

A feed's output format decides what each poll contains. Pick it by what you want to do: IP threat indicators to match IPs in your logs, Full-Spectrum Threat Graph to pivot between related addresses in a graph platform, IP threat indicators (extended) for your own STIX pipeline, or IP threat indicators with reports to see the individual reports behind an address. You pick it when you create the feed and can't change it later; create another feed if you need a different one.

• IP threat indicators: one indicator per IP, with context in labels. Use this unless you have a reason not to: it is the only format on the Free and Paid plans, and every platform guide below uses it.
• Full-Spectrum Threat Graph (Enterprise): the same indicators plus linked autonomous-system, domain and country objects, for graph platforms such as OpenCTI.
• IP threat indicators (extended) (Enterprise): the same context as typed fields (integers, ISO codes, timestamps) in a STIX extension, for your own pipelines that parse extensions instead of label strings.
• IP threat indicators with reports (Enterprise): each indicator followed by its recent individual reports as sightings, so you can see when, why and from which country an address was reported.

Client setup guides

Tested end to end against AbuseIPDB: Microsoft Sentinel, Splunk Enterprise Security and OpenCTI.

Not yet verified against AbuseIPDB; these guides follow each vendor's documented TAXII 2.1 setup: IBM QRadar, Palo Alto Cortex XSIAM / XSOAR, Google Security Operations, ThreatConnect, Anomali ThreatStream, EclecticIQ and MISP.

Other TAXII 2.1 clients have not been verified. Start with the IP threat indicators output format, which uses only standard STIX 2.1 indicator fields. If your client has trouble, contact us.

No SIEM or threat intelligence platform? You need a TAXII 2.1 client to read a feed; OpenCTI is a free, open-source platform tested with AbuseIPDB. If you only need a blocklist for a firewall or script, the blacklist endpoint you already use stays the simpler option.

Connection URLs

Which URL goes where depends on your client: some ask for the server (discovery) URL, some for the API root plus a Collection ID, and some for the full collection URL. Each platform guide says which.

Server / discovery URL (QRadar, Cortex, ThreatConnect, Anomali, Google SecOps, EclecticIQ Auto Discovery):
https://taxii.abuseipdb.com/taxii2/

API root URL (Sentinel, OpenCTI, EclecticIQ):
https://taxii.abuseipdb.com/taxii2/abuseipdb-taxii2/

Collection URL shape (Splunk, MISP):
https://taxii.abuseipdb.com/taxii2/abuseipdb-taxii2/collections/{collection-id}/

On My TAXII Feeds, copy a feed's Collection ID from the table, or its full URL from the feed's ⋯ menu (Copy collection URL).

Authentication

TAXII requests use HTTP Basic Auth, the scheme TAXII clients expect. The username is your AbuseIPDB account email; the password is any API key on your account, not your account password.

Look-back window

The look-back window limits how far back an Enterprise client can start an import. It selects indicators by when their latest report reached AbuseIPDB, not by attack date: the last 60 days (UTC), or the last 7 days for the IP threat indicators with reports output format. A start date older than this is moved forward to the start of the window. This is separate from an indicator's valid_until expiry. Free and Paid feeds don't use a look-back window: AbuseIPDB keeps your place in the feed (see Plans).

Query parameters

Most TAXII clients set these for you; they're listed here for testing and troubleshooting. Free and Paid feeds accept limit but ignore added_after and next.

Parameter	Description
limit	Maximum STIX objects in one response page. Integer, 10–1000. Defaults to 100, or 1000 for the reports format. Larger values are treated as 1000. The identity object, and any other objects the output format adds, count toward it.
added_after	Return only indicators whose latest report arrived at or after this timestamp. ISO 8601 UTC with a Z suffix, with or without fractional seconds (e.g. 2026-11-01T00:00:00.000Z). Maximum 60 days ago (7 for the reports format); earlier values are moved forward to the start of the look-back window, and future values are rejected. With neither added_after nor next, the stream starts 60 days ago (7 for the reports format).
next	Pagination cursor. Pass the value returned in the previous response's next field to fetch the next page. Takes precedence over added_after. A token whose position has aged out of the look-back window resumes from the start of the window.

Responses

A response is a TAXII envelope: {"more": true, "next": "…", "objects": [...]}. When more is false there is no next, and a page with nothing to send is {"more": false}. On Enterprise feeds, indicators are ordered by the arrival time of their latest report, then by IP address, and the first page of each sync (a request without next) starts with the AbuseIPDB identity object. Free and Paid feeds are served oldest first from AbuseIPDB's saved position (see Plans).

The X-TAXII-Date-Added-First and X-TAXII-Date-Added-Last headers carry the modified of the first and last indicator on the page. On an empty page both repeat the requested added_after.

What a page contains beyond indicators depends on the feed's output format; each format's guide is linked under Choosing an output format.

Polling

The intervals below are for clients that fetch every waiting page in each sync. OpenCTI fetches one page per check: leave its schedule at Platform default and follow its polling instructions.

Plan	How often to start a sync
Free	Once an hour
Paid	Once an hour
Enterprise	As agreed with AbuseIPDB; ask us if you have no agreed interval

Free and paid feeds: start a sync once an hour, and in each sync keep fetching pages while more is true. AbuseIPDB keeps your place in each feed and ignores added_after and next. At 00:00 UTC each feed starts again from the addresses added to the AbuseIPDB blacklist earliest and serves forward until the daily cap; once the cap is used, polls return no objects until the next UTC day. Indicators you already hold can come back with the same IDs, so a client that updates indicators by ID keeps one copy.

Enterprise feeds: follow next until a response has more set to false. On your next poll, send added_after set to the X-TAXII-Date-Added-Last header from your last response. The boundary is inclusive, so the last indicators can arrive again; your client updates them by ID. Most TAXII clients do this for you.

Errors

What an error from a collection URL means and how to fix it.

Status	What went wrong	How to fix it
401	The API key is missing, wrong or revoked.	Use your AbuseIPDB account email as the Basic Auth username and one of your API keys as the password, not your account password. Check the key is still listed on your API keys page.
403	The API key belongs to an account without STIX/TAXII access.	Use an API key from the account that owns your feeds. If that account cannot open My TAXII Feeds either, contact us.
403	Your client read the write-only AbuseIPDB reports collection instead of your feed, usually because its collection field was left empty, so it polled every collection the server lists.	Enter your feed's Collection ID, collection URL or title in the client, as its setup guide says. The reports collection only accepts pushed reports.
404	The URL is not one of your active custom feeds: it is incomplete or mistyped, the feed was deactivated or deleted, it belongs to another account, or its output format is not on your plan.	Copy the collection URL or Collection ID from your feed on My TAXII Feeds. If the feed is listed as inactive, reactivate it. If its output format isn't on your plan, create a feed in IP threat indicators or contact us about access. Open My TAXII Feeds
200, no objects	Not an error: nothing new matches your feed right now. On free and paid plans it can also mean today's indicator cap is used up.	Check your feed's filters on My TAXII Feeds. On Free and Paid feeds, also check Indicators today: the cap resets at 00:00 UTC.
422	limit is not a whole number, or is below 10.	Send a whole number from 10 to 1000, or leave limit out.
400	added_after is not a UTC timestamp ending in Z, or is in the future.	Send a timestamp such as 2024-01-01T00:00:00Z that is not later than now. Older timestamps are accepted and served from the start of the 60-day look-back window (7 for the reports format).
400	The next token was changed or cut short, or points to a time in the future.	Drop next and restart from your last good added_after, or with no added_after to pull the whole look-back window. Objects you already have come back with the same IDs; set your client to update indicators by ID, and check how it handles duplicates.

Free and paid feeds ignore added_after and next, so they never return a 400 for them.

Pushing reports back to AbuseIPDB (optional)

Optional: pulling feeds does not need this. Use it to report abuse your own organization observed, as abuse reports from your account, the same as reporting on the website or through the API. A match against an indicator you downloaded from AbuseIPDB is not, by itself, a new observation, so don't send feed indicators back. An envelope (the JSON body of one push request) creates at most one report per IP address: sightings merge into the indicator they reference, and supporting objects make no report.

Endpoint:
POST https://taxii.abuseipdb.com/taxii2/abuseipdb-taxii2/collections/c9f3c918-047e-493b-90b6-bc640e92bb86/objects/

Header: Content-Type: application/taxii+json;version=2.1 or Content-Type: application/stix+json;version=2.1
Body: a TAXII envelope, {"objects": [...]}, or a STIX bundle, {"type": "bundle", "id": "bundle--<UUID>", "objects": [...]}

STIX field	Report field
indicator.pattern	Reported IP. Must name exactly one IP: a single ipv4-addr or ipv6-addr equality, e.g. [ipv4-addr:value = '203.0.113.9'], or a network-traffic pattern of the kind MISP exports (pushing from MISP itself is not tested): a src_ref or dst_ref value equality optionally ANDed with a type equality on the same ref and a numeric port on the same side, e.g. [network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '203.0.113.9']. The port is ignored.
indicator.description	Comment.
indicator.valid_from	Time of attack. ISO 8601, not in the future, within the last 2 months. Defaults to now.
indicator.labels abuseipdb-category:<id>	Categories (at least one required), as AbuseIPDB category IDs. If your platform sends its tags as STIX labels when it pushes (OpenCTI does; see its guide), tag the indicator abuseipdb-category:<id> there.
sighting.sighting_of_ref	An indicator in the same envelope. The indicator still makes one report; its sightings are merged into it. If none of its sightings is accepted, the indicator is reported from its own fields.
sighting.description, sighting.last_seen (then first_seen), sighting.labels	The sighting with the latest last_seen (then first_seen) overrides the indicator's comment, time of attack and categories when present; fields it lacks are inherited from the indicator.

• The response is a TAXII status resource. Poll status/<id>/ under the API root until status: complete, then check the failures and each object's message. Complete means processing has finished, not that every report succeeded. Counts are STIX objects, not reports: merged objects and ignored supporting objects count as successes without making extra reports. Statuses expire after 3 hours.
• Every object needs a STIX id of its own type, e.g. indicator--<UUID>.
• count on sightings is ignored.
• Each IP is reported at most once per envelope: the object with the latest time of attack wins, and every other object for that IP shares its outcome.
• Objects that accompany indicators in a MISP export (identity, report, grouping, marking-definition, note, observed-data, ipv4-addr, ipv6-addr, network-traffic, relationship, opinion) are listed as successes with "Ignored: not reportable" and make no report. Any other object type fails on its own without affecting the rest of the envelope.
• Limits: 1,000 objects and 10 MB per request, 10 requests per minute, one report per IP per 15 minutes, and your account's daily report limit (the same one the API uses).

{
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11111111-1111-4111-8111-111111111111",
      "created": "2026-11-01T00:00:00.000Z",
      "modified": "2026-11-01T00:00:00.000Z",
      "pattern": "[ipv4-addr:value = '203.0.113.9']",
      "pattern_type": "stix",
      "valid_from": "2026-11-01T00:00:00.000Z",
      "description": "SSH brute force",
      "labels": ["abuseipdb-category:18"]
    }
  ]
}