IP Abuse Contact Database
Overview
Our IP Abuse Contact Database gives you instant access to the correct abuse desk for any routable IP that connecting you to verified addresses, phone numbers, and emails worldwide. By mapping IPs to the responsible operator (ISPs, cloud providers, hosting networks, and enterprises) and their preferred reporting channels, it streamlines abuse escalation, speeds up takedowns, and helps you quickly pinpoint the source of malicious or unwanted activity to keep your environment safer.
Updated daily and delivered in flexible formats (CSV, JSON, MMDB, or custom exports/API), each record includes organization and netblock context, primary abuse mailbox and phone. Below, you'll find full documentation of the archive contents, schema definitions, file specifications, and integration notes to help you integrate with SIEM/SOAR, ticketing, and security workflows—fast.
Available Database Formats
CSV Database Documentation
1.Overview
The CSV version is a set of Gzip-compressed CSV files containing IP ranges and their Abuse Contact details. Designed for bulk imports and integration into relational databases.
2.Archive Content
After downloading and extracting the IP to Abuse Contact CSV database archive, you’ll find the following files (with their types noted):
db-abuse-details.csv.gzGzip-compressed CSV provides abuse contact info: unique ID, network, and contact details.
db-ip-abuse.csv.gzEach start_ip, end_ip link to the abuse details ID that is related to the abuse-details file.
README.mdDocumentation for dataset contents, schema, usage, and support.
checksum.txtSHA-256 checksums for verifying file integrity.
Always verify downloaded files with the provided checksum before importing.
On Linux, if sha256sum is not installed, first run:
sudo apt-get install coreutilsThen check the archive files against the checksum file with:
sha256sum -c checksum.txtExample output:
db-abuse-details.csv.gz: OK
db-ip-abuse.csv.gz: OK
README.md: OKIf a file’s checksum does not match, FAILED will be shown instead of OK . If verification fails, first confirm that the download completed correctly; if the issue persists, please contact our support team.
Schema
This section describes the schema of each file included in the IP to Abuse Contact Database archive. For every file, you’ll find its purpose, field definitions, and examples to help with integration.
1.db-ip-abuse.csv.gz
This file contains IP address ranges linked to abuse details. It maps each IP block to a unique abuse_details_id , which in turn corresponds to the abuse contact information.
| Field | Type | Description | Can be empty? | Example |
|---|---|---|---|---|
| start_ip | string | The starting IP address of the range in IPv4 or IPv6 format. | No | 192.168.0.1 |
| end_ip | string | The ending IP address of the range in IPv4 or IPv6 format. | No | 192.168.0.255 |
| id | number | The unique identifier for the abuse contact. | No | 1 |
abuse_details_id joins to db-abuse-details.id to get abuse contact information for IP.Example Records
2.db-abuse-details.csv.gz
This file provides detailed abuse contact information. It links a unique ID to a specific network, country, and other contact details, including name, address, emails, and phone numbers.
| Field | Type | Description | Can be empty? | Example |
|---|---|---|---|---|
| id | number | The unique identifier for the abuse contact. | No | 1 |
| network | string | The network associated with the abuse contact. | Yes | 192.168.1.0/24 |
| country | string | The ISO 3166-1 alpha-2 code of the country associated with the abuse contact. | Yes | US |
| kind | string | The kind specifies whether the contact is a person or an organization. | Yes | group |
| name | object | The name (english) of the abuse contact. | Yes | Abuse Team |
| address | string | The physical address of the abuse contact. | Yes | 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA |
| emails | string | Comma-separated email addresses associated with the abuse contact. | Yes | abuse@example.com |
| phone_numbers | string | Comma-separated phone numbers associated with the abuse contact. | Yes | +1-800-555-0199 |
id in the db-abuse-details.csv.gz file joins to the abuse_details_id field in db-ip-abuse.csv.gzExample Records
3.File Relationship Diagram
The diagram below illustrates the relationships between the various files included in the CSV database package. It shows how the main CSV file connects to reference table for abuse contact details, ensuring accurate data linkage and integrity.
File Format & Encoding
All IP to Abuse Contact CSV datasets are provided in UTF-8 encoding, comma-separated, and compressed with Gzip (.csv.gz). Each file includes a header row listing the field names for clarity and consistency.
Field values are unquoted by default, with quotes applied only in the following cases:
- Line breaks within text fields.
- Commas inside a value (e.g., addresses).
- Lists of values (e.g., languages).
- Spaces that may be auto-quoted by export tools.
MMDB Database Documentation
1.Overview
MMDB version of the database consists of three files: one MMDB file containing all the abuse contact data, a README file, and a checksum file, all compressed together in a ZIP file for easy delivery.
2.Archive Content
After downloading and extracting the IP to Abuse Contact MMDB database archive, you’ll find the following files (with their types noted):
db-ip-abuse.mmdbProvides full abuse contact details for IP addresses: network, country, kind, and contact info.
README.mdDocumentation for dataset contents, schema, usage, and support.
checksum.txtSHA-256 checksums for verifying file integrity.
Always verify downloaded files with the provided checksum before importing.
On Linux, if sha256sum is not installed, first run:
sudo apt-get install coreutilsThen check the archive files against the checksum file with:
sha256sum -c checksum.txtExample output:
db-ip-abuse.mmdb: OK
README.md: OKIf a file’s checksum does not match, FAILED will be shown instead of OK . If verification fails, first confirm that the download completed correctly; if the issue persists, please contact our support team.
Response Schema
This section describes the structure of the data returned from the IP to Abuse Contact MMDB file. Each field is detailed with its type, meaning, and example values to help you interpret responses and integrate them into your applications.
1.db-ip-abuse.mmdb
This file contains abuse contact details for both IPv4 and IPv6 address ranges. Below is an example of the structure you will encounter in the response.
2.Field Reference
The following reference lists all fields available in the MMDB response. Each entry includes the field path, its description, data type, and example value to help you understand how to parse and integrate the data.
Example Records
Data Format & Constraints
- All fields defined in the schema are always present in the IP to Abuse Contact MMDB response.
- Fields may contain empty strings (""), but never null, so null checks are not required.
- Place names such as countries, states, districts, and cities are available in multiple translations.
- All text values are encoded in UTF-8.
- Field names and response structure remain stable across updates for backward compatibility.
Database Updates & Delivery
When you subscribe to our IP to Abuse Contact database, we’ll send you static download links for the archive in your chosen formats. These links never change, so you can use them both for your initial download and for all future updates.
Our databases are refreshed daily and weekly, ensuring you always have access to the most current data. Each time your subscribed dataset is updated, you’ll also receive an email notification so you don’t miss a release.
For automated workflows, you can check our status endpoint to see the last update timestamp. When the date changes, simply re-fetch the archive using your static download URL to pull the latest version into your system.
