IP Abuse Contact Database

Overview

Our IP Abuse Contact Database gives you instant access to the correct abuse desk for any routable IP that connecting you to verified addresses, phone numbers, and emails worldwide. By mapping IPs to the responsible operator (ISPs, cloud providers, hosting networks, and enterprises) and their preferred reporting channels, it streamlines abuse escalation, speeds up takedowns, and helps you quickly pinpoint the source of malicious or unwanted activity to keep your environment safer.

Updated daily and delivered as CSV and MMDB, with JSON, Parquet, or any custom export on request at no extra cost and backed by stable schemas and changelogs. Each record includes organization and netblock context, primary abuse mailbox and phone. Below, you'll find full documentation of the archive contents, schema definitions, file specifications, and integration notes to help you integrate with SIEM/SOAR, ticketing, and security workflows—fast.

Available Database Formats

CSV

File Size: 341.02 MB

Entries: 32.8M

Fields: 9

Last Updated: Yesterday

Documentation

MMDB

File Size: 791.04 MB

Entries: 32.8M

Fields: 9

Last Updated: Yesterday

Documentation

CSV Database Documentation

1. Overview

The CSV version is a set of Gzip-compressed CSV files containing IP ranges and their Abuse Contact details. Designed for bulk imports and integration into relational databases.

2. Archive Content

After downloading and extracting the IP to Abuse Contact CSV database archive, you'll find the following files (with their types noted):

db-abuse-details.csv.gz

Gzip-compressed CSV provides abuse contact info: unique ID, network, and contact details.

File Size: 115.06 MB

Entries: 12.4M

Fields: 8

db-ip-abuse.csv.gz

Each start_ip, end_ip link to the abuse details ID that is related to the abuse-details file.

File Size: 225.96 MB

Entries: 32.8M

Fields: 3

README.md

Documentation for dataset contents, schema, usage, and support.

File Size: 5.60 KB

checksum.txt

SHA-256 checksums for verifying file integrity.

File Size: 251 Bytes

Schema

This section describes the schema of each file included in the IP to Abuse Contact Database archive. For every file, you'll find its purpose, field definitions, and examples to help with integration.

1. db-ip-abuse.csv.gz

This file contains IP address ranges linked to abuse details. It maps each IP block to a unique abuse_details_id , which in turn corresponds to the abuse contact information.

Field	Type	Description	Can be empty?	Example
start_ip	string	The starting IP address of the range in IPv4 or IPv6 format.	No	192.168.0.1
end_ip	string	The ending IP address of the range in IPv4 or IPv6 format.	No	192.168.0.255
id	number	The unique identifier for the abuse contact.	No	1

I. Example Records

Example

start_ip,end_ip,abuse_details_id
60.68.68.117,60.68.68.117,1499572
77.131.193.0,77.131.193.255,3234354
86.64.61.72,86.64.61.75,4337814
124.105.48.237,124.105.48.237,6585760
71.232.160.26,71.232.160.26,2843668
176.113.74.47,176.113.74.47,7487439
24.189.57.25,24.189.57.25,566562
109.79.36.5,109.79.36.5,5951066
136.142.159.2,136.142.159.2,6802835
93.11.239.0,93.11.239.69,4995087

2. db-abuse-details.csv.gz

This file provides detailed abuse contact information. It links a unique ID to a specific network, country, and other contact details, including name, address, emails, and phone numbers.

Field	Type	Description	Can be empty?	Example
id	number	The unique identifier for the abuse contact.	No	1
network	string	The network associated with the abuse contact.	Yes	192.168.1.0/24
country	string	The ISO 3166-1 alpha-2 code of the country associated with the abuse contact.	Yes	US
kind	string	The kind specifies whether the contact is a person or an organization.	Yes	group
name	object	The name (english) of the abuse contact.	Yes	Abuse Team
address	string	The physical address of the abuse contact.	Yes	1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
emails	string	Comma-separated email addresses associated with the abuse contact.	Yes	abuse@example.com
phone_numbers	string	Comma-separated phone numbers associated with the abuse contact.	Yes	+1-800-555-0199

I. Example Records

Example

id,network,country,kind,name,address,emails,phone
1499572,60.64.0.0/12,JP,group,IRT-SOFTBANK-JP,"Tokyo Portcity Takeshiba Office Tower 21F, 1-7-1, Kaigan, Minatoku,Tokyo, Japan",abuse@e.softbank.co.jp,+81366885120
2843668,71.232.0.0/15,US,group,Network Abuse and Policy Observance,"1800 Bishops Gate Blvd, Mount Laurel, NJ, 08054, United States",abuse@comcast.net,+18885654329
6585760,124.105.48.237/32,PH,group,IRT-PLDT-PH,"Philippine Long Distance Telephone Company, G/F PLDT Smart Integrated Center (IOC), Nicanor Garcia St, Makati City, Philippines",abuse@pldt.net,+6325840201
566562,24.189.56.0/22,US,group,OOL Hostmaster,"111 new south RD, Hicksville, NY, 11801, United States","hostmaster@alticeusa.com, abuse@alticeusa.com",+15168032300
3234354,77.131.192.0/19,FR,group,Abuse-C Role,SFR Xavier Caillaud Immeuble Quai Ouest 40-42 Quai Du Point Du Jour 92100 BOULOGNE-BILLANCOURT France,abuse@gaoland.net,+33185060000
4995087,93.11.232.0/21,FR,group,Abuse-C Role,SFR Xavier Caillaud Immeuble Quai Ouest 40-42 Quai Du Point Du Jour 92100 BOULOGNE-BILLANCOURT France,abuse@gaoland.net,+33185060000
7487439,176.113.74.0/24,RO,group,M247 Europe,"Sos. Fabrica de Glucoza, Nr 11B, etaj 1, Sector 2, Bucuresti Romania","abuse@m247.ro, abuse@m247.com",+40310800700
4337814,86.64.0.0/17,FR,group,Abuse-C Role,SFR Xavier Caillaud Immeuble Quai Ouest 40-42 Quai Du Point Du Jour 92100 BOULOGNE-BILLANCOURT France,abuse@gaoland.net,+33185060000
5951066,109.79.32.0/21,IE,group,Vodafone Ireland Limited,"MountainView, Leopardstown Dublin 18, IRELAND",spam.ie@vodafone.com,"+3538756227222, +353876227222"
6802835,136.142.0.0/16,US,group,abuse,"Computing Services and Systems Development, 709 Cathedral of Learning, Pittsburgh, PA, 15260, United States",abuse@pitt.edu,+14126244357

3. File Relationship Diagram

The diagram below illustrates the relationships between the various files included in the CSV database package. It shows how the main CSV file connects to reference table for abuse contact details, ensuring accurate data linkage and integrity.

File Format & Encoding

All IP to Abuse Contact CSV datasets are provided in UTF-8 encoding, comma-separated, and compressed with Gzip (.csv.gz). Each file includes a header row listing the field names for clarity and consistency.

Field values are unquoted by default, with quotes applied only in the following cases:

Line breaks within text fields.
Commas inside a value (e.g., addresses).
Lists of values (e.g., languages).
Spaces that may be auto-quoted by export tools.

MMDB Database Documentation

1. Overview

MMDB version of the database consists of three files: one MMDB file containing all the abuse contact data, a README file, and a checksum file, all compressed together in a ZIP file for easy delivery.

2. Archive Content

After downloading and extracting the IP to Abuse Contact MMDB database archive, you'll find the following files (with their types noted):

db-ip-abuse.mmdb

Provides full abuse contact details for IP addresses: network, country, kind, and contact info.

File Size: 791.04 MB

Entries: 32.8M

README.md

Documentation for dataset contents, schema, usage, and support.

File Size: 3.92 KB

checksum.txt

SHA-256 checksums for verifying file integrity.

File Size: 159 Bytes

Response Schema

This section describes the structure of the data returned from the IP to Abuse Contact MMDB file. Each field is detailed with its type, meaning, and example values to help you interpret responses and integrate them into your applications.

1. db-ip-abuse.mmdb

This file contains abuse contact details for both IPv4 and IPv6 address ranges. Below is an example of the structure you will encounter in the response.

2. Field Reference

The following reference lists all fields available in the MMDB response. Each entry includes the field path, its description, data type, and example value to help you understand how to parse and integrate the data.

Showing 0 of 7

Select a field to view details

I. Example Records

Example

{
  "abuse": {
    "address": "Tokyo Portcity Takeshiba Office Tower 21F, 1-7-1, Kaigan, Minatoku,Tokyo, Japan",
    "country_code": "JP",
    "emails": "abuse@e.softbank.co.jp",
    "kind": "group",
    "name": {
      "en": "IRT-SOFTBANK-JP"
    },
    "phone_numbers": "+81366885120",
    "route": "60.64.0.0/12"
  }
}

Database Integrity & Authenticity Verification

There are two methods of verifying the integrity and authenticity of our Database:

1. Using the Signature File (Recommended)

IPGeolocation.io signs every database release to ensure its authenticity and integrity. This allows customers to verify that a downloaded IP to Abuse Contact database file originates directly from IPGeolocation.io and has not been altered, corrupted, or tampered with during transfer or storage.

Each database update includes a corresponding signature file, generated using our private signing key. Customers can validate the database using the provided public verification key. To verify a database file, you need:

Database file (the downloaded archive)
Signature file (the matching signature for that archive)
Public key (public-key.pem)

These files are available via official IPGeolocation.io download endpoints and are also shared in database update notifications.

Note

The public key may be provided as PEM-encoded text. Save it to a file named public-key.pem

Ensure OpenSSL is installed on your system. If not, install it using the following commands

On Linux, if openssl is not installed

sudo apt install openssl

Verify OpenSSL installation:

openssl version

To verify the database file, run the following command, replacing the placeholders with your actual file paths:

openssl dgst -sha256 -verify <path-to-public-key.pem> -signature <path-to-signature-file.sig> <path-to-database-file.zip>

Example output:

Verified OK

if verification FAILED do not use the file, re-download the database and signature from official IPGeolocation endpoints. If the issue persists, please contact our support team.

2. Using the Checksum File (Legacy)

Each database archive includes a checksum.txt file containing the SHA-256 checksums for the files packaged in the archive. You can use this file to validate that the extracted contents are complete and unchanged.

Tip

Always verify downloaded files with the provided checksum before importing.

On Linux, if sha256sum is not installed, first run:

sudo apt-get install coreutils

Then check the archive files against the checksum file with:

sha256sum -c checksum.txt

Example output:

db-abuse-details.csv.gz: OK
db-ip-abuse.csv.gz: OK
README.md: OK

*your output may differ depending on the specific database archive you downloaded.

If a file's checksum does not match, FAILED will be shown instead of OK . If verification fails, first confirm that the download completed correctly; if the issue persists, please contact our support team.

Data Format & Constraints

All fields defined in the schema are always present in the IP to Abuse Contact MMDB response.
Fields may contain empty strings (""), but never null, so null checks are not required.
Place names such as countries, states, districts, and cities are available in multiple translations.
All text values are encoded in UTF-8.
Field names and response structure remain stable across updates for backward compatibility.

Database Updates & Delivery

When you subscribe to our IP to Abuse Contact database, we'll send you static download links. These links never change, so you can use them both for your initial download and for all future updates. You will receive:

Database Archive URL : downloads the latest release of your subscribed database (CSV, MMDB or requested formats).
Signature File URL : downloads the matching signature file for the latest release (used for authenticity verification).
Public Key URL : downloads the public verification key (used with the signature file).
Status Endpoint URL : returns the database's most recent update timestamp.

Our databases are updated continuously and shipped on a daily or weekly cycle depending on your plan, ensuring you always have access to the most current data. Each time your subscribed dataset is updated, you'll also receive an email notification so you don't miss a release.

For automated workflows, you can check our status endpoint to see the last update timestamp. When the date changes, simply re-fetch the archive using your static download URL to pull the latest version into your system.

IP Abuse Contact Database

Overview

Available Database Formats

CSV Database Documentation

1. Overview

2. Archive Content

Schema

1. db-ip-abuse.csv.gz

I. Example Records

2. db-abuse-details.csv.gz

I. Example Records

3. File Relationship Diagram

File Format & Encoding

MMDB Database Documentation

1. Overview

2. Archive Content

Response Schema

1. db-ip-abuse.mmdb

2. Field Reference

I. Example Records

Database Integrity & Authenticity Verification

1. Using the Signature File (Recommended)

2. Using the Checksum File (Legacy)

Data Format & Constraints

Database Updates & Delivery

Subscribe to Our Newsletter