IP Abuse Contact Database

Overview

Our IP Abuse Contact Database gives you instant access to the correct abuse desk for any routable IP that connecting you to verified addresses, phone numbers, and emails worldwide. By mapping IPs to the responsible operator (ISPs, cloud providers, hosting networks, and enterprises) and their preferred reporting channels, it streamlines abuse escalation, speeds up takedowns, and helps you quickly pinpoint the source of malicious or unwanted activity to keep your environment safer.

Updated daily and delivered in flexible formats (CSV, JSON, MMDB, or custom exports/API), each record includes organization and netblock context, primary abuse mailbox and phone. Below, you'll find full documentation of the archive contents, schema definitions, file specifications, and integration notes to help you integrate with SIEM/SOAR, ticketing, and security workflows—fast.

Available Database Formats

CSV

• File Size: 318.19 MB

• Entries: 29.9M

• Fields: 9

• Last Updated: Today

Documentation

MMDB

• File Size: 763.54 MB

• Entries: 29.9M

• Fields: 9

• Last Updated: Today

Documentation

CSV Database Documentation

db-abuse-details.csv.gz

Gzip-compressed CSV provides abuse contact info: unique ID, network, and contact details.

• File Size: 111.32 MB

• Entries: 12.3M

• Fields: 8

db-ip-abuse.csv.gz

Each start_ip, end_ip link to the abuse details ID that is related to the abuse-details file.

• File Size: 206.87 MB

• Entries: 29.9M

• Fields: 3

README.md

Documentation for dataset contents, schema, usage, and support.

• File Size: 4.55 KB

checksum.txt

SHA-256 checksums for verifying file integrity.

• File Size: 251 Bytes

Schema

This section describes the schema of each file included in the IP to Abuse Contact Database archive. For every file, you'll find its purpose, field definitions, and examples to help with integration.

start_ip,end_ip,abuse_details_id
202.83.50.21,202.83.50.21,9053784
182.177.150.75,182.177.150.75,7699976
205.250.74.37,205.250.74.37,9263600
191.255.84.0,191.255.84.72,8198055
99.139.209.19,99.139.209.19,5509570
66.117.238.222,66.117.238.222,2294295
208.98.142.243,208.98.142.243,9397770
36.161.58.204,36.161.58.204,688694
1.178.130.23,1.178.130.23,4586
71.173.198.83,71.173.198.83,2818393

id,network,country,kind,name,address,emails,phone
2294295,66.117.192.0/18,,group,Fuse Internet Access Abuse Team,"209 W. Seventh St.
MS 121-550
Cincinnati
OH
45202
United States",abuse@fuse.net,+1-513-397-6598
9397770,208.98.142.0/23,,org,Farmers Mutual Telephone Company,"319 SW 3rd St
Fruitland
ID
83619
United States",,
4586,1.178.128.0/20,PS,group,Abuse-C Role,"Palestine Telecommunications (PALTEL) Khaled Sayeh Rafeedya St. 1570 Nablus PALESTINIAN TERRITORY, OCCUPIED",RipeAdmin.TechEng@PaltelGroup.ps,"+ 970 9 2376227, + 970 9 2376225"
688694,36.128.0.0/10,CN,group,IRT-CHINAMOBILE2-CN,"China Mobile Communications Corporation
29, Jinrong Ave., Xicheng District, Beijing, 100032",abuse@chinamobile.com,"+86 1052686688, +86 10 52616187"
5509570,99.128.0.0/13,,group,abuse,"2701 W 15th ST
Plano
TX
75075
United States",abuse@att.net,+1-919-319-8167
9263600,205.250.74.0/24,,group,Abuse at TELUS,"10035 102 AVE
Edmonton
AB
T5J 0E5
Canada",abuse@telus.com,+1-877-945-8220
8198055,191.254.0.0/15,BR,individual,CSIRT TELEFONICA BR,,abuse.br@telefonica.com,
7699976,182.177.0.0/16,PK,group,IRT-PTCLBB-PK,"General Manager,
Pakistan Telecommunication Company Limited.
H-9/1, CDDT Building, Training Block
Islamabad, Pakistan","abuse.irt@ptcl.net, csirt@ptcl.net",+92-51-4865412
9053784,202.83.32.0/19,IN,group,IRT-ASIANET-IN,"2 nd Floor , Leela Tower
Technopark,Kazhakuttam
Trivandrum
Kerala","abuse-reports@asianet.co.in, muralin@asianet.co.in","+91 471 2527878, +91 471 2700244, +91 471 3071300, +91 471 3071100"
2818393,71.173.96.0/19,,group,Abuse,"22001 Loudoun County Parkway
Asburn
VA
20147
United States",abuse@verizon.com,+1-800-900-0241

---

3.File Relationship Diagram

The diagram below illustrates the relationships between the various files included in the CSV database package. It shows how the main CSV file connects to reference table for abuse contact details, ensuring accurate data linkage and integrity.

Expand

File Format & Encoding

All IP to Abuse Contact CSV datasets are provided in UTF-8 encoding, comma-separated, and compressed with Gzip (.csv.gz). Each file includes a header row listing the field names for clarity and consistency.

Field values are unquoted by default, with quotes applied only in the following cases:

• Line breaks within text fields.
• Commas inside a value (e.g., addresses).
• Lists of values (e.g., languages).
• Spaces that may be auto-quoted by export tools.

MMDB Database Documentation

db-ip-abuse.mmdb

Provides full abuse contact details for IP addresses: network, country, kind, and contact info.

• File Size: 763.54 MB

• Entries: 29.9M

README.md

Documentation for dataset contents, schema, usage, and support.

• File Size: 4.55 KB

checksum.txt

SHA-256 checksums for verifying file integrity.

• File Size: 159 Bytes

Response Schema

This section describes the structure of the data returned from the IP to Abuse Contact MMDB file. Each field is detailed with its type, meaning, and example values to help you interpret responses and integrate them into your applications.

{
  "abuse": {
    "address": "2 nd Floor , Leela Tower\nTechnopark,Kazhakuttam\nTrivandrum\nKerala",
    "country_code": "IN",
    "emails": "abuse-reports@asianet.co.in, muralin@asianet.co.in",
    "kind": "group",
    "name": {
      "en": "IRT-ASIANET-IN"
    },
    "phone_numbers": "+91 471 2527878, +91 471 2700244, +91 471 3071300, +91 471 3071100",
    "route": "202.83.32.0/19"
  }
}

Database Integrity & Authenticity Verification

There are two methods of verifying the integrity and authenticity of our Database:

sudo apt install openssl

openssl version

openssl dgst -sha256 -verify <path-to-public-key.pem> -signature <path-to-signature-file.sig> <path-to-database-file.zip>

Verified OK

sudo apt-get install coreutils

sha256sum -c checksum.txt

db-abuse-details.csv.gz: OK
db-ip-abuse.csv.gz: OK
README.md: OK

Data Format & Constraints

• All fields defined in the schema are always present in the IP to Abuse Contact MMDB response.
• Fields may contain empty strings (""), but never null, so null checks are not required.
• Place names such as countries, states, districts, and cities are available in multiple translations.
• All text values are encoded in UTF-8.
• Field names and response structure remain stable across updates for backward compatibility.

Database Updates & Delivery

When you subscribe to our IP to Abuse Contact database, we'll send you static download links. These links never change, so you can use them both for your initial download and for all future updates. You will receive:

1. Database Archive URL : downloads the latest release of your subscribed database (CSV, MMDB or requested formats).
2. Signature File URL : downloads the matching signature file for the latest release (used for authenticity verification).
3. Public Key URL : downloads the public verification key (used with the signature file).
4. Status Endpoint URL : returns the database's most recent update timestamp.

Our databases are refreshed daily and weekly, ensuring you always have access to the most current data. Each time your subscribed dataset is updated, you'll also receive an email notification so you don't miss a release.

For automated workflows, you can check our status endpoint to see the last update timestamp. When the date changes, simply re-fetch the archive using your static download URL to pull the latest version into your system.