The IP Abuse Contact API returns the abuse contact for any IPv4 or IPv6 address: emails, phone numbers, organization, kind, postal address, route, and country. The data comes from records registered with all five Regional Internet Registries and refreshes daily, so your report reaches the team responsible for investigating the abuse. Free Trial Available
ip:"216.73.217.15",
abuse:Object,route:"216.73.216.0/22",country:"US",name:"Anthropic",organization:"Anthropic",kind:"group",address:"548 Market St., PMB 90375, San Francisco, CA, 94104-5401, United States",emails[0]:"arin@anthropic.com",phone_numbers[0]:"+1-415-236-0599",
One request to /v3/abuse returns the full abuse-handling record for the IP's network. The live example shown is real output. Four groups of fields cover who to contact, how to reach them, and which route they answer for.
name , organization , and kind identify the abuse handler: the registered role or team, the organization behind it, and whether the contact is a group or an individual. Useful for addressing the report properly and for compliance records that need a named responsible party.
Full field-by-field reference in the IP Abuse Contact API documentation.
Abuse contact data comes from the registration records network operators file with the five Regional Internet Registries: ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC. We collect those WHOIS and RDAP records, normalize them into one JSON shape, and refresh the dataset every day.
Every allocated IP range carries registered abuse-handling contacts in WHOIS and RDAP. Formats differ by registry, fields go stale, and free-text records resist parsing. We pull from all five registries so coverage is global, IPv4 and IPv6.
Five registries, one response. Instead of parsing five text formats and RDAP entity roles yourself, every lookup returns the same fields in the same place: name, organization, kind, address, emails, phone numbers, route, and country.
Operators change abuse desks, route ranges change hands, contacts rot. The dataset rebuilds every day so a lookup reflects current registrations, not last quarter's. Data refreshes daily.
To report IP abuse, look up the abuse contact for the offending IP, then send the evidence to the registered email with timestamps and logs. The API turns the lookup step into one request, so reporting can run inside your tooling.
Call /v3/abuse with the offending IP. You get back the registered abuse emails, phone numbers, organization, and the CIDR route the contact is responsible for.
Include the IP, UTC timestamps, what it did, and how often. Keep it short and factual; abuse desks triage hundreds of these a day.
Email the registered address and store the incident for your records. For live attacks where minutes matter, use the registered phone number instead of waiting on an inbox.
Every abuse workflow starts with the same question: who is responsible for this IP? Here is how teams that report abuse for a living answer it, and the one check worth running first.
Hosting providers, registrars, and email platforms route outbound complaints automatically: detect the incident, look up the responsible network's contact, file the report with evidence attached. No analyst time spent digging through registry records for every offending IP.
SOC teams add the abuse contact to alert context, so the analyst who confirms an attack already knows who to notify and which CIDR range the notification covers. Escalation starts faster after detection instead of after a manual WHOIS session.
When harmful content or traffic traces back to an IP, legal and trust-and-safety teams get a documented, named recipient for takedown requests and complaints, plus the postal address that formal notices and legal follow-up require.
Detection is a different job: the IP Security API scores an IP for VPN, proxy, Tor, bot, and attacker signals with a 0 to 100 threat score. Score it there, report it here.
Same abuse contact data, two ways to run it.
1{
2 "ip": "8.8.8.8",
3 "abuse": {
4 "route": "8.8.8.0/24",
5 "country": "US",
6 "name": "Abuse",
7 "organization": "Abuse",
8 "kind": "group",
9 "address": "1600 Amphitheatre Parkway Mountain View, CA, 94043, United States",
10 "emails": [
11 "network-abuse@google.com"
12 ],
13 "phone_numbers": [
14 "+16502530000"
15 ]
16 }
17}Real-time lookups, one IP per request, 1 credit each, no rate limits. Need abuse contacts alongside location, ASN, and security data, or in batches of up to 50,000 IPs? Use the unified endpoint with include=abuse; the bulk lookup docs cover it.
The full dataset as CSV or MMDB, refreshed daily, for offline matching, air-gapped environments, and volumes where per-request calls stop making sense. Licensed separately from API plans. See the IP Abuse Contact Database page.
Quickly identify and report abusive IP addresses generating malicious traffic to the relevant authorities. This rapid action significantly helps in preventing further abuse and protecting network integrity by promptly alerting internet service providers and network owners. This process minimizes the window for attackers and ensures a more secure online environment for all users and services.
Effectively spot and handle phishing attacks by accurately tracing and reporting the origin IP addresses. This helps protect users from clicking malicious links and leaking their personal and sensitive data. By disrupting the source of these attacks, we can reduce successful phishing attempts and enhance the protection of digital platforms for overall online safety.
Monitor the IP addresses that are sending spam and report them to the relevant authorities in order to reduce their impact on email systems. This essential action creates a smooth communication environment for businesses and individual users alike. By proactively identifying and blocking spam sources, we can ensure communication integrity and minimize unwanted disruptions.
Integrate comprehensive abuse contact data directly into automated systems for real-time response to suspicious activities. This powerful automation enables immediate flagging and mitigation of threats, significantly reducing manual work. It ensures a proactive security measure to help take swift action against emerging online threats and protect critical infrastructure across the internet.
Leverage abuse contact information to meet compliance requirements and effectively report abuse cases. This data is crucial for initiating legal proceedings against entities involved in harmful activities such as IP hijacking or data breaches. By providing concrete evidence, it ensures accountability and supports the enforcement of digital legal frameworks. This approach helps protect user data and safeguard online assets.
Utilize comprehensive abuse contact data to significantly strengthen network defenses against online threats like DDoS attacks, malicious actors, and IP spoofing. This strategic approach ensures uninterrupted services and strong protection against cyber threats. By utilizing this data, organizations have the ability to prevent known threats and improve their defenses.
An IP abuse contact is the person or team a network operator registers to receive reports about malicious activity coming from its IP ranges. Every allocated range carries one in the internet registry system. The IP Abuse Contact API returns that record as structured JSON, including the name, organization, kind, postal address, email addresses, and phone numbers.
Email the registered abuse address with the offending IP address, UTC timestamps, and relevant log excerpts showing the activity, then keep a copy with your incident record. If an attack is active and requires an immediate response, call the registered phone number. The contact belongs to the network operator responsible for the IP range, allowing them to investigate or suspend the source.
A community abuse-report database tells you whether an IP address has been reported as abusive. The IP Abuse Contact API tells you who is responsible for the IP address and how to contact them. You can combine it with the IP Security API to assess the IP first and then report confirmed malicious activity to the responsible network operator.
The dedicated /v3/abuse endpoint supports one IP address per request. For larger batches, use the Bulk IP Geolocation API with include=abuse to get the abuse object, or get the IP Abuse Contact Database in CSV or MMDB format for offline matching at any scale. The database is refreshed daily.
Call /v3/abuse with an IPv4 or IPv6 address and your API key. One request returns the abuse handler's email addresses, phone numbers, organization, kind, postal address, route, and registration country as a single JSON object. You can also reduce the response using the fields parameter and test the endpoint with a free trial.
Abuse contact information comes from the registration records network operators submit to the five Regional Internet Registries: ARIN , RIPE NCC , APNIC , LACNIC , and AFRINIC . We collect WHOIS and RDAP records, normalize them into a consistent JSON format, and refresh the dataset daily so lookups reflect current ownership and contact information.
The IP Abuse Contact API is available on paid plans starting from $19/month , and a free trial is available for evaluation. Each lookup costs 1 credit , so the Starter plan's 150,000 monthly credits cover 150,000 abuse contact lookups. API keys on the free tier receive a 401 response when calling /v3/abuse .
Enrich every request with precise geolocation and real-time threat intelligence, delivered on a global edge with a 99.99% uptime SLA. Start free and scale when you’re ready.
Get the latest in geolocation tech, straight to your inbox.
