AbuseIPDB API

Use in your agent

Load AbuseIPDB IP checks into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.

Access

• Create a free AbuseIPDB account and place its API key in ABUSEIPDB_API_KEY.
• The free plan is for evaluation, contribution or non-commercial personal projects.

Request

curl -G 'https://api.abuseipdb.com/api/v2/check' --data-urlencode 'ipAddress=1.1.1.1' --data-urlencode 'maxAgeInDays=30' -H "Key: $ABUSEIPDB_API_KEY" -H 'Accept: application/json'

Format

JSON:API-style response whose data object includes IP identity, country, usage type, ISP, domain, whitelist state, abuseConfidenceScore, totalReports, lastReportedAt and optional report details.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

"""AbuseIPDB checks for caller-supplied IPs -> pandas -> Parquet."""
import os
import requests
import pandas as pd

URL = "https://api.abuseipdb.com/api/v2/check"
IPS = ["1.1.1.1"]  # Replace with IPs from your own defensive telemetry.
headers = {"Key": os.environ["ABUSEIPDB_API_KEY"], "Accept": "application/json"}
rows = []
for ip in IPS:
    r = requests.get(URL, headers=headers,
                     params={"ipAddress": ip, "maxAgeInDays": 30}, timeout=30)
    r.raise_for_status()
    rows.append(r.json()["data"])
df = pd.json_normalize(rows, sep="_")
if "lastReportedAt" in df:
    df["lastReportedAt"] = pd.to_datetime(df["lastReportedAt"], utc=True, errors="coerce")
df.to_parquet("abuseipdb_checks.parquet", index=False)
print(len(df), "IP checks", "maximum confidence score", df["abuseConfidenceScore"].max())

Not run: it needs a free API key.

Limits

• Free pricing: 1,000 IP checks and reports, 100 block checks, and a basic blacklist up to 10,000 IPs per day.
• The check endpoint accepts a 1 to 365 day lookback and defaults to 30 days.
• Verbose check responses contain at most 10,000 report elements.

Quirks

• Set Accept: application/json; otherwise error responses may be returned as a complete HTML page.
• The free pricing page groups checks and reports at 1,000 per day, while the API rate table lists 1,000 checks and 100 report searches separately.
• Do not visit or connect to a reported host; query only its address through the API.

Terms and attribution

• Free plans may be used for evaluation, contribution and non-commercial personal projects, not commercial purposes.
• Do not reproduce, republish, sell, resell or exploit the API or associated data without a separate written agreement.

Sources

• https://docs.abuseipdb.com/: “endpoint accepts a single IP address (v4 or v6).”
• https://www.abuseipdb.com/pricing: “1,000 IP Checks & Reports / Day”
• https://www.abuseipdb.com/legal: “may not use Free plans for commercial purposes, and a single user or organization may not register multiple”
• https://www.abuseipdb.com/legal: “No Resale of The Website or Data.”