---
name: abuseipdb-api-ingestion
description: "How to get AbuseIPDB API data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Load AbuseIPDB IP checks into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/abuseipdb-api
Provider: https://docs.abuseipdb.com/
Checked against the provider's documentation: 2026-11-01

## Access
- Create a free AbuseIPDB account and place its API key in ABUSEIPDB_API_KEY.
- The free plan is for evaluation, contribution or non-commercial personal projects.

## Request
```bash
curl -G 'https://api.abuseipdb.com/api/v2/check' --data-urlencode 'ipAddress=1.1.1.1' --data-urlencode 'maxAgeInDays=30' -H "Key: $ABUSEIPDB_API_KEY" -H 'Accept: application/json'
```

## Format
JSON:API-style response whose data object includes IP identity, country, usage type, ISP, domain, whitelist state, abuseConfidenceScore, totalReports, lastReportedAt and optional report details.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""AbuseIPDB checks for caller-supplied IPs -> pandas -> Parquet."""
import os
import requests
import pandas as pd

URL = "https://api.abuseipdb.com/api/v2/check"
IPS = ["1.1.1.1"]  # Replace with IPs from your own defensive telemetry.
headers = {"Key": os.environ["ABUSEIPDB_API_KEY"], "Accept": "application/json"}
rows = []
for ip in IPS:
    r = requests.get(URL, headers=headers,
                     params={"ipAddress": ip, "maxAgeInDays": 30}, timeout=30)
    r.raise_for_status()
    rows.append(r.json()["data"])
df = pd.json_normalize(rows, sep="_")
if "lastReportedAt" in df:
    df["lastReportedAt"] = pd.to_datetime(df["lastReportedAt"], utc=True, errors="coerce")
df.to_parquet("abuseipdb_checks.parquet", index=False)
print(len(df), "IP checks", "maximum confidence score", df["abuseConfidenceScore"].max())
```
Not run: it needs a free API key.

## Limits
- Free pricing: 1,000 IP checks and reports, 100 block checks, and a basic blacklist up to 10,000 IPs per day.
- The check endpoint accepts a 1 to 365 day lookback and defaults to 30 days.
- Verbose check responses contain at most 10,000 report elements.

## Quirks
- Set Accept: application/json; otherwise error responses may be returned as a complete HTML page.
- The free pricing page groups checks and reports at 1,000 per day, while the API rate table lists 1,000 checks and 100 report searches separately.
- Do not visit or connect to a reported host; query only its address through the API.

## Terms and attribution
- Free plans may be used for evaluation, contribution and non-commercial personal projects, not commercial purposes.
- Do not reproduce, republish, sell, resell or exploit the API or associated data without a separate written agreement.
- Terms page: https://www.abuseipdb.com/legal

## Sources
- https://docs.abuseipdb.com/: "endpoint accepts a single IP address (v4 or v6)."
- https://www.abuseipdb.com/pricing: "1,000 IP Checks & Reports / Day"
- https://www.abuseipdb.com/legal: "may not use Free plans for commercial purposes, and a single user or organization may not register multiple"
- https://www.abuseipdb.com/legal: "No Resale of The Website or Data."

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.