01 · Product name
AbuseIPDB
Check and report IP addresses tied to abusive traffic.
Published by AbuseIPDB.
In short
AbuseIPDB is a project where administrators check and report IP addresses tied to activity such as spam, intrusion attempts, and denial-of-service. Checking and reporting are free. API plans are paid, and the pricing page says each plan includes a 30-day trial. A report is a submission from another user. It is not proof the address is still hostile, or of who operates it.
Product pricing strategy
02
Free and paid
AbuseIPDB is free to check and report an address in the browser. The API is paid. The pricing page says every plan includes a 30-day trial and that you can cancel anytime. This listing does not quote a monthly price, because those amounts were not in the HTML of the pricing page when it was reviewed. Open the pricing page for the current card.
Utility and features
03
The AbuseIPDB FAQ describes the project directly: help administrators and webmasters check and report addresses involved in malicious activity, and a free public interface for that. The pricing page is for the API. It says plans include a 30-day trial and that you can cancel anytime. The dollar figures on that page are rendered in the browser. They were not in the HTML this directory reviewed, so they are not repeated here.
- Check and report. The FAQ’s job description: look up an address, and report one that abused your systems, in the site’s categories.
- Free website, paid API. The public check is free. API plans are on the pricing page, with a stated 30-day trial.
- Reports are submissions. You are reading other operators’ reports. Confidence is a score on that crowd, not a packet you captured.
Use a report as a tip. Someone said that address misbehaved, in a category the site publishes. GreyNoise answers a different question, about whether an address looks like internet background noise. Shodan answers what a scanner saw listening. None of the three is a warrant, and none of them names a person.
- 1
Look up an address that appeared in your own logs.
- 2
Read the report categories and the dates before you block a whole network.
- 3
If you need this in a script, use the API plan rather than scraping the site.
- 4
Pair it with GreyNoise or Shodan when the question is exposure or background noise, not user reports.
Caveats
04
A high report count means many people clicked report. It can be a shared NAT, a VPN exit, or a scanner that has moved on. Read the dates.
The public site and the API are different products. Scripting the website because you do not want an API key is not what the pricing page is for.
Screenshots
05
Potential use cases
06
- An address is hitting a login form you run. Look it up on AbuseIPDB. The output is the report count, the categories, and the dates other people submitted. Read the dates. A high count can be a NAT, a VPN exit, or a scanner that left. Pivot the same address to GreyNoise to see whether it is tagged as widespread scanning. Do not block a shared resolver because the count is large.
- You are deciding whether a block rule has any public corroboration. The lookup is that corroboration, and it is only as good as the reporters. A zero is ‘nobody here reported it,’ not ‘the address is benign.’ Combine it with your own logs. The public site and the API are different products. The pricing page is the API. Do not script the website to avoid a key.
- You want to report an address that attacked a system you run. Use the site’s categories and report what you observed. The output is your report, which other people will rely on. Do not report an address because it was merely noisy, and do not report a whole cloud range as if it were one offender.
Hard cases
The case where the first result is easy to over-read.
The count is high and the address is a VPN exit
The reports are real and the address is also used by people who are not your attacker. Blocking it may be operationally right for your form and still be the wrong story in a report. Write the report dates, the categories, and the fact it is shared infrastructure if you know that from GreyNoise or from the address’s own provider. Do not write ‘this person attacked us.’
Questions
Is AbuseIPDB free?
Checking and reporting in the browser are free. The API has paid plans with a 30-day trial, according to the pricing page.
Does a report prove who owns the address?
No. It records that someone reported abusive behavior from that address. Ownership is a different question.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
AbuseIPDB FAQ
https://www.abuseipdb.com/faqPricing
AbuseIPDB API pricing
https://www.abuseipdb.com/pricingDocumentation
AbuseIPDB API docs
https://docs.abuseipdb.com/