Developers

API Documentation

Check, report and block abusive IP addresses over HTTP. Free, and the first calls work without an account.

Get a free API key OpenAPI spec

Quick start

Base URL https://abusetrack.io

1Try it without an account
The community blocklist and lookups answer without a key.
shell
```
curl -s "https://abusetrack.io/api/v1/blocklist.txt" | head
```
2Create a free API key
Sign up and create a key under API keys. It is shown only once, so store it right away.
shell
```
export AT_API_KEY="at_your_key"
```

3Send it with each request

Keys start with at_ and raise your limits right away.

shell

curl "https://abusetrack.io/api/v1/lookup?value=203.0.113.7" \
  -H "Authorization: Bearer $AT_API_KEY"

Authentication

Send your key in one of these ways. All of them count against the same daily quota of your account.

Authorization: Bearer at_…Recommended for everything.
X-API-Key: at_…Alternative header.
Key: at_…For AbuseIPDB clients and the v2 endpoints.
?key=at_…List endpoints only, for firewalls that load a URL without headers. URLs can end up in logs.

What you get

	Without key	Free key	Reporting account
Requests	60 lookups and 12 list calls per hour and IP	3,000 per day	5,000 per day
Blocklist	Up to 5,000 entries, new IPs after 24 h	Up to 5,000 entries, new IPs after 24 h	Full list in real time
Lookup results	Latest 10 reports	All reports	All reports
Report IPs	No	Yes	Yes

An account counts as reporting with at least 1 approved report(s) in the last 7 days. The data is licensed under CC BY 4.0. License and removal

Limits and errors

The daily quota is shared by all keys of an account and resets at 00:00 UTC. Every response tells you where you stand:

•v1: the usage field in JSON responses, and the X-AbuseTrack-Usage header on the blocklist.
•v2: X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (Unix time), like AbuseIPDB.

Status	Meaning
400	v1: invalid input, for example a value that is not an IP address.
401	Missing, invalid or revoked API key.
403	The value was blocked by an administrator.
422	v2: invalid parameter, named in errors[].source.parameter.
429	Quota or rate limit reached, or the same IP reported again within 15 minutes (v2). Wait for Retry-After.

AbuseTrack API v1

The native API. Lookups and the blocklist also work without a key, with lower limits.

GET/api/v1/lookupKey optionalLook up an IP

All community reports for an IPv4 or IPv6 address, newest first. Without a key the latest 10 reports are returned and the call is limited to 60 per hour per IP.

Parameter	Type	Description
`value`required	string	IP address to look up.

curl

curl "https://abusetrack.io/api/v1/lookup?value=203.0.113.7" \
  -H "Authorization: Bearer $AT_API_KEY"

200 · application/json

{
  "value": "203.0.113.7",
  "reported": true,
  "count": 2,
  "results": [
    {
      "type": "ip",
      "value": "203.0.113.7",
      "threatType": "Brute Force",
      "reportedAt": "2026-09-28T21:14:03.000Z"
    }
  ],
  "usage": {
    "used": 42,
    "limit": 3000,
    "resetsAt": "2026-09-29T00:00:00.000Z"
  }
}

GET/api/v1/blocklist.txtKey optionalBlocklist feed

One IP per line for firewalls and ipsets. Without a key: community feed (capped, new IPs delayed), 12 calls per hour per IP. Accounts that report get the full real-time list. Poll every 15 to 30 minutes.

Parameter	Type	Description
`score`	integer	Minimum risk score 0 to 100. Default 25.
`reporters`	integer	Minimum number of distinct reporters. Default 1.
`since`	integer	Only IPs reported in the last N days.
`limit`	integer	Maximum entries, up to 200,000. Default 10,000.
`comments`	0 \| 1	0 returns pure IPs without # header lines.
`key`	string	API key as a parameter, for firewalls that can only load a URL (pfSense, OPNsense, MikroTik).

curl

curl "https://abusetrack.io/api/v1/blocklist.txt?score=60&comments=0"

200 · text/plain

198.51.100.23
203.0.113.7
2001:db8::1f
...

POST/api/v1/reportsAPI keyReport an IP

Submit an attack, for example from a fail2ban action. Private and reserved ranges are rejected.

Parameter	Type	Description
`type`required	"ip"	Always ip.
`value`required	string	The attacking IP.
`threatType`required	string	e.g. Brute Force, Port Scan. Spelling variants are folded.
`comment`	string	Free text, up to 1,000 characters.

curl

curl -X POST "https://abusetrack.io/api/v1/reports" \
  -H "Authorization: Bearer $AT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"ip","value":"203.0.113.7","threatType":"Brute Force","comment":"sshd: 12 failed logins"}'

200 · application/json

{
  "ok": true,
  "id": "0f6c5d1e-7a1b-4c8e-9a52-6b1d2e3f4a5b",
  "usage": {
    "used": 43,
    "limit": 3000,
    "resetsAt": "2026-09-29T00:00:00.000Z"
  }
}

AbuseIPDB compatible (v2)

Same parameters, response format and errors as AbuseIPDB API v2. Tools written for AbuseIPDB work after changing the base URL and using an AbuseTrack key in the Key header.

GET/api/v2/checkAPI keyCheck an IP

abuseConfidenceScore is the AbuseTrack community risk score. Fields without data (usageType, domain, isTor) are returned empty with AbuseIPDB's types.

Parameter	Type	Description
`ipAddress`required	string	IPv4 or IPv6 address.
`maxAgeInDays`	integer	1 to 365. Default 30.
`verbose`	flag	Include up to 100 individual reports.

curl

curl -G "https://abusetrack.io/api/v2/check" \
  --data-urlencode "ipAddress=203.0.113.7" \
  -d maxAgeInDays=90 \
  -H "Key: $AT_API_KEY" -H "Accept: application/json"

200 · application/json

{
  "data": {
    "ipAddress": "203.0.113.7",
    "isPublic": true,
    "ipVersion": 4,
    "isWhitelisted": false,
    "abuseConfidenceScore": 87,
    "countryCode": "NL",
    "usageType": null,
    "isp": "Example Hosting B.V.",
    "domain": null,
    "hostnames": [],
    "isTor": false,
    "totalReports": 14,
    "numDistinctUsers": 5,
    "lastReportedAt": "2026-09-28T21:14:03+00:00"
  }
}

POST/api/v2/reportAPI keyReport an IP

Form fields, JSON or query string. One account can report the same IP once per 15 minutes; repeats get 429.

Parameter	Type	Description
`ip`required	string	The attacking IP.
`categories`required	string	Comma-separated AbuseIPDB category ids, e.g. 18,22.
`comment`	string	Free text, up to 1,024 characters.
`timestamp`	ISO 8601	Time of the attack.

curl

curl "https://abusetrack.io/api/v2/report" \
  -H "Key: $AT_API_KEY" -H "Accept: application/json" \
  --data-urlencode "ip=203.0.113.7" \
  --data "categories=18,22" \
  --data-urlencode "comment=sshd: 12 failed logins"

200 · application/json

{
  "data": {
    "ipAddress": "203.0.113.7",
    "abuseConfidenceScore": 88
  }
}

GET/api/v2/blacklistAPI keyBlocklist

JSON by default, plain text with plaintext or Accept: text/plain. confidenceMinimum defaults to 75 (AbuseIPDB: 100), because AbuseTrack scores are calibrated differently.

Parameter	Type	Description
`confidenceMinimum`	integer	25 to 100. Default 75.
`limit`	integer	Up to 200,000. Default 10,000.
`plaintext`	flag	One IP per line.
`ipVersion`	4 \| 6	Only one address family.
`onlyCountries`	string	Comma-separated ISO codes, e.g. CN,RU.
`exceptCountries`	string	Comma-separated ISO codes.

curl

curl "https://abusetrack.io/api/v2/blacklist?confidenceMinimum=90&limit=5000" \
  -H "Key: $AT_API_KEY"

200 · application/json

{
  "meta": {
    "generatedAt": "2026-09-29T06:00:00+00:00"
  },
  "data": [
    {
      "ipAddress": "203.0.113.7",
      "countryCode": "NL",
      "abuseConfidenceScore": 100,
      "lastReportedAt": "2026-09-28T21:14:03+00:00"
    }
  ]
}

Public data

No key, no quota. Cached for a few seconds.

GET/api/statsPublicLive statistics

Totals, threat type distribution and the latest reports, as shown on the homepage.

curl

curl "https://abusetrack.io/api/stats"

200 · application/json

{
  "counts": {
    "ip": 196000
  },
  "total": 196000,
  "threats": [
    {
      "name": "Brute Force",
      "count": 21870
    }
  ],
  "recent": [
    {
      "id": "0f6c5d1e-7a1b-4c8e-9a52-6b1d2e3f4a5b",
      "type": "ip",
      "value": "203.0.113.7",
      "href": "/reports/ip/203.0.113.7",
      "threatType": "Brute Force",
      "country": "NL",
      "createdAt": "2026-09-28T21:14:03.000Z"
    }
  ]
}

Migrate from AbuseIPDB

Replace https://api.abuseipdb.com with https://abusetrack.io and use an AbuseTrack key. Nothing else changes, and you can keep reporting to AbuseIPDB at the same time.

fail2ban: copy the stock AbuseIPDB action with our URL, then add abusetrack[...] to your jail.

shell

sed 's#https://api.abuseipdb.com#https://abusetrack.io#' \
  /etc/fail2ban/action.d/abuseipdb.conf \
  > /etc/fail2ban/action.d/abusetrack.conf

Step by step on the integrations page

Category mapping

Reports keep their AbuseIPDB category ids and are filed under the AbuseTrack threat type shown on the right.

1DNS CompromiseDNS Compromise
2DNS PoisoningDNS Poisoning
3Fraud OrdersFraud
4DDoS AttackDDoS
5FTP Brute-ForceBrute Force
6Ping of DeathDDoS
7PhishingPhishing
8Fraud VoIPFraud
9Open ProxyOpen Proxy
10Web SpamSpam
11Email SpamSpam
12Blog SpamSpam
13VPN IPVPN
14Port ScanPort Scan
15HackingHacking
16SQL InjectionWeb Attack
17SpoofingSpoofing
18Brute-ForceBrute Force
19Bad Web BotBad Bot
20Exploited HostExploited Host
21Web App AttackWeb Attack
22SSHBrute Force
23IoT TargetedIoT Attack

Try it in the browser

The interactive explorer is generated from the OpenAPI document and can send real requests. It loads about 1 MB of scripts, so it only starts when you open it.

IntegrationsConnect AbuseTrack to the security tools you already run. A couple of minutes, one command.