Threat categories

Every category AbuseTrack uses, with the AbuseIPDB-compatible category ID the API accepts and returns.

ID	Category	Description	Accepted IDs	Reports	IPs
1	DNS Compromise Altering DNS records or registrar accounts without permission.	Altering DNS records or registrar accounts without permission.	1	0	0
2	DNS Poisoning Injecting forged records into DNS resolver caches.	Injecting forged records into DNS resolver caches.	2	0	0
3	Fraud Fraudulent orders, payment fraud and VoIP toll fraud.	Fraudulent orders, payment fraud and VoIP toll fraud.	3, 8	0	0
4	DDoS Traffic floods meant to exhaust bandwidth or server resources.	Traffic floods meant to exhaust bandwidth or server resources.	4, 6	0	0
7	Phishing Hosting or sending pages and mail that impersonate a trusted brand.	Hosting or sending pages and mail that impersonate a trusted brand.	7	0	0
9	Open Proxy Open proxies or relays used to hide the real source.	Open proxies or relays used to hide the real source.	9	0	0
11	Spam Unsolicited email, comment, forum or web-form spam.	Unsolicited email, comment, forum or web-form spam.	10, 11, 12	1	1
13	VPN Traffic from a VPN endpoint, reported together with abuse.	Traffic from a VPN endpoint, reported together with abuse.	13	0	0
14	Port Scan Probing many ports or hosts to find open services.	Probing many ports or hosts to find open services.	14	9,050	5,213
15	Data Theft Exfiltrating data or scraping protected content.	Exfiltrating data or scraping protected content.	–	1,052	670
15	Hacking General intrusion attempts that fit no narrower category.	General intrusion attempts that fit no narrower category.	15	0	0
17	Spoofing Forged sender addresses or headers.	Forged sender addresses or headers.	17	0	0
18	Brute Force Repeated login attempts against SSH, FTP, mail, web or other authentication endpoints.	Repeated login attempts against SSH, FTP, mail, web or other authentication endpoints.	5, 18, 22	236,463	21,625
19	Bad Bot Crawlers that ignore robots.txt, scrape aggressively or fake their user agent.	Crawlers that ignore robots.txt, scrape aggressively or fake their user agent.	19	0	0
20	Command & Control Servers that control botnets or compromised machines.	Servers that control botnets or compromised machines.	–	0	0
20	Cryptojacking Installing or running unauthorized cryptocurrency miners.	Installing or running unauthorized cryptocurrency miners.	–	0	0
20	Exploited Host A machine that is itself compromised and now attacks others.	A machine that is itself compromised and now attacks others.	20	0	0
20	Malware Distributing or downloading malicious software.	Distributing or downloading malicious software.	–	1,730	723
21	Web Attack Exploit attempts against web applications, including SQL injection.	Exploit attempts against web applications, including SQL injection.	16, 21	0	0
23	IoT Attack Attacks aimed at routers, cameras and other IoT devices.	Attacks aimed at routers, cameras and other IoT devices.	23	0	0

AbuseIPDB category IDs

The v2 API accepts all 23 AbuseIPDB category IDs. Several fold into one AbuseTrack category; check responses report the ID from the table above.

ID	AbuseIPDB name	AbuseTrack category
1	DNS Compromise	DNS Compromise
2	DNS Poisoning	DNS Poisoning
3	Fraud Orders	Fraud
4	DDoS Attack	DDoS
5	FTP Brute-Force	Brute Force
6	Ping of Death	DDoS
7	Phishing	Phishing
8	Fraud VoIP	Fraud
9	Open Proxy	Open Proxy
10	Web Spam	Spam
11	Email Spam	Spam
12	Blog Spam	Spam
13	VPN IP	VPN
14	Port Scan	Port Scan
15	Hacking	Hacking
16	SQL Injection	Web Attack
17	Spoofing	Spoofing
18	Brute-Force	Brute Force
19	Bad Web Bot	Bad Bot
20	Exploited Host	Exploited Host
21	Web App Attack	Web Attack
22	SSH	Brute Force
23	IoT Targeted	IoT Attack