AbuseTrack
Report

Integrations

Connect AbuseTrack to the security tools you already run. A couple of minutes, one command.

Create an API key

Choose a tool

Every integration speaks the same public API. Point your firewall or intrusion-prevention tool at it and it works both ways: you report the attackers you catch back to the community, and you block the IPs everyone else flagged.

Report once, block everywhere

AbuseTrack works like a neighbourhood watch for servers. Every sensor that reports helps all others, and reporting servers get the best protection back.

  1. 01Your server catches an attacker
  2. 02The IP is reported automatically
  3. 03Every connected firewall drops it
Community
Blocklist with up to 5,000 entries. New attackers appear after 24 h.
Contributorfor reporters
Full real-time blocklist and +2,000 API requests per day, as long as your servers report.

Firewall

nftables · iptables · ufw

Blocks threats

The community blocklist in your firewall, kept fresh.

Loads the blocklist into nftables, iptables/ipset or next to ufw and refreshes it every 30 minutes. Updates are atomic, a failed download never empties the firewall, private ranges and the SSH address you install from are never blocked. Docker hosts are covered too.

Detects your firewall automatically. To uninstall, run the same URL with "bash -s -- uninstall".

README

Needs an API key from your account.

Install

curl -fsSL https://abusetrack.io/integrations/firewall/install.sh | \
  AT_API_KEY=your_api_key bash

fail2ban

Reports abuseBlocks threats

Bans on your Linux box, reported automatically.

Every IP fail2ban bans (SSH brute-force and any jail you wire up) is reported to AbuseTrack with the threat and a short note on what the attacker did. The installer also loads the community blocklist into your firewall, so attackers others already caught never reach your server. Set AT_BLOCKLIST=0 to report only.

One command installs the reporter, the fail2ban action, an sshd jail and the firewall blocklist, then verifies your key.

Step-by-step guideREADME

Needs an API key from your account.

Install

curl -fsSL https://abusetrack.io/integrations/fail2ban/install.sh | \
  AT_API_KEY=your_api_key AT_API_URL=https://abusetrack.io bash

CrowdSec

Reports abuseBlocks threats

Report what CrowdSec catches, block what the community flags.

Works both ways. The installer reports every IP CrowdSec bans locally (WordPress brute-force, scanners, CVE probes) to AbuseTrack. And you can pull the community blocklist straight into CrowdSec, so flagged IPs get blocked by your bouncers on top of CrowdSec's own scenarios.

Step-by-step guideREADME

Needs an API key from your account.

Report bans

A cron job forwards new local decisions to AbuseTrack. It only reports your own detections, so anything you pull from the community feed is never reported back.

Install
curl -fsSL https://abusetrack.io/integrations/crowdsec/install.sh | \
  AT_API_KEY=your_api_key AT_API_URL=https://abusetrack.io bash

Block with the community list

The installer imports the community blocklist as CrowdSec decisions every 4 hours, so every bouncer you run blocks flagged IPs. Set AT_BLOCKLIST=0 to report only. To pull the raw feed yourself:

curl
curl -fsSL -H "Authorization: Bearer your_api_key" \
  "https://abusetrack.io/api/v1/blocklist.txt?score=60&comments=0"

UniFi

Reports abuse

What your UniFi gateway catches, reported.

Point your UniFi gateway's syslog at a small listener. Every Threat Management (IDS/IPS) detection and firewall drop with an external attacker IP is reported to AbuseTrack. Report-only, runs as a service, standard-library Python with no pip installs.

One command installs the syslog listener as a systemd service. Then point UniFi's Activity Logging (Syslog) at it and enable Security Detections.

README

Needs an API key from your account.

Install

curl -fsSL https://abusetrack.io/integrations/unifi/install.sh | \
  AT_API_KEY=your_api_key AT_API_URL=https://abusetrack.io LISTEN_PORT=514 bash

Other ways to connect

Already using AbuseIPDB?

Reports abuse

Report to both, no new software

AbuseTrack speaks the AbuseIPDB API v2 (/api/v2/check, /api/v2/report, /api/v2/blacklist). Tools written for AbuseIPDB work by changing the URL and using an AbuseTrack key. With fail2ban you keep your AbuseIPDB action and add a copy that reports to AbuseTrack.

AbuseTrack as an AbuseIPDB alternative

1. Copy the stock action with our URL

sed 's#https://api.abuseipdb.com#https://abusetrack.io#' \
  /etc/fail2ban/action.d/abuseipdb.conf \
  > /etc/fail2ban/action.d/abusetrack.conf

2. Add it to a jail in jail.local, then reload fail2ban

action = %(action_)s
         abusetrack[abuseipdb_apikey="your_api_key", abuseipdb_category="18,22"]

Category ids are the same as AbuseIPDB's (18 brute force, 22 SSH, 14 port scan). Each IP is accepted once per 15 minutes per account.

Try it without an account

Blocks threats

Also for pfSense, OPNsense and MikroTik

The community blocklist works without an API key: up to 5,000 entries, new IPs after 24 hours. Firewalls that load a list from a URL can pass the key as a parameter; accounts that report then receive the full real-time list.

Look at the list now

curl -s https://abusetrack.io/api/v1/blocklist.txt | head

URL for an alias or address list (refresh every 30 minutes)

https://abusetrack.io/api/v1/blocklist.txt?comments=0&key=your_api_key

Without a key: 12 requests per hour per IP. Only use the key parameter on firewalls you control, because URLs can end up in logs.

Any other tool

Reports abuseBlocks threats

It all runs on a small REST API: submit reports, look up an IP, or pull the blocklist feed. Wire it into your SIEM, a firewall or a script in a few lines.

Read the API docs