Why does name hold a company on some rows?

When the record names no abuse contact, name falls back to the organization holding the block.

Why is phone or address empty?

Many records publish only an email. Phone and address are there when the record has them.

What do validated and unvalidated_since mean?

validated is 1 when ARIN reports that the contact answered its yearly validation, and unvalidated_since dates when it stopped answering. The other registries publish no such state, so both are empty on their records.

Why not report to the registry?

A registry only allocates the space. The contact here is the one that handles abuse for that range.

Where to send an abuse report, for every address.

The contact that takes abuse reports for each address range, resolved from the registries' records and operators' RWHOIS servers, with the email, phone and postal address, and the block the contact was taken from.

Request evaluation

In the lookup API: abuse.email on every plan, and the rest of abuse on a paid plan.

Look up one address free with the abuse contact lookup.

Real rows, with what each column means.

See documentation →

The schema and metadata are in the docs. It is published as CSVGZ and MMDB.

start_ip	end_ip	network	name	email	phone	country	address
1.1.1.0	1.1.1.255	1.1.1.0-1.1.1.255	ABUSE APNICRANDNETAU	helpdesk@apnic.net		AU	PO Box 3646, South Brisbane, QLD 4101, Australia
8.8.8.0	8.8.8.255	8.8.8.0-8.8.8.255	Abuse	network-abuse@google.com	+1-650-253-0000	US	1600 Amphitheatre Parkway, Mountain View, CA, 94043
12.4.166.88	12.4.166.119	12.0.0.0-12.255.255.255	abuse	abuse@att.net	+1-919-319-8167	US	2701 W 15th ST, Plano, TX, 75075
88.198.0.0	88.198.71.199	88.198.0.0-88.198.255.255	Hetzner Online GmbH - Contact Role	abuse@hetzner.com	+49 9831 505-3	DE	Hetzner Online GmbH, Industriestrasse 25, D-91710 Gunzenhausen, Germany
2a01:4f8::	2a01:4f8:171:f7ff:ffff:ffff:ffff:ffff	2a01:4f8::/29	Hetzner Online GmbH - Contact Role	abuse@hetzner.com	+49 9831 505-3	DE	Hetzner Online GmbH, Industriestrasse 25, D-91710 Gunzenhausen, Germany

ip_abuse_contact_v1

Entries

4,204,090

Refresh

Daily

CSVGZ

68.63 MB

MMDB

237 MB

Download it from your code in one call.

Database API reference →

Every official client fetches the current IP Abuse Contact build to disk, as a link for your own runner or into memory, and checks it against its published checksums.

download()

Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.

downloadUrl()

The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.

downloadBytes()

The build in memory, for a small database or a pipeline that never touches a filesystem.

metadata()

Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.

checksums()

The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.

import os
from internetdata import InternetData
 
client = InternetData(os.environ["INTERNETDATA_API_KEY"])
 
# what is in today's build, without moving the file
meta = client.database.metadata("ip_abuse_contact_v1")
 
client.database.download("ip_abuse_contact_v1", "mmdb", "./ip_abuse_contact_v1.mmdb")
sums = client.database.checksums("ip_abuse_contact_v1", "mmdb")
print(meta.updated, meta.entries, sums["sha256"])

load.pypip install internetdata

Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

Put it to work in your own systems.

Teams join IP Abuse Contact against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.

Abuse reporting

Send each report to the mailbox that handles abuse for that range, not to the registry that allocated it.

Reporting in bulk

Route what your own detection finds to the right contacts by address, without a lookup per report.

License the full database

Sales will quote on volume, term and whether you need redistribution rights.

Checksums published per file: md5, sha1, sha256 and sha512.

The ID fixes the schema, so a new build never changes the columns your parser reads.

Samples are cut from the current build, not a synthetic extract.

Get a quote See documentation

Call the API in your language, with an official client.

All SDKs on GitHub →

Thirteen official clients, one for each language you ship in and one for the browser, plus middleware for fifteen web frameworks. Each answers private addresses without a request, caches what it looks up and splits big batches for you.

Node.js Web Python Go Java .NET PHP Ruby Rust Swift Erlang Perl Zig Express Fastify Next.js Django Flask FastAPI Laravel Symfony Rails Spring Boot ASP.NET Core net/http Gin axum Cowboy

Common questions

Read the docs →API reference →Email support →

On this page

Where does a contact come from?

From the registries' records and operators' RWHOIS servers. network names the block whose record supplied it.

00 · Unlimited

Unlimited lookups, no sign-up.

Paste it into a terminal. Any address answers with its country, network, company and hostname, with no key and no daily or monthly cap. ASes and domains answer too.

curl https://api.internetdata.io/8.8.8.8

{
  "ip": "8.8.8.8",
  "is_tor": false,
  "is_anycast": true,
  "is_dns_resolver": true,
  "location": {
    "country": "US", ...
  },
  "asn": { "asn": 15169, ... },
  "hostname": "dns.google"
}

01 · Every field

All of the data on a paid plan.

VPN, proxy, hosting and CDN flags, each naming the operator.

Location to the city, with coordinates and an accuracy radius.

WHOIS records, the whole abuse contact and the services an address runs.

Up to 1,000 addresses, ASes and domains in one request.

A free API key answers every field for its first 100 lookups each day, with no card.

See pricing Get a free API key