What is IP abuse, and how do you report an abusive IP address?

IP abuse is harmful traffic sent from an IP address: spam, password guessing, scans, malware, phishing, and the servers that control infected machines. You report it to the abuse contact of the network that owns the address, which you find in the registry's WHOIS or RDAP record. Send the address, the exact time in UTC, a few log lines and what happened. A report to a shared abuse database also warns the next site.

#What counts as IP abuse?

Abuse is anything an address does to attack, trick or flood other systems. FFraud's open data sorts every confirmed attacker by the worst thing it was caught doing, and MITRE ATT&CK gives neutral definitions for most of these kinds.

• Command and control: a server through which an attacker communicates with compromised systems to control them (MITRE ATT&CK TA0011).
• Botnet: infected machines that take orders from such a server.
• Brute force: guessing passwords for accounts when the passwords are unknown (MITRE T1110).
• Scanning: probing networks to gather information for an attack (MITRE T1595).
• Web attacks: SQL injection, cross-site scripting, path traversal and other exploit attempts against websites (FFraud docs).
• Phishing: social engineering delivered over the network, such as fake login pages (MITRE T1566).
• Spam: unwanted email, comments and contact form floods.
• Malware: serving or spreading malicious software.

Command and control is the largest group, 649,082 addresses or 41 percent of the list. The next 411,583 carry the general label abuse. The file is free to download from the malicious IP database.

#Who do I report an abusive IP address to?

Report to the network that owns the address. RIPE NCC puts it plainly: the abuse contact you find "will be an ISP or other network operator - not the abuser!" (RIPE NCC). Five regional registries record who holds each address, and their WHOIS and RDAP records can list an abuse contact. RDAP even has a role named abuse for it (RFC 9083).

FFraud's free API returns that contact in one call, with no key. This is the real answer for Google's public resolver on October 23, 2026, trimmed to the fields that matter:

curl https://api.ffraud.com/public/ip/8.8.8.8

{
  "ip": "8.8.8.8",
  "fraud_score": 5,
  "risk": "none",
  "organization": "Google LLC",
  "whois": {
    "abuse_contact": "[email protected]"
  }
}

The registries keep the records and do not act on abuse themselves. ARIN says it is not able to investigate or stop unwanted network activity, and IANA has no control over how addresses are used. If a record has no abuse contact, RFC 2142 has named abuse@ as the standard mailbox for complaints since 1997.

#What should an abuse report include?

RIPE NCC asks for as much detail as possible, including the address and the time the abuse took place. The port matters on shared addresses: RFC 6269 notes that an address and a time cannot identify one subscriber behind carrier-grade NAT, and logging port numbers fixes that. Write times in the RFC 3339 form, which always states the offset to UTC. The example address 203.0.113.7 belongs to a block reserved for documentation (RFC 5737).

Two things stay out. Leave personal data out of anything that may be published: FFraud's public reports show each report's category, comment and the handle you chose. And skip floods: some denial of service attacks forge their source addresses (RFC 2827), so the address in your log may belong to a bystander.

#How do I report an abusive IP address?

1. Check the address first. Run it through the IP abuse check or the IP lookup. A Tor exit, a VPN or a carrier-grade NAT address serves many users, so the source port and the exact time are essential.
2. Find the abuse contact in the WHOIS or RDAP record, or in the whois.abuse_contact field of the free API.
3. Write a short report with the five items in the table, as plain text in the body of an email.
4. Send it and keep a copy. Note any ticket number the network sends back.
5. Report it to a shared database too, so other sites can block the address before it reaches them.
6. Go to the police for crimes. For hacking, the U.S. Justice Department lists the FBI, the Secret Service and the FBI's Internet Crime Complaint Center. ARIN sends people facing personal threats online to local law enforcement.

FFraud takes a report with no account. Only the category is required; the comment, an evidence link and a reporter handle are optional (reporting docs). Replace the example address with the attacker's address:

curl https://api.ffraud.com/public/ip/203.0.113.7/report \
  -H "Content-Type: application/json" \
  -d '{"category": "brute_force", "comment": "41 failed SSH logins, 2026-10-23 09:00 to 09:05 UTC", "reporter": "your-handle"}'

If you run fail2ban, a drop-in action reports every ban for you; the setup is in feed the database and in our fail2ban guide.

#What happens after I report an IP?

The network may act on its customer, reply, or stay silent. RIPE NCC says there is nothing it can do if an operator chooses not to reply. It does ask you to tell it when an abuse contact is invalid or missing.

At FFraud, one report is a claim. Reports are checked and weighted by the reporter's track record, and an address is listed only after two independent confirmations (how we score). Confirmed listings ship in the next open data build, at most half an hour later. Check that your report landed with the public reports endpoint. On October 23, 2026, the Tor exit from our tools showed this:

curl https://api.ffraud.com/public/ip/185.220.101.34/reports

{"reports":[{"category":"vpn","comment":"","created_at":"2026-09-28T05:14:05.160496+00:00","id":12,"reporter":"Anonymous","votes_down":0,"votes_up":0}],"total":1}

If nobody answers and the traffic goes on, block the address yourself. A report to the network stops one attacker at best; a shared database ships your evidence to everyone who blocks with it.

#Questions people ask