API reference
Community reporting
Report abusive IPs (no account needed), read reports, and vote. Confirmed reports roll into the open-data build, rebuilt every 30 minutes.
The database grows with the community. Anyone can report an abusive IP with no account. Reports are verified, then confirmed ones ship in the next open-data build, at most half an hour later, with leaderboard credit if you want it.
#Report an IP
/public/ip/{ip}/reportno keyAdd a report, no keycurl https://api.ffraud.com/public/ip/80.82.77.33/report \
-H "Content-Type: application/json" \
-d '{
"category": "brute_force",
"comment": "Hit /login 10k times overnight.",
"evidence_url": "https://gist.github.com/...",
"reporter": "your-handle"
}'Valid category values: brute_force, spam, vpn, tor, fraud, port_scan, web_attack, phishing, malware, bot, scraping, other. Everything except category is optional.
#Read reports
/public/ip/{ip}/reportsno keyList reports for an IP (ranked, max 50)/public/ip/{ip}/reports/{id}/voteno keyVote a report up or down#Bulk reporting
/v1/report/bulkkeyReport up to 1000 IPs at once (trust-weighted)Running honeypots, fail2ban, or a WAF? Submit up to 1000 IPs per call. Reports are weighted by your reporter trust score, so established reporters move the needle faster. New accounts are quarantined until they build trust, which keeps the open data clean.
Already using fail2ban with AbuseIPDB? Point it at our AbuseIPDB-compatible report endpoint and every ban you make helps everyone, no code changes.