The Abuser dataset aggregates addresses reported for abusive activity such as spam campaigns, credential stuffing, scraping and brute-force attempts, distilled from more than 220 OSINT threat feeds and Ipregistry’s own observations.
Entries decay as behavior stops, keeping the list focused on currently risky sources rather than accumulating stale history.
Available formats
| Format | Description | Size |
|---|---|---|
| CSV | Plain text, one range per line. Import into any database or data warehouse. | 4.3 MB |
| CSV (zipped) | Same file compressed for faster downloads and cheaper storage. | 993 KB |
| MMDB | Binary format for instant lookups with standard MMDB readers. | 9.8 MB |
Latest build: 144,318 records. Files are regenerated every day and published with MD5, SHA-1, SHA-256 and SHA-512 checksums so you can verify every download.
What's inside
The CSV file starts with a header line and contains one record per row, with the following fields:
| Column | Description |
|---|---|
ip_end | Last IP address of the range, inclusive. |
ip_start | First IP address of the range, IPv4 or IPv6. |
The MMDB variant carries the same data in a memory-mapped binary tree, compatible with the standard MMDB reader libraries available for every major programming language.
What you can build
- Rate limit or challenge requests from recently abusive sources
- Pre-filter registration and comment spam
- Enrich SIEM alerts with abuse reputation
- Protect login endpoints from credential stuffing infrastructure
Related use case: Cyber security
Datasets are available with an Ipregistry subscription and download from your dashboard, or over a stable URL for automated syncs. Prefer live data? The same intelligence is served by the Ipregistry API.