Look up the IP abuse contact for any IP address range. IP Trust's IP abuse contact API and database provide structured contact details sourced directly from RIR records - streamlining incident response and automating abuse report filing.
IP Trust's IP abuse contact data provides the name, email address, and physical address of the person or team responsible for handling abuse reports for any IP range.
| JSON Field | Description | Plans |
|---|---|---|
| { | ||
| "abuse_contact": { | ||
| "address": "One Microsoft Way, Redmond, WA 98052", | optional Physical mailing address for the abuse contact of the network owner. | Premium |
| "email": "abuse@microsoft.com", | optional Email address for reporting abuse originating from this network. | Premium |
| "name": "Microsoft Abuse Contact" | optional Name of the person or team responsible for abuse reports. | Premium |
| } | ||
| } |
| Field | Value | Description | Database Package |
|---|---|---|---|
| abuse_name | Microsoft Abuse Contact | Name of the person or team responsible for abuse reports. | ASN & Abuse Contacts |
| abuse_email | abuse@microsoft.com | Email address for reporting abuse originating from this network. | ASN & Abuse Contacts |
| abuse_phone | +1-425-882-8080 | Phone number for the abuse contact, if available. | ASN & Abuse Contacts |
| abuse_address | One Microsoft Way, Redmond, WA 98052 | Physical mailing address for the abuse contact of the network owner. | ASN & Abuse Contacts |
Quickly find the right IP abuse contact to report incidents, automate response workflows, and hold network operators accountable.
Look up the correct abuse contact for any offending IP and automatically generate and send abuse reports. Eliminate the manual process of searching WHOIS records and composing emails for each incident.
When you detect an attack or abuse, instantly retrieve the responsible network operator's contact details. Speed up your incident response workflow by having structured, ready-to-use contact information on hand.
Enrich your threat intelligence feeds with abuse contact information. Understand which network operators are responsive to reports and track patterns of abuse across networks over time.
Structured, machine-readable IP abuse contact data sourced directly from all five Regional Internet Registries.
Abuse contact data is extracted directly from WHOIS and RDAP records maintained by all five Regional Internet Registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC). No scraping, no guessing - just the authoritative contact details registered by the network operator.
No more parsing free-text WHOIS output. Every abuse contact is returned as structured JSON with separate fields for name, email, and address, ready to plug directly into your incident response tooling and automation workflows.
Full coverage of all allocated IP ranges worldwide. Abuse contact records are refreshed daily to reflect changes in network ownership, updated contact details, and new allocations.
Choose the integration model that works best for your use case.
| Network | Abuse Name | Phone | Address | |
|---|---|---|---|---|
| 5.57.227.64/28 | Stackscale NOC | abuse@stackscale.com | Calle Dos de Mayo 2, Elda | |
| 8.12.66.0/24 | Network Services | admins@incomm.com | +1-770-240-6116 | 250 Williams St, Atlanta |
| 24.139.0.0/23 | ARIN Abuse Support | arin-abuse@eastlink.ca | +1-902-453-2800 | 6080 Young St, Halifax |
| 41.72.222.0/24 | Andrew Alston | andrew@liquidtelecom.com | +254-20-5000000 | Sameer Park, Nairobi |
| 41.181.52.172/30 | Alan McKinnon | alan@mtn.com | +27-11-912-3000 | 216 14th Ave, Johannesburg |
An IP abuse contact is the person or team designated by a network operator to receive reports of malicious or unwanted activity originating from their IP address ranges. Every IP range registered with a Regional Internet Registry (RIR) has an associated abuse contact. IP Trust makes this data available as structured fields via the IP abuse contact API and database.
The IP abuse contact API returns three fields for each IP address: the contact name (person or team), the abuse email address, and the physical mailing address. These are sourced directly from WHOIS and RDAP records maintained by the five Regional Internet Registries, so you get authoritative data without having to parse raw WHOIS output yourself.
Yes. IP abuse contact data is included in the ASN & Abuse Contacts database package, available for download in MMDB, CSV, JSON, and Parquet formats. The IP abuse contact database also includes a phone number field not available via the API. Once downloaded, lookups run entirely on your own infrastructure with zero external calls. See our database downloads page for details.
IP Trust refreshes abuse contact records daily from all five RIR sources (ARIN, RIPE, APNIC, LACNIC, AFRINIC). This ensures that changes in network ownership, updated contact details, and newly allocated IP ranges are reflected quickly in both the IP abuse contact API and database.
A raw WHOIS lookup returns unstructured text that varies by registry and often contains irrelevant fields. The IP abuse contact API extracts just the abuse-relevant contact details - name, email, and address - and returns them as clean, structured JSON ready for automation. It also handles rate limits and registry differences behind the scenes, so you get consistent results regardless of which RIR manages the IP range.