Getting Started

Rate this article:

X

Select all that apply:

The content is confusing or hard to follow.

There is missing information or code.

There is inaccurate or outdated information.

This page did not solve my problem.

I would like to speak with someone about this.

Email:

Submit Feedback

About the IP Address Abuse Feed

The IPQS IP Address Abuse Feed is a structured data source that provides updates on IP addresses involved in malicious or suspicious activity. The information in the IP Address Abuse Feed is updated every five minutes to ensure fresh information and high accuracy. Unlike general scoring systems, this feed includes specific labels for behaviors such as bot attacks, credential stuffing, brute force attempts, and proxy use.

Delivered as downloadable JSON files, the feed supports teams that need reliable access to IP threat intelligence without relying on continuous API calls. Whether it's updating internal blocklists or feeding into security platforms, the feed helps teams make faster and better-informed decisions with consistent data.

When to Use the IP Address Abuse Feed

Choose the IP Address Abuse Feed when your environment requires offline access to threat data, or when large-scale analysis of IP behavior is needed. While the Proxy & VPN Detection API returns real-time insights for individual IPs, the Abuse Feed is designed for bulk access and supports local file storage. This makes it a better fit for workflows that require full control over data storage, frequent audits, or integration into internal monitoring systems.

IP Address Abuse Feed Use Cases

• Fraud teams expanding blocklists with confirmed high-risk IPs.
• Security operations reviewing historical attack behavior.
• Analysts feeding threat data into detection systems or SIEM tools.
• Threat intelligence teams comparing abuse patterns across data sources.
• Internet providers tracking IPs involved in proxy usage and abuse.
• Incident response teams reviewing activity without external lookups.
• Developers creating custom scoring systems based on abuse types.
• Businesses working under data retention or residency requirements.
• Teams monitoring port scans, brute force attempts, and bot traffic patterns.

Downloading the IP Address Abuse Feed

You can use the following URLs to request specific time ranges of the IP Address Abuse Feed. These URLs return .gzip compressed JSON files containing the abuse feed data for the requested time range:

Using the IP Address Abuse Feed

The IP Address Abuse Feed is provided in a .gzip compressed JSON file. You will first need to decompress the archive before you or your applications can read the JSON file. Each line in the file is a JSON object representing a single entry in the IP Address Abuse Feed.

Next Steps

Learn more about each of the parameters included in the IP Address Abuse Feed.