The Abuser dataset aggregates addresses reported for abusive activity such as spam campaigns, credential stuffing, scraping and brute-force attempts, distilled from more than 220 OSINT threat feeds and Ipregistry’s own observations.
Entries decay as behavior stops, keeping the list focused on currently risky sources rather than accumulating stale history.
The data
Inside the file
One record per row, a commented header line first. This is what ipregistry-abuser.csv looks like:
# ip_start,ip_end152.58.123.185,152.58.123.185196.51.145.194,196.51.145.194104.250.205.36,104.250.205.3627.6.223.128,27.6.223.12831.173.85.193,31.173.85.193The rows above come from the free sample. Every build ships with MD5, SHA-1, SHA-256 and SHA-512 checksums so you can verify downloads.
| Column | Description |
|---|---|
ip_start | First IP address of the range, IPv4 or IPv6. |
ip_end | Last IP address of the range, inclusive. |
The MMDB variant carries the same data in a memory-mapped binary tree, compatible with the standard MMDB reader libraries available for every major programming language.
Downloads
Available formats
| Format | Description | Size |
|---|---|---|
| CSV | Plain text, one range per line. Import into any database or data warehouse. | 4.3 MB |
| CSV (zipped) | Same file compressed for faster downloads and cheaper storage. | 998 KB |
| MMDB | Binary format for instant lookups with standard MMDB readers. | 9.9 MB |
Use cases
What you can build
- Rate limit or challenge requests from recently abusive sources
- Pre-filter registration and comment spam
- Enrich SIEM alerts with abuse reputation
- Protect login endpoints from credential stuffing infrastructure
Related use case: Cyber security
Datasets are available with an Ipregistry subscription and download from your dashboard, or over a stable URL for automated syncs. Prefer live data? The same intelligence is served by the Ipregistry API.