AbuseRoute

AbuseRoute API: Quickstart

Given a domain, the API answers: who should this abuse be reported to? One call returns registrar data, registrar abuse contact, DNS observations, and the network operators (with abuse contacts) hosting the domain's current infrastructure.

Base URL: https://api.abuseroute.com

Authentication

Every request requires an API key, via either header:

X-Api-Key: <your-key>
Authorization: Bearer <your-key>

Access is private: there is no anonymous or self-service access, and keys are issued on request to organisations that identify themselves and describe their abuse-handling or security use.

Keys are issued per organization with per-key limits. Trial keys: 5 requests/minute, 50 lookups/day, valid for 2 days from the first request. Exceeding a limit returns 429 Too Many Requests; an expired trial key returns 403 Forbidden. Paid plans raise these limits.

Endpoints

GET /health

Service liveness. No auth required.

{"status":"ok"}

GET /v1/lookup/{domain}

Full abuse-routing lookup for a domain. Internationalized domain names (Unicode) are accepted and converted to punycode automatically.

curl -H "X-Api-Key: $KEY" https://api.abuseroute.com/v1/lookup/example.com

Response (abridged):

{
  "domain": "example.com",
  "timestamp": "2026-08-30T22:00:00Z",
  "registration": {
    "registrar": "GoDaddy.com, LLC",
    "iana_id": 146,
    "registrar_abuse": {
      "email": "abuse@godaddy.com",
      "phone": "tel:480-624-2505"
    },
    "created": "1994-07-06T04:00:00Z",
    "expires": "2027-07-05T04:00:00Z",
    "status": ["client transfer prohibited"],
    "nameservers": ["NS1.EXAMPLE.COM"]
  },
  "dns": {
    "a_records": ["151.101.1.111"],
    "aaaa_records": [],
    "mx_records": ["aspmx.l.google.com"],
    "ns_records": ["dns1.p04.nsone.net"],
    "txt_records": ["v=spf1 ..."]
  },
  "network": [
    {
      "ip": "151.101.1.111",
      "cidr": "151.101.0.0/16",
      "org_name": "Fastly, Inc.",
      "abuse_contact": {
        "email": "abuse@fastly.com",
        "phone": "+1-415-496-9353"
      }
    }
  ],
  "infrastructure": {
    "hosting_provider": null,
    "cdn": "Fastly",
    "mail_provider": "Google Workspace",
    "dns_provider": "NS1",
    "origin_obscured": true,
    "confidence": "high"
  },
  "abuse_contacts": [
    { "role": "registrar", "entity_name": "GoDaddy.com, LLC", "email": "abuse@godaddy.com", "iana_id": 146 },
    { "role": "cdn",       "entity_name": "Fastly",           "email": "abuse@fastly.com" }
  ],
  "status": {
    "domain_exists": true,
    "registration": "found",
    "network_queried": 1,
    "network_found": 1,
    "network_failed": 0,
    "warnings": []
  }
}

Field notes:

Errors

Quotas and overage

Each key has a per-minute limit and a daily allowance (the monthly plan quota spread over the month). Trial keys stop at the allowance with 429 until 00:00 UTC. Paid keys keep being served past the allowance, up to three times it in a day; requests above the allowance are metered as overage and invoiced at the rate on your order, and carry the response header X-AbuseRoute-Quota: overage so your pipeline can see it. Above the ceiling the key returns 429 until the next day. Repeated lookups of the same domain count as requests whether or not we answered from cache, so cache on your side if your pipeline sees the same domain often.

Scope and roadmap

Contact: WappDev, https://wappdev.co.uk