AbuseRoute API: Acceptable Use Policy
Version 1.0. Effective date: 17 September 2026
This Acceptable Use Policy ("AUP") forms part of the AbuseRoute Terms of Service. Capitalised terms have the meanings given there. Where this AUP and the Terms differ, the stricter provision applies.
The Service returns registration and contact data that registries, registrars and network operators publish for one reason: so that people who need to report a problem with an Internet resource can reach the party responsible for it. Those publishers attach conditions to that data. This AUP exists so that the Customer's use stays within those conditions and WappDev's access to the sources continues for everyone.
1. Permitted purposes
The Customer may use the Service and any information obtained through it only for the following purposes, carried out by or for the Customer's own organisation or the Customer's own clients in respect of their own incidents:
1.1. Identifying the registrar, hosting network operator, content delivery network, DNS provider or mail provider associated with a domain name that is the subject of a security or abuse investigation.
1.2. Identifying the correct recipient for a report of abusive, unlawful or harmful activity (including phishing, malware distribution, fraud, spam, botnet command and control, intellectual-property infringement handled by an authorised party, or child-safety matters) and sending that report.
1.3. Documenting an investigation in the Customer's own case-management or ticketing records.
1.4. Coordinating with law enforcement, courts, CERTs/CSIRTs, or the affected resource holder in connection with a specific incident.
1.5. Operational security tasks that are closely related to the above, such as assessing whether infrastructure involved in an incident is shared, proxied or hosted with a particular provider.
2. Prohibited uses
The Customer must not use the Service or any information obtained through it:
2.1. For advertising, direct marketing, marketing research, sales prospecting, lead generation, recruitment, or the solicitation of any person or organisation for any purpose.
2.2. To compile, aggregate or maintain a database, list or directory of domain registration, network registration or contact information, or to supplement such a database, whether for internal use or for others. Retaining the specific information relevant to an individual investigation in the Customer's case records is permitted.
2.3. To redistribute, publish, resell, sublicense, or otherwise make information obtained through the Service available to any third party, except (a) within an abuse report or investigation file sent to the party responsible for the resources concerned, (b) to law enforcement, a regulator or a court, (c) to the Customer's own client concerning that client's own incident, or (d) as required by law.
2.4. To offer the Service, or a service substantially derived from it, to third parties, including by proxying, wrapping, embedding in a product, or white-labelling, without a separate written agreement with WappDev.
2.5. To identify, locate, contact, profile, monitor or harass any natural person, or for any purpose unrelated to a genuine security or abuse matter. Contact details of role holders (for example an abuse desk mailbox) may be used only to send reports of the kind described in Section 1.
2.6. To interfere with, disrupt, overload or attempt to gain unauthorised access to the Service, its infrastructure or any upstream source; to circumvent rate limits, quotas, key controls or trial restrictions; to share keys between organisations; or to use automated means to obtain more than the plan allows.
2.7. In any manner that would, if done directly by the Customer, breach the terms of use of the sources from which the Service obtains data, including the ARIN Whois Terms of Use, the RIPE Database Terms and Conditions and Acceptable Use Policy, and the terms of the relevant domain registries and registrars.
2.8. In connection with any unlawful activity, or to facilitate harm to any person.
3. Technical conduct
3.1. Requests must be made only through documented endpoints using the Customer's own key.
3.2. The Customer should query domains individually as they arise in investigations. Bulk enumeration of domains unrelated to specific incidents (for example scanning lists of domains to harvest their contacts) is not a permitted purpose and will be treated as a breach of Section 2.2.
3.3. The Customer should honour HTTP 429 responses by backing off and must not retry aggressively.
3.4. The Customer should not cache or store responses beyond what is needed for the investigation to which they relate.
4. Personal data
4.1. Some information returned by the Service is personal data (for example the name or mailbox of an individual listed as an abuse or registrar contact). The Customer is responsible for handling any such data lawfully under the data protection law that applies to it, for the purposes in Section 1 only, and for no longer than the investigation requires.
4.2. Where a person listed in the data asks the Customer to stop contacting them, the Customer should comply unless a lawful basis to continue exists.
5. Reporting and enforcement
5.1. If the Customer becomes aware of any use of its keys that breaches this AUP, it must notify WappDev promptly at contact@abuseroute.com and take steps to stop it.
5.2. WappDev may monitor request metadata (key, timestamp, requesting IP, queried domain, response outcome) to detect breaches and to protect upstream sources. WappDev does not inspect the Customer's investigations beyond that metadata.
5.3. On a suspected breach WappDev may, at its discretion and without liability: warn the Customer; reduce rate limits or quotas; suspend one or more keys; or terminate the Customer's access under the Terms. WappDev will explain the reason unless doing so would prejudice an investigation or is prohibited by law.
5.4. WappDev may report serious misuse to the affected upstream source or to law enforcement.
5.5. WappDev may update this AUP in the manner set out in the Terms, including on shorter notice where an upstream source changes its terms.
Contact. Khaled Doulami, trading as WappDev. Flat 17, 6 Violet Road, London E3 3QH, United Kingdom. contact@abuseroute.com. https://wappdev.co.uk