About BadBot.net

BadBot.net (BadBot Gateway) is a platform for tracking abusive IP addresses. It aggregates reports from our own deployed sensors around the world, applies time-decayed scoring, and exposes a simple API and minimal UI for security and operations teams.

  • Reports abuse with standardized categories and severities
  • Query reputation: score, activity timeline, and category summary
  • High‑risk feeds (JSON/CSV/TXT) for easy integration with firewalls and SIEMs
  • Correlation across indicators via ASN and sensors
  • Enrichment with ASN/WHOIS and passive DNS

Use the search on the home page to look up an IP or domain or explore related indicators under “Correlate”.

Developers can start with the API Documentation for authentication, example requests, feeds, and OpenAPI links.

BadBot.net is maintained and developed by Rick Hoekman.

Where the data comes from

Every score is built from abuse observed by BadBot's own honeypot sensors. No third-party blocklists or recycled lists feed the score. The enrichment shown next to an indicator (location, ASN and WHOIS, DNSBL listings, DNS and passive DNS) is context only and does not change the score.

Terms of use

  • The lookups, API and feeds are free to use, including commercially, to protect your own networks, users and customers.
  • Attribution (“Data: BadBot.net”) is appreciated, not required.
  • Reselling the data, or redistributing it as (part of) a feed, dataset or product of your own, needs written permission from info [at] badbot.net.
  • The data is provided as is, without warranty. A listing records abuse our sensors observed; test before you block.

Getting an address delisted

  • Listings expire on their own. Each report loses half its weight every 14 days, so an address that stops attacking our sensors drops out of the high-risk feeds without any action.
  • To have a listing reviewed sooner, for example after cleaning up a compromised host or when an address was reassigned, email info [at] badbot.net with the IP address or domain and what changed. Requests are reviewed by hand, and a wrong or outdated listing is removed.
  • If the sensors see new abuse from the address, it is listed again.

This product includes GeoLite2 data created by MaxMind, available from maxmind.com.