AbuseIPDB API and Bewary answer different IP questions

At a glance

AbuseIPDB is a community IP abuse database

AbuseIPDB describes a shared database where sysadmins and webmasters report and look up IP addresses associated with spam, hacking attempts and DDoS. Its CHECK endpoint accepts an IPv4 or IPv6 address. The check tool does not accept URLs, hostnames or CIDR ranges.

According to its documentation, a check returns the IP version, country, usage type, ISP and domain name, together with abuse reports. Its headline output is the Abuse Confidence Score, a 0 to 100 rating of confidence that an IP is malicious.

AbuseIPDB's FAQ says the score considers distinct reporters and reduces each report's weight as it ages. Its documentation identifies geolocation, usage type, ISP and domain as externally supplied fields. The report-based score and the network metadata therefore have different sources.

Bewary returns typed scam checks through REST and MCP

Bewary is a scam detection API and MCP server for apps and AI agents. It looks up links, domains, IP addresses, phone numbers, SMS short codes, email addresses, crypto wallets, IBANs, mobile apps and payment handles.

Every check and lookup returns a typed JSON envelope containing verdict, p_scam, reason_codes, classification, entities and signals. Each entity carries its typed facts and, separately, the datasets checked. Signals carry their source class, weight, dataset and coverage.

The verdict is scam, suspicious, safe or unknown. Unknown means evidence was insufficient or a source failed. Your code must never treat unknown as safe.

The p_scam field ranges from 0 to 1 and is not yet calibrated against labelled data. Stable reason_codes identify the evidence that decided the verdict, strongest first.

The domain field site.p_scam_site is the one calibrated part of Bewary's scores, fitted on labelled hosts. Its calibration is published at GET /v1/calibration/site and refit as the nightly audit labels more hosts. It gives Bewary's verdict on a page its worker read in the last 90 days.

The remote MCP server runs the same code as the REST API. Its tools return outputSchema and structuredContent for clients including Claude, ChatGPT, Cursor and VS Code. The OpenAPI specification, TypeScript types and Python models describe the response contract.

Where AbuseIPDB is stronger

On November 12, 2026, AbuseIPDB's statistics page counted 1,747,986 IP addresses reported in the last 24 hours and 49,980,021 in the last 30 days.

Its documented API also covers subnet checks, report submission and blacklist retrieval. CHECK-BLOCK accepts a subnet in CIDR notation. BLACKLIST returns the most-reported IP addresses. Users can submit an IP address with at least one abuse category.

These are substantive advantages when your product needs report histories, subnet investigations or an IP blocklist. Bewary's IP endpoint returns network and hosting facts. Bewary never places IP addresses on its scam list because many sites share an address.

According to AbuseIPDB's pages, its SLA promises 99% API availability each month. For IP-only lookups, the free plan allows more volume than Bewary's free key, 1,000 checks a day against 1,000 credits a month.

AbuseIPDB also offers Enterprise direct data access and a STIX/TAXII threat feed. The feed is purchased separately from the API plan. Its first-party MCP server means IP reputation checks are available to AI assistants as well.

Where Bewary differs

Bewary accepts the links, domains and contact points that AbuseIPDB's IP check tool does not take. A domain lookup reads registration and expiry dates and the registrar from RDAP. It also checks brand imitation and membership in Bewary's scam list.

Bewary also assesses a new account's contact points in one call through POST /v1/assess for 1 credit. That endpoint returns its own typed object, as do related domains, watches and events. The OpenAPI specification describes each response.

Bewary returns its own verdict with the reason_codes that decided it. No source's output is passed through unchanged. Lookups use no language model, so their answers are fast and repeatable.

Bewary reads phishing and malware URL feeds every hour. It lists an exact link instead of a whole host when the host is a top site, a business's own website, a URL shortener or a platform anyone can publish on.

On November 6, 2026, Bewary's active scam list entries included 715,887 domains, 1,163 links, 14,767 phone numbers and 28,604 crypto wallets. Bewary also listed 805 sanctioned wallets on that date.

Bewary also finds related domains through GET /v1/domain/{host}/related. Relations can include a shared IP address, name servers, a certificate, registrar and registration time, a page template or a tracking ID. Each related domain carries its own verdict and every relation with its strength.

Bewary lists CDNs, large hosting providers, parking providers and DNS providers as pivots with a reason and does not follow them.

The dataset directory at GET /v1/datasets lists each dataset's geography, kind, entity coverage and active entry count. For scam lists, it also gives counts by target country. This endpoint is free and needs no key.

A lookup keeps no record of who asked. The queried value can still enter Bewary's records: a looked-up domain is queued for its web-archive history.

Free use, API limits and commercial use

AbuseIPDB's pricing page, read November 12, 2026, lists the free Individual plan with 1,000 IP checks and reports a day, 100 block checks a day and a blacklist of up to 10,000 IP addresses. Its legal page prohibits commercial use of that plan.

Its documentation calls the same free plan the Standard account. Standard gets 1,000 check, 1,000 report, 100 reports, 100 check-block and 5 blacklist calls a day. It also gets 5 bulk-report and 5 clear-address calls a day.

For Premium, the documentation lists 50,000 check, 50,000 report, 25,000 reports, 5,000 check-block and 500 blacklist calls a day. Bulk-report and clear-address each have a daily limit of 500 calls.

Every call needs a key. A free key gets 1,000 credits a month, no card. Bewary's free allocation covers every endpoint, and an IP lookup costs 1 credit. The browser checkers allow 10 lookups a day per visitor without a key.

Bewary allows 600 requests a minute with an API key. Its batch endpoint accepts up to 1,000 values, charged at 1 credit per item.

AbuseIPDB's legal page also prohibits redistribution of its API data without express permission. Free and Individual plans carry no support or warranty obligations. AbuseIPDB disclaims responsibility for wrong or malicious reports in its database.

Published prices at volume

As of November 12, 2026, AbuseIPDB's pricing page lists Basic at $25 a month or $228 a year with yearly billing. The plan includes 10,000 checks and reports a day.

AbuseIPDB’s pricing page lists Premium at $99 a month or $1,068 a year with yearly billing. The same listing includes 50,000 checks and reports a day. Enterprise has custom pricing and offers direct data access.

Bewary sells prepaid credits without a subscription. Packs cost $20 for 10,000 credits, $100 for 60,000 credits, $500 for 375,000 credits and $2,000 for 2,000,000 credits. Prepaid credits never expire.

Bewary's published pack rates range from $2.00 down to $1.00 per 1,000 credits. A deep domain or link lookup consumes 30 credits.

Moving an IP check from AbuseIPDB to Bewary

An IP network lookup is the overlapping call. AbuseIPDB's documentation describes a CHECK request containing an IPv4 or IPv6 address and an API key. It recommends sending the key in an HTTP header.

For Bewary, send an authenticated GET https://api.bewary.app/v1/ip/{ip} request with the same IP address. The call costs 1 credit. Its answer contains the network owner, ASN, registry country, hosting type and reverse DNS inside Bewary's typed response.

Map the fields your application consumes. Bewary returns the registry country, while AbuseIPDB returns a geolocation country supplied by IPinfo. The country fields do not map one to one. AbuseIPDB's Abuse Confidence Score and report history have no counterpart in Bewary's IP lookup.

Branch on verdict and reason_codes. Keep unknown as its own result and never treat it as safe. Never set a threshold on p_scam alone because it is not yet calibrated against labelled data.

Bewary's response contract is version 1.16.0. Within /v1, changes add fields, enum values and reason codes. Existing names are retained. The OpenAPI specification at https://api.bewary.app/v1/openapi.json describes the response types.

Using AbuseIPDB and Bewary in one app

An app can query AbuseIPDB for community reports about an IP and query Bewary for its network owner and hosting type. A domain, link, email address or wallet collected by the app can receive its own Bewary lookup.

Log AbuseIPDB's Abuse Confidence Score and abuse reports separately from Bewary's verdict and reason_codes. Your trust and safety lead can cite these outputs when explaining a block.

An agent can call AbuseIPDB's MCP check for an IP address's abuse reports. It can call Bewary's lookup_url, lookup_domain or lookup_payment_handle for a link, domain or payment handle in the same message.

Questions

Sources

1. www.abuseipdb.com: Faqwww.abuseipdb.com/faq
2. www.abuseipdb.com: Statisticswww.abuseipdb.com/statistics
3. docs.abuseipdb.comdocs.abuseipdb.com/
4. www.abuseipdb.com: Abuseipdb mcpwww.abuseipdb.com/tutorial/abuseipdb-mcp
5. www.abuseipdb.com: Pricingwww.abuseipdb.com/pricing
6. www.abuseipdb.com: Legalwww.abuseipdb.com/legal
7. www.abuseipdb.com: Stix taxiiwww.abuseipdb.com/stix-taxii