Companies Using AbuseIPDB

Our crawler reads the TXT records of every domain it visits, and AbuseIPDB's record is about as close to a sysadmin's signature as DNS gets. A domain counts when a TXT record contains abuseipdb-verification. Our October 2026 crawl puts that at 2,642 domains, 1,808 matched to a company, 7th of 17 in Security Testing & Compliance. When I re-read the 2,649 domains in our clean set on 15 October, 2,628 still had it.

What the record proves

AbuseIPDB's FAQ gives the reason to verify: regular users get 1,000 API requests a day, verified webmasters 3,000. Webmaster status also gives a user's reports slightly more weight in the confidence score. So the record marks someone who reports or checks IP addresses in volume, usually from a firewall, a mail server or Fail2Ban, and who wanted the higher limit. It says nothing about buying anything, and a paid Basic or Premium plan leaves no separate trace in DNS.

Sales signal: a domain with this record has a person who reads server logs and automates blocking. That's the buyer for hosting, firewall and log tools, and rarely a procurement department.

One verifier per domain

AbuseIPDB's code is per account, and it barely repeats: the 2,628 domains carry 2,552 different codes, and 2,503 codes sit on a single domain. The biggest shared code covers 16 unrelated Italian and other sites, probably one developer's clients, and another covers 10 small Australian and American businesses. The Portuguese publisher of Correio da Manhã and Record verified 12 of its titles under one code. Eleven more domains carry the record with an empty value, which looks like a DNS template copied without its code; they still count in the 2,642, though they prove nothing. Codes held for other people's domains come to about 1% of the count.

"Almost every AbuseIPDB domain has its own code. That's what a tool used by individual sysadmins looks like in DNS." - David Thomson, CTO at TechnologyChecker.io

Sales signal: you can treat rows as separate decision-makers here, unlike on Wiz or Detectify, where one code can cover dozens of domains.

Steady, not growing

The chart goes from 1,942 domains in June to 2,642 in October. That's our crawl, not AbuseIPDB: the domains we cover turn over each month as dead sites leave and new ones are found, and our DNS detection widened over the same months. 37 domains dropped the record since 16 March 2026, 5 still carry it on another hostname, and 32 of the 38 dropped hostnames had really removed it when I checked.

Sales signal: a pool of about 2,600 domains that changes slowly. Don't build a forecast on the chart.

Who verifies

Small technical businesses. 42.57% of matched companies have 1 to 10 staff and 68.21% have 50 or fewer; IT Services and IT Consulting is the top industry at 18.62%, and IT-related rows add up to 45.62%. 834 domains, 31.57% of the count, match no company. In a random sample of 50 domains I opened, 7 were hosting, VoIP or security firms and 6 were personal sites: a developer's portfolio, a radio hobbyist's blog, self-hosted servers. The big names are universities, Rutgers, Lund and Northern Arizona, plus Ulta Beauty, Eurostar, PizzaExpress and NTPC.

Sales signal: for hosting, VPS and managed-firewall vendors this is a good list. For enterprise security it isn't; filter to the 115 companies above 1,000 staff first.

A European user base

The United States has 449 matched companies, but Germany has 165 and the United Kingdom 136. The European countries in our table add up to 680. Germany, Austria and Switzerland reach 229, about half the American figure. On Wiz's page, Germany and Switzerland together come to 139 against 1,246 American companies.

Sales signal: German-speaking hosting and IT firms are over-represented here. A DACH campaign for server tooling has a usable list.

No switching to report

We publish no migration table for AbuseIPDB, and our checks found no overlap with another tracked tool large enough to quote. That fits the product: it's a free shared database that people use alongside firewalls and other feeds, not instead of them.

"Nobody leaves AbuseIPDB for a competitor. They stop running the server that reported to it, and the DNS record stays where it was." - David Thomson, CTO at TechnologyChecker.io

Sales signal: there's no displacement play here. Sell what sits next to it: blocklists, WAF rules and log analysis.

The stack around it

On the 2,649 clean domains, Cloudflare runs on 49.3% and Cloudflare Browser Insights on 20.42%, against 10.79% on Wiz's page. Google Analytics is on 51.38%, lower than on the other security pages, and Matomo (5.81%) and Plausible (2.23%) take up some of the rest. Consent banners are scarce: CookieYes leads on only 3.78%.

Sales signal: self-hosted, privacy-minded and technical. Developer-first products with self-hosted options will land better than enterprise suites.

What it costs

The pricing page keeps an Individual plan free, with 1,000 checks and reports a day. Basic costs $25 a month ($228 a year) for 10,000, Premium $99 a month ($1,068 a year) for 50,000, and Enterprise is quoted. Marathon Studios Inc. in Pennsylvania has run the service since March 2016, per its FAQ.

Sales signal: most verifiers stay free. The few who need more than 3,000 calls a day are running security products or large networks, and they're the paying minority.

Key takeaways

1. 2,642 domains in October 2026, 7th of 17; nearly all verified a domain for webmaster status at least once.

2. Nearly one code per domain: 2,552 codes on 2,628 domains.

3. 42.57% of matched companies have 1 to 10 staff, and 31.57% of domains match no company.

4. Europe outnumbers the US, 680 matched companies to 449.

5. No switching or overlap large enough to report.

How to use this list

Filter by company size and industry, and keep the domains with no company match for technical products only. Our DNS statistics report explains why we read TXT records as history. The full list of 2,642 domains, with 1,808 matched companies and their size, country and industry, is on TechnologyChecker.io.