Spaw vs AbuseIPDB
AbuseIPDB is a reputation service built on abuse reports its own users submit: a check returns an abuse confidence score with the report count, country, usage type, ISP and a Tor flag, and plans are sold as daily request allowances rather than credits.
The table uses AbuseIPDB's public pricing and documentation pages as checked on 2026-09-10, and Spaw's own pricing page. A row those pages carry no value for is marked "not on the pages read" rather than guessed at, and that is a statement about the reading and not about what AbuseIPDB publishes.
| spaw | abuseipdb | |
|---|---|---|
| Pricing model | Pay-as-you-go credit packs, or optional monthly plans that deposit the same credits every month for less; both through Stripe Checkout, credits from either never expire | Plans with daily request allowances: Individual free "Forever!", Basic $25/mo or $228/year, Premium $99/mo or $1,068/year, Enterprise custom |
| Free tier | 10 free credits every month, no card required | Individual: free forever with no credit card, 1,000 check and report requests, 100 block checks and 5 bulk reports a day |
| Price per 1,000 at about 10k | $7.80 (Growth pack: 5,000 credits for $39), or $5.80 on the Growth monthly plan (5,000 credits for $29 a month) | not on the pages read |
| Price per 1,000 at about 100k | $4.99 (Volume pack: 100,000 credits for $499), or $3.99 on the Volume monthly plan (100,000 credits for $399 a month) | not on the pages read |
| Addresses no feed covered billed | An answered address costs 1 credit whatever its flags say; a flag no feed could evaluate answers null rather than false, and the answer costs the same | not on the pages read |
| Reserved and private ranges billed | No: reserved, private, loopback, CGNAT, documentation and multicast ranges answer reason reserved_range and are free, and so are repeats within 7 days | not on the pages read |
| Feeds behind the flags | Public feeds, each named in the answer with the date it was synced: DB-IP Lite and RFC 8805 geofeeds for location, the five registries' delegated statistics for allocation, Spamhaus DROP and ASN-DROP and abuse.ch Feodo Tracker for blocklists, the Tor Project's exit list and Onionoo, the Mullvad, NordVPN and Private Internet Access server lists plus the open X4BNet lists, Apple's iCloud Private Relay egress list, the cloud providers' own published ranges, and the verification files Google, Microsoft, OpenAI, Perplexity, DuckDuckGo and Ahrefs publish for their crawlers. | One feed, its own: the abuse confidence score is computed from reports submitted by AbuseIPDB users, and totalReports is "a sum of the reports within maxAgeInDays". A check also returns countryCode, usageType, isp, domain, isTor and isWhitelisted, which "reflects whether the IP is spotted in any of our whitelists". |
| Refresh cadence | Every feed re-syncs daily, the botnet command-and-control list hourly, and the geofeed crawl weekly. Each response names every dataset it consulted with the date it was last synced, and /status lists them all. | Not published as a schedule; reports arrive continuously and the caller chooses the window with maxAgeInDays, which "determines how far back in time we go to fetch reports" (1 to 365 days, default 30). |
| Geolocation source | The DB-IP Lite database, overridden wherever the operator publishes the location itself — an RFC 8805 geofeed, Apple's relay list, a VPN provider's server list. location_source says which answered, and location_confidence is graded from a weekly accuracy report rather than asserted. | Country only: a check returns countryCode alongside the ISP and usage type. No city, coordinates or ASN answer is documented. |
| Bulk limit | 100,000 addresses per bulk job, with an HMAC-signed completion webhook | not on the pages read |
| Batch API | 1,000 addresses per synchronous request; repeats inside the list are looked up once | Bulk reporting rather than bulk checking: 5 bulk reports a day on the free plan, 100 on Basic and 500 on Premium |
| Rate limit | 50 requests per second per key on the IP endpoints | Daily rather than per second: the check endpoint documents 1,000 requests a day (Standard), 3,000 (Webmaster), 5,000 (Supporter), 10,000 (Basic) and 50,000 (Premium) |
| Official SDKs | Python, Node.js, PHP | not on the pages read |
| Data retention | Nothing: no history row and no log line carrying the address, only a hashed 7-day marker that makes a repeat free. Bulk input lists and result files are deleted with the job after 30 days. | not on the pages read |
checked 2026-09-10 · sources: AbuseIPDB pricing, AbuseIPDB API documentation
When AbuseIPDB fits better
Teams that want to know whether other operators have complained about an address recently, and to contribute their own reports back.
- The score is a community judgement: it counts what other operators reported, over a window you choose
- maxAgeInDays lets a caller decide how stale a report may be, from 1 to 365 days
- A free plan generous enough to run a small production service on
When Spaw fits better
Developers who want every public IP feed compiled, dated and named for them, with a risk score whose weights are published so it can be recomputed or ignored.
- AbuseIPDB scores an address from user reports; Spaw's is_blocklisted comes from published netblock lists (Spamhaus DROP and ASN-DROP, abuse.ch Feodo Tracker) and names which list matched
- Spaw answers datacenter, Tor, VPN, relay, crawler, anycast and unallocated flags with geolocation in the same lookup; an AbuseIPDB check answers reputation, country, ISP and Tor
- AbuseIPDB counts requests per day; Spaw bills per answered address and charges nothing for reserved, private and documentation ranges
- Spaw takes your own abuse reports too, and they feed the reported_abuse weights in its risk score for your account
Questions
Does Spaw charge for addresses its feeds do not cover?
Spaw bills per answered address. Reserved, private, loopback, CGNAT, documentation and multicast ranges answer reason reserved_range and are free, and so is a repeat of the same address within seven days. A flag no feed could evaluate answers null rather than false: the address still costs 1 credit, and the null tells you the signal was not checked instead of pretending it was. AbuseIPDB does not publish how it bills them.
Can I run a log file or an export through Spaw?
Yes. A bulk run takes up to 100,000 addresses from the dashboard or the API and returns one row per input address, in input order, with every flag, the risk score and the signals that made it. Repeats inside the list are looked up once, reserved ranges cost nothing, and the finish is announced on an HMAC-signed webhook.
Is there a free tier?
Every Spaw account receives 10 free credits at the start of each month with no card on file, and unused credits accumulate. AbuseIPDB offers: Individual: free forever with no credit card, 1,000 check and report requests, 100 block checks and 5 bulk reports a day.
Try Spaw on your own list
Free credits every month, no card. Upload a list, keep your columns, and download only the rows you want. See the pricing page for every rule, or the AbuseIPDB alternatives.
AbuseIPDB is a trademark of its owner. Spaw is not affiliated with it. Markdown version: /compare/abuseipdb.md