One field, a whole takedown workflow.

Planned shape

{
  "ip": "185.220.101.5",
  "asn": 205100,
  "org": "F3 Netze e.V.",
  "abuse_contact": "[email protected]",
  ...
}

The field will be present on every plan (including Free). We derive it from the same daily RIR feeds we use for ASN data, with fallback to the org record when a specific abuse address is missing.

Why surface it as an API field

• One less dependency. No embedded whois library, no separate TCP connection, no 43/tcp egress rules.
• Cached at our edge. Whois is rate-limited by registries; we cache the daily snapshot so your takedown job doesn't get throttled.
• Machine-readable. Parsed into a single RFC 5321 address string. No free-form text munging.

Typical use

1. Your SIEM flags suspicious scraping from a batch of IPs.
2. You POST /v1/batch those IPs to IP-Atlas.
3. For each result, you pull asn, org, and abuse_contact.
4. Your job templates a takedown email to the abuse contact. One job, 100 IPs, no whois dependency.