Acceptable Use Policy

What AbuseScore may not be used for, and how to tell us when someone is doing it anyway.

Last updated 2026-09-14 · forms part of the Terms of Service

AbuseScore exists to help people keep automated abuse out of their systems. It is a tool for defence. This policy exists so it does not quietly become a tool for something else.

Do not use it against people

The service describes networks. It must not be turned on individuals.

  • No stalking, harassment, doxxing or tracking a specific person's whereabouts or movements.
  • No building or enriching profiles of identified or identifiable individuals.
  • No attempting to deanonymise the users of privacy tools. Tor, VPNs and privacy relays exist for good reasons and are used by people who need them.
  • No targeting people for who they are , including their nationality, ethnicity, politics, religion, sexuality or health.

Do not use it for decisions the law fences off

A risk score is an opinion about a network. It is not a consumer report and must not be used as an input to decisions about a person's:

  • credit, lending or insurance;
  • employment, promotion or dismissal;
  • housing or tenancy;
  • education, or eligibility for a government benefit.

Using it that way may make you a consumer reporting agency under laws such as the US Fair Credit Reporting Act, with obligations you almost certainly have not met. Do not do it.

Do not turn the fingerprinting into tracking

The browser fingerprinting is for fraud prevention, security and abuse handling on your own service. That is the whole permitted purpose.

Specifically, do not use it to:

  • target advertising, measure an audience, or build a marketing profile;
  • follow a person between websites, or combine what you learn with data from another operator to do so;
  • identify somebody who has asked not to be, or work around a choice they made in their browser;
  • sell, share or otherwise pass an identifier to a third party.

We built it so that most of that is impossible rather than merely forbidden: an identifier belongs to one account, the same browser at another customer is an unrelated identifier, and nothing on either side can connect the two. Attempting to defeat that, by pooling identifiers across accounts or by trying to correlate them with anything else, is a breach of this policy and of the Terms of Service.

Getting consent where the law requires it is your responsibility, before the script runs. The Cookie Policy says what that covers.

Do not use it to attack anything

  • No reconnaissance for an attack on infrastructure you do not own or have permission to test.
  • No scanning, probing or load-testing third-party systems on the back of our results.
  • No use in furtherance of fraud, malware distribution, spam, or any criminal offence.
  • No use that breaches sanctions or export control law.

Do not strip-mine the service

  • No systematic enumeration of the address space to reconstruct our database.
  • No reselling or republishing the raw data, or building a substantially similar dataset from it.
  • No sharing one account across unrelated businesses, and no creating extra accounts to evade free-tier limits or a suspension.
  • No deliberately working around rate limits or quota enforcement.

Use judgement about blocking

This is advice rather than a rule, and we will not suspend you for ignoring it. It is still the difference between using the service well and using it badly.

  • A high score is a reason to look harder, not automatically a reason to refuse someone. Step up to a challenge before you block.
  • Blocking all datacenter traffic blocks legitimate automation, corporate VPNs and a lot of ordinary people.
  • Apple Private Relay is scored at zero deliberately. It is not an anonymiser to fear. It is your iOS customers, and blocking it costs you real revenue.
  • Whole-country blocks based on the geography field punish people for where they live.

Reporting abuse

If you believe an AbuseScore account is being used against this policy, email [email protected] with “abuse report” in the subject. Include whatever evidence you have. We read these the same day.

You do not need to be a customer to report something, and we will not disclose your identity to the account you reported.

If your network is described wrongly

You do not need an account and there is no charge. Email [email protected] with the prefix and what is inaccurate. If we are wrong, we fix it. If the entry is correct we will tell you which source it came from so you can take it up with them, since much of the underlying data is published by third parties we do not control.

Enforcement

Where we can, we warn first and give you a chance to fix it. For serious breaches, meaning unlawful use, targeting individuals or an attack on the service, we suspend immediately and without notice, and we may report the matter to the relevant authorities.

Fees already paid are not refunded when an account is terminated for a serious breach. See Refunds & Cancellation.