It’s 2 a.m., and the abuse reports are piling up faster than anyone can triage them. Meanwhile, AI-powered phishing is landing in your users’ inboxes from the other direction. Your team is protecting your network on both sides, every day, no matter how much abuse presses on.
Abusix is built for those teams. And today, we’re excited to share the next evolution of our technology to help those teams manage network abuse at scale. We’re introducing a simplified way to leverage the full power of Abusix. And it starts with our products getting one clear name:
- Guardian Mail is now Abusix Mail
- Guardian Ops is now Abusix Ops
- Guardian Intel is now Abusix Intel
Abusix Ops also replaces AbuseHQ, which is reaching end of life, and the new Abusix API, now in beta, lets you build Abusix into your own systems.
In this post, you’ll find:
- Why we made the change now
- What each product does for your team, and how to get started
- How to start building with the Abusix API beta
All network providers have two sides to protect
Every network is responsible for the traffic it carries. Outside your edge, everyone else’s traffic is arriving, along with everyone else’s reports about you. Inside, it’s your network, your customers, and your own telemetry. Most bad days start when something unwelcome crosses between the two.
When the outside world’s threats become yours to manage
Spam, phishing, and malware arrive at your edge, aimed at your users. When one gets through, someone else’s attack becomes your ransomware, your helpdesk queue, and your team’s capacity.
When the inside world starts blocking your business
One compromised customer starts sending abusive mail from your IP ranges, causing your ranges to land on blocklists, and a mailbox provider suddenly starts refusing your mail — every one of your customers’ mail. Then your call center takes thousands of calls about blocked customer accounts that were caught in the remediation process, and regulators start asking questions about what you did and when.
Abusix guards that crossing in both directions. It’s the purpose behind every product we build.
We’re giving every product the Abusix name
Your team shouldn’t need a glossary to work out which product does what. Until now, our products ran under different names: Guardian and AbuseHQ.
Two things have made now the right time to fix that. AbuseHQ is reaching end-of-life, and Abusix Ops, its replacement, is fully mature and already in daily use by our customers.
One platform should carry one name. It also makes room for what’s next on our product roadmap, starting with the Abusix API.
“Abusix Ops has replaced AbuseHQ and proven itself at our customers’ abuse desks, so it was time for one platform to carry one name. The Abusix API is our next step. It lets our customers build Abusix into the systems they already run, and there’s more to come.” – Tobias Knecht, Founder & CEO of Abusix
Abusix products cheat sheet
Not sure what your product is called now? Here’s how the names map.
| Previous name | New name | What it does for you |
| Guardian Mail | Abusix Mail | Blocks email threats at the first connection with DNS blocklists (DNSBLs) |
| Guardian Ops | Abusix Ops | Automates network abuse handling, from first abuse report to resolution |
| AbuseHQ | Abusix Ops (replacement) | Legacy abuse management platform, now reaching end of life |
| Intel | Abusix Intel | Sends threat intelligence feeds to your SIEM and threat intelligence platform |
| New | Abusix API (beta) | Gives you programmatic access to Abusix products, starting with Abusix Ops |
You’ll see the new names on abusix.com, in our documentation, and inside the products you log into.
What each Abusix product does for your team
Abusix Mail stops malicious actors from the outside world from getting into your network, and Abusix Ops ensures your own customer accounts don’t become an outside-world problem. Our unique threat intelligence from Abusix Intel fuels both.
Together, they strengthen each other; Abusix Ops customers generate live abuse reports, which sharpen Abusix Intel, which improves Abusix Mail’s catch rate, which reduces the inbound abuse that Abusix Ops customers have to handle. We call this the Abusix flywheel effect.
Abusix Mail: block email threats before they reach your users
Abusix Mail is a set of curated DNS blocklists (DNSBLs) for your inbound and outbound mail servers. It rejects known-bad senders at the first connection, before anything gets scanned.
It catches 99.6% of malicious traffic across IPs, domains, and URLs, usually in under a second. The false-positive rate stays under 0.284%, and our data comes from direct observation, not from someone else’s email blocklist.
Every threat feed has coverage gaps, and you usually find them when a customer reports one. Abusix Mail supplements your existing data feeds with 100% empirical threat intelligence across IPs, domains, and URLs, and runs in parallel with what you already ingest.
Get started: Read the Abusix Mail docs.
Abusix Ops: automate abuse handling from first report to resolution
Abuse desks are stretched thin, and the increase in AI-driven abuse volume is the next wave the team is facing. We built Abusix Ops, the successor to AbuseHQ, to take the manual load off your team and automate the processing of abuse, no matter the volume.
Simply start by forwarding your abuse reports by email, XARF, or Global Reporting, and Abusix Ops normalizes them all to XARF. It splits each report into events, so one bulk brute-force report becomes one event per port, and matches every event to the customer behind the IP address. Case groups then turn events into cases using your rules, and playbooks run your escalation policy automatically. Playbooks can call your APIs, schedule delayed actions, and share evidence with your customers.
Get started in four steps:
- Forward your abuse reports to Abusix Ops.
- Set up customer resolution. We recommend API resolution, so you keep tracking abuse even when IPs, domains, or ports change.
- Create case groups to turn events into cases.
- Attach a playbook to each case group to automate your response.
Get started: Read the Abusix Ops docs.
Abusix Intel: unique threat intelligence for your SIEM
Abusix Intel starts with data we generate ourselves, from over 12 billion threat indicators captured each day via a global network of sensors, spam traps, and honeypots. We catch real-world malicious activity as it happens, and live abuse reports flow in from the email, network, and ISP infrastructures we run abuse management for. Use it to enrich investigations, check IP reputation, correlate events, and block malicious assets before they cause damage.
Most threat intelligence feeds start with network traffic or endpoint telemetry. We start with email, still the most common attack vector, so you see phishing campaigns, spam runs, and malware infrastructure early.
Get started: Abusix Intel is available through our Enterprise API. Email [email protected] or read the Abusix Intel docs.
Abusix API (beta): build on the Abusix platform
The Abusix API gives you direct, programmatic access to your incoming abuse data. Instead of working only inside the Abusix interface, you can pull that data straight into the systems your team already relies on.
It builds on how Abusix Ops already connects to your stack. Customer resolution queries your own API to map each IP address to the right customer ID. Playbooks trigger API calls into your systems, so a confirmed case can kick off a ticket, a notification, or a block automatically.
The Abusix API completes that loop. Your systems can now reach into Abusix as easily as Abusix reaches into them, so you can automate the workflows your team still runs by hand and build tooling around your own processes. Try out Abusix API (beta) for Abusix Ops endpoints today.
Get started: Read the Abusix API docs.
What this means for your network abuse analysts
Seven of the ten largest European telcos already run Abusix, giving their security and network abuse management teams highly automated abuse handling that gives them their time back.
With Abusix, up to 99% of abuse incidents are resolved without an analyst touching them, and mean time to resolution drops by more than 60%.
We’re relentless in the pursuit of making the internet safer for everyone, and we welcome you to join the mission.
Book a demo to test the quality > [demo URL needed]
Frequently asked questions
Do I need to change anything because of the new names?
Abusix Mail, Abusix Ops, and Abusix Intel are the current names for the products previously sold as Guardian Mail, Guardian Ops (and before that AbuseHQ), and Guardian Intel. Same platform, same data, with an expanded automation engine and richer enrichment. Existing integrations, API access, and documentation remain supported, and current customers need to take no action.
What happens to AbuseHQ?
AbuseHQ is reaching end of life, and Abusix Ops replaces it. Still on AbuseHQ? Talk to your Abusix account team, and we’ll help you plan your move to Abusix Ops.
Can I use Abusix Mail with Google Workspace or Microsoft 365?
Yes, if you run an email gateway in front of Google Workspace or Microsoft 365. Point your domain’s MX records to that gateway, and you can use Abusix Mail upstream of Google or Microsoft.
Can I use the Abusix API today?
Yes. It’s in beta, with Abusix Ops endpoints available under the /beta path prefix. The Abusix API docs list everything that’s live.
Do we need all three Abusix products?
No. Each product works on its own, and most customers start with whichever side of the problem hurts most, then add the other. Running all three is what closes the loop: the abuse reports your desk generates in Abusix Ops improve the threat data behind Abusix Mail, so the volume you have to handle keeps dropping.
