# FFraud

> Free IP and email fraud intelligence. Public API with no key and no usage caps. The list of confirmed attackers is published as MIT open data on GitHub; the API answers for every address and holds far more than the files.

- API base: https://api.ffraud.com
- Full docs as Markdown: https://ffraud.com/llms-full.txt
- OpenAPI spec: https://ffraud.com/openapi.json
- Open data: https://github.com/FFraud-com

## Open data or the API?

The open data is the confirmed core. The API is the full answer. The files on GitHub hold the addresses we have confirmed as attackers, so anyone can block them for free. The API answers for every address, with everything we know about it, including what we keep out of the files on purpose.

| | Open data files | API |
|---|---|---|
| Which addresses | Confirmed attackers only: seen at least twice, score 50 or higher | Any address you ask about |
| Addresses confirmed only once | Left out until a second, independent confirmation | Answered, and already weighed into the score |
| VPN, proxy, Tor, datacenter, residential proxy | Only as the type of a listed attacker | For every address |
| When it was active | No dates | First seen, last seen, times seen, recent abuse |
| Why it is flagged | The worst category | Every threat tag and a written reason |
| Its neighborhood | Not included | How much of its /24 network is abusive |
| Who runs it | Not included | ASN, ISP, organization, hostname, WHOIS abuse contact |
| Where it is | Not included | Country, region, city, timezone |
| Open ports | Not included | Its open ports |
| Email | The list of disposable domains | Also brand-new throwaway services, caught by their mail servers before any list has them |

What FFraud never publishes, and why:

- **Who reported an address, and the evidence they sent.** People report to us in confidence. Their identity, their logs and their screenshots stay with us.
- **Addresses confirmed only once.** One report is a claim, not proof. It goes public after an independent second confirmation; until then only the API weighs it.
- **Where our sensors are.** A honeypot only works while attackers do not know it is one.
- **Which internet providers have infected customers.** A ranking of consumer networks by infected machines would be a target list for criminals. The networks file names only small networks where almost every address we saw was abusive; large providers are left out on purpose.

Use the files to block known attackers in bulk. Use the API when you decide about a specific visitor: a first-time address, a VPN user, a signup from a datacenter. Both are free.

## Docs

### Start here
- [FFraud API](https://ffraud.com/docs): Free IP and email fraud intelligence. No key needed to start, no usage caps, and the confirmed-attacker list is published as MIT open data on GitHub.
- [Authentication](https://ffraud.com/docs/authentication): Public endpoints need no key. A free API key unlocks batch lookups, usage stats and higher burst limits. How to create one and send it with each request.

### API reference
- [IP check API](https://ffraud.com/docs/ip-intelligence): Full fraud intelligence for any IP address: fraud score, VPN, proxy and Tor flags, network owner, geolocation and threat tags, from one free API call.
- [Email check API](https://ffraud.com/docs/email): Tell temporary inboxes from alias addresses, catch typos and dead domains, and spot repeat signups, from one free API call per address. No key needed.
- [Domain reputation](https://ffraud.com/docs/domain): Check whether a domain is a disposable email provider or linked to phishing, with one combined risk level. One free API call, no key needed.
- [Device ID](https://ffraud.com/docs/device-id): Give every device on your site a stable ID and a risk score: one script on the page, one call from your server, with a public key and a secret key.
- [Community reporting](https://ffraud.com/docs/reporting): Report abusive IPs (no account needed), read reports, and vote. Confirmed reports roll into the open-data build, rebuilt every 30 minutes.
- [Migrate in one line](https://ffraud.com/docs/migrate): Drop-in replacement endpoints for AbuseIPDB, IPQualityScore and ipinfo. Change one URL, keep your code, and get the response shape it already expects.

### AI
- [MCP server](https://ffraud.com/docs/mcp): Add FFraud to Claude, Cursor or any MCP client with one address. Four tools check IPs, emails, domains and abuse reports. Free, no key, nothing to install.
- [AI agents](https://ffraud.com/docs/ai-agents): Give an AI agent FFraud's IP, email and domain checks as tools: ready definitions for Claude and OpenAI, the calls behind them, a prompt and llms.txt.

### Open data
- [Open data](https://ffraud.com/docs/open-data): Download the confirmed-attacker list and 220,000 disposable email domains from GitHub, MIT licensed. What the files hold, and what only the API answers.
- [How we score](https://ffraud.com/docs/methodology): How an IP gets listed, how the 0-100 fraud score is built, and why we publish our conclusions but verify every one independently.
- [Feed the database](https://ffraud.com/docs/contribute): Turn every ban you already make into a community report: point fail2ban at a drop-in endpoint, or POST from any script or honeypot. Every block helps.

### Reference
- [Rate limits & fair use](https://ffraud.com/docs/rate-limits): No daily or monthly caps. Just fair-use burst limits to keep the API fast for everyone, and how to raise yours.
- [Errors](https://ffraud.com/docs/errors): The error response shape, the stable error codes (bad key, invalid IP, batch too large, rate limits) and the HTTP status that goes with each class.

## Email check at a glance

POST https://api.ffraud.com/public/email/check with `{"email": "..."}`, no key (`/v1/email/check` with a key adds `blocked`). Fields to build on:

- `email_type`: `temp` (throwaway inbox), `alias` (forwarding address, unlimited per person), `normal` or `invalid`.
- `is_alias_service`: true or false, the yes or no for an alias. `is_disposable` is true for temp and alias alike.
- `did_you_mean`: the corrected address when the domain is one keystroke from a big provider.
- `normalized_email`: one key per mailbox (the +tag removed, Gmail dots removed), for spotting repeat signups.
- `mx_found` and `mx_records`: whether the domain has mail servers, and which.
- `blocked`: keyed calls only, the account's own allow and block lists (`/v1/email/lists`) first, then its two dashboard switches. `allowlisted` and `blocklisted` say which list matched.
- A domain that does not exist or accepts no mail answers `email_type: invalid` (`detection_source: no_mx`).
- `request_id`: quote it to support to have a check traced.

## Free tools

No account, no API key, no usage caps. Each page runs the check in the browser and explains how to read the result.

- [IP blacklist check](https://ffraud.com/ip-blacklist-check): Check any IPv4 or IPv6 address against our abuse database. See if it is listed, why, and how recently.
- [IP reputation](https://ffraud.com/ip-reputation-check): A 0 to 100 fraud score for any IP address, with every signal that produced it shown in the open.
- [Email blacklist check](https://ffraud.com/email-blacklist-check): Paste any email address. Disposable, phishing, role account, known spammer, and community reports, in one verdict.
- [Domain reputation](https://ffraud.com/domain-reputation-checker): Look up any domain for phishing, scam, and disposable-mailbox history, with the evidence shown.
- [Proxy and VPN detection](https://ffraud.com/proxy-vpn-check): Test whether an address is seen as a VPN, proxy, Tor node, or datacenter host, and what to do about it.
- [What is my IP](https://ffraud.com/what-is-my-ip): Your public address, plus the risk score, VPN classification, and network reputation that sites see with it.
- [What is my ISP](https://ffraud.com/what-is-my-isp): See which internet provider your connection runs through, its network, and how sites classify the line.
- [Who is hosting this website](https://ffraud.com/who-is-hosting-this-website): Find the company that hosts any website, the platform it runs on, and whether a CDN stands in front of it.
- [MX lookup](https://ffraud.com/mx-lookup): See a domain's MX records, the mail service behind them, and whether FFraud lists the domain as disposable.
- [SPF checker](https://ffraud.com/spf-checker): Check a domain's SPF record, the DNS lookups it needs against the limit of 10, and the mistakes that make it fail.
- [DMARC checker](https://ffraud.com/dmarc-checker): Check a domain's DMARC policy, where its reports go, and the mistakes that stop it working.
- [DNS lookup](https://ffraud.com/dns-lookup): Every DNS record of a domain at once: A, AAAA, CNAME, MX, NS, TXT, SOA and CAA, with the network behind each address.
- [DKIM checker](https://ffraud.com/dkim-checker): Find a domain's DKIM keys under the common selectors or your own, and check their type, length and status.
- [Email header analyzer](https://ffraud.com/email-header-analyzer): Paste an email's headers to trace its servers, read its SPF, DKIM and DMARC results, and spot the signs of phishing.
- [IP lookup](https://ffraud.com/ip-lookup): Owner, network, autonomous system, reverse DNS, and approximate location for any address.
- [IP check](https://ffraud.com/check): A 0 to 100 fraud score with VPN, proxy, Tor, network type and abuse history for any address.
- [IP abuse check](https://ffraud.com/ip-abuse-check): See whether an address has been reported for attacks, for what, and how much those reports weigh.
- [Email checker](https://ffraud.com/email-checker): Format, disposable providers, role accounts, phishing domains, and known spam addresses in one verdict.
- [Temporary email API](https://ffraud.com/temporary-email-api): Detect disposable addresses from your own code with one unauthenticated call, or download the whole list.
- [Website safety check](https://ffraud.com/website-safety-check): Paste a link to check it against millions of known phishing and scam domains, plus the checks to run yourself.
- [Reverse DNS lookup](https://ffraud.com/reverse-dns-lookup): Find the PTR record for any address, the network behind it, and what the hostname gives away.
- [ASN lookup](https://ffraud.com/asn-lookup): Find the organization behind any network by AS number or IP, and how abusive its observed traffic is.
- [Disposable email checker](https://ffraud.com/disposable-email-checker): Check whether an email domain hands out throwaway mailboxes, and whether to block it at signup.

## Blog

- [Private IP address ranges: RFC 1918 and every other reserved block](https://ffraud.com/blog/private-ip-address-ranges): The three private IPv4 ranges from RFC 1918, every other block that can never be public, and how much of IPv4 that is: 13.8 percent, by IANA's own registries.
- [Static vs dynamic IP: the difference, how to check yours, and why it matters for blocking](https://ffraud.com/blog/static-vs-dynamic-ip): A static IP stays the same; a dynamic IP is lent for a while and can change. How to check which you have, which to choose, and what it means when you block IPs.
- [Free disposable email APIs compared: 10 detection APIs, their limits, keys and terms](https://ffraud.com/blog/free-disposable-email-apis-compared): Ten disposable email detection APIs with a free tier, read on one day: checks a month, keys, commercial terms, what each answers, and how to test them yourself.
- [Phishing statistics 2026: one in three new phishing sites sits on free hosting](https://ffraud.com/blog/phishing-free-hosting-statistics): FFraud listed 66,440 new phishing domains in 30 days. 31.7% sat on free hosting, led by EdgeOne Pages and Cloudflare Pages. The counts, the brands, the method.
- [Disposable email statistics: 100 servers carry 65% of throwaway domains that take mail](https://ffraud.com/blog/disposable-email-mail-servers): Of 46,092 throwaway email domains with a mail server, 64.8% use one of just 100 servers. How to catch a new disposable domain by its mail server, with the data.
- [Email validation regex that will not reject real users (and what a regex cannot catch)](https://ffraud.com/blog/email-validation-regex): A tested email regex for JavaScript, Python and PHP that accepts plus signs and long domains, and the throwaway and dead domains no regex can catch.
- [Stop form spam without a CAPTCHA: a honeypot field plus free IP and email checks](https://ffraud.com/blog/stop-form-spam-honeypot-field): Stop form spam without a CAPTCHA: an accessible honeypot field, a signed time check and free IP and email checks, with tested Node.js and PHP code.
- [Block disposable emails in Django and Python (free API, offline fallback)](https://ffraud.com/blog/block-disposable-emails-django-python): Block throwaway email signups in Python and Django with a free API and a free list of 224,174 domains as backup, in tested code that keeps relay addresses.
- [Block disposable emails in Supabase Auth with a free hook (no API key)](https://ffraud.com/blog/block-disposable-emails-supabase): Block throwaway signups in Supabase Auth with a before-user-created hook: a free Edge Function or a SQL list, both tested, and the 200 answer Auth expects.
- [Block disposable emails in Next.js and Express (middleware, no API key)](https://ffraud.com/blog/block-disposable-emails-nextjs-express): Block throwaway email signups in Next.js and Express with no API key: one small module, a free API call, a free list of 224,174 domains and tested code.
- [Block disposable emails in Laravel with a free validation rule](https://ffraud.com/blog/block-disposable-emails-laravel): Block throwaway email signups in Laravel with one validation rule, a free API call and a free list of 224,174 domains, with tested PHP code and measured costs.
- [Block disposable emails in WordPress and WooCommerce with one plugin file](https://ffraud.com/blog/block-disposable-emails-wordpress): One free plugin file refuses throwaway emails at WordPress signup, both WooCommerce checkouts and Contact Form 7. It keeps relay addresses and needs no API key.
- [Detect proxies and VPNs in PHP and Laravel with a free API (no key)](https://ffraud.com/blog/detect-proxy-php): Detect proxy, VPN and Tor visitors in PHP and Laravel with one free API call, a 5-minute cache file and tested middleware, and why header checks fail.
- [Detect VPN and proxy users in JavaScript and Node.js (free API, no key)](https://ffraud.com/blog/detect-vpn-javascript): Detect VPN, proxy, Tor and data center visitors in Express and Next.js with one free API call, tested on 80 public addresses, and why browser tricks fail.
- [Detect VPN and proxy IPs in Python: Flask, Django and FastAPI (free API)](https://ffraud.com/blog/detect-vpn-python): Detect VPN, proxy and Tor visitors in Flask, Django and FastAPI with one standard-library module and a free API call, tested, with a 5-minute cache.
- [Minecraft anti-VPN: block VPN, proxy and Tor players on Paper for free](https://ffraud.com/blog/minecraft-anti-vpn): Turn away Tor, VPN, proxy and data center players before they join your Paper server, with a tested two-class plugin and FFraud's free IP API.
- [Add a free attacker blocklist to pfSense (pfBlockerNG), OPNsense and MikroTik](https://ffraud.com/blog/pfsense-opnsense-mikrotik-blocklist-feed): Add a free list of confirmed attacker IPs to pfBlockerNG, an OPNsense URL table alias or a MikroTik address list, with tested settings and a safe refresh.
- [Why is my IP location wrong? The causes, the checks, and where to send a correction](https://ffraud.com/blog/why-is-my-ip-location-wrong): Your IP location can show the wrong city or country because of relays, mobile networks, shared addresses or slow databases. Check which one, then fix it.
- [Block a list of IPs in Cloudflare: an IP list, one rule, and a script that keeps it current](https://ffraud.com/blog/cloudflare-block-ip-list): Block thousands of IPs in Cloudflare on any plan: an IP list, one WAF custom rule, and a tested script that refreshes the list from a free feed every six hours.
- [SSH brute force attacks: where they come from and what stops them](https://ffraud.com/blog/ssh-brute-force-attacks): SSH brute force means bots guessing your server's passwords. Our data on 358,485 attackers, the tested OpenSSH settings that stop them, and where fail2ban fits.
- [Malicious IP statistics: what 1.58 million confirmed attackers have in common](https://ffraud.com/blog/malicious-ip-statistics): We counted FFraud's open list of 1,580,496 confirmed malicious IPs: what they do, which networks they use, how often each was confirmed, and how to recount it.
- [Free IP blocklists compared: what each one holds, its terms and how often it changes](https://ffraud.com/blog/free-ip-blocklists-compared): Eight free IP blocklists counted on one day: what earns a listing, how many addresses each holds, how often it updates, its terms, and which one to load first.
- [What is an IP fraud score, and how is it calculated?](https://ffraud.com/blog/what-is-an-ip-fraud-score): An IP fraud score rates how likely traffic from an address is to be abusive. How the number is built, what each band means, and real examples.
- [Why is my IP blocked? Find the reason and fix it](https://ffraud.com/blog/why-is-my-ip-blocked): A site blocked your IP address? What each block message means, the usual causes, how to check your own address for free, and how to get it unblocked.
- [Why is my IP blacklisted, and how do I get it removed?](https://ffraud.com/blog/why-is-my-ip-blacklisted): Your IP is on a blacklist? Find out which kind of list it is (mail, abuse or fraud), why the address was listed, and the removal path for each one.
- ["Unusual traffic from your computer network": why Google shows it and how to fix it](https://ffraud.com/blog/unusual-traffic-from-your-computer-network): "Our systems have detected unusual traffic" means requests from your IP address looked automated to Google. The causes, a free check and the fixes in order.
- [Block known attackers in nginx with a free list that updates itself](https://ffraud.com/blog/nginx-block-malicious-ips): Block known attackers in nginx with a geo map and a free list rebuilt every six hours: tested config, a safe update script, Cloudflare setup and real numbers.
- [Block thousands of bad IPs with iptables and ipset, using a free list that updates itself](https://ffraud.com/blog/block-ip-list-iptables-ipset): Block thousands of known attackers at the Linux firewall with ipset or nftables and a free list rebuilt every six hours. Tested scripts and measured numbers.
- [How to get the real client IP from X-Forwarded-For behind Cloudflare, nginx and load balancers](https://ffraud.com/blog/get-real-client-ip-x-forwarded-for): X-Forwarded-For carries a visitor's IP, and the visitor can forge it. Which entry to trust behind Cloudflare, nginx and load balancers, with tested code.
- [How to stop fake and spam signups with IP and email checks](https://ffraud.com/blog/stop-fake-signups): Spam signups come from scripts and account farms. Check the IP and the email at the form, challenge the doubtful ones and confirm the inbox, with tested code.
- [What is IP reputation, and how do you check it?](https://ffraud.com/blog/what-is-ip-reputation): IP reputation is the record of what an address has done: abuse, network type, neighbors and timing. What builds it, how long it lasts, and how to check it.
- [What is IP abuse, and how do you report an abusive IP address?](https://ffraud.com/blog/what-is-ip-abuse-how-to-report): IP abuse is spam, attacks or fraud sent from an IP address. What counts, how to find the network's abuse contact for free, and what to put in the report.
- [What is CGNAT, and why does it get innocent users blocked?](https://ffraud.com/blog/what-is-cgnat): CGNAT puts many customers of an internet provider behind one public IPv4 address. How it works, how to tell if you are behind it, and why sites block it.
- [What is an ASN (autonomous system number)?](https://ffraud.com/blog/what-is-an-asn): An ASN is the number that identifies one network on the internet. How AS numbers work, how many exist, how to look one up, and why it matters for traffic.
- [What is a botnet, and how do you spot its traffic?](https://ffraud.com/blog/what-is-a-botnet): A botnet is a network of infected computers, routers and cameras run from command servers. How botnets work, how big they get, and how to spot their traffic.
- [What is credential stuffing, and how do you stop it?](https://ffraud.com/blog/what-is-credential-stuffing): Credential stuffing tests stolen username and password pairs on other sites. How it works, where the traffic comes from, and the defenses that stop it.
- [What is card testing, and how do merchants stop it?](https://ffraud.com/blog/what-is-card-testing): Card testing is fraud that checks stolen cards with many small payments. How it shows up at checkout, what it costs a merchant, and the fixes that stop it.
- [What is a disposable email address, and should you block it?](https://ffraud.com/blog/what-is-a-disposable-email-address): A disposable email address is a throwaway inbox for one signup. How it works, how it is detected, what 224,090 known domains look like, and when to block.
- [What is privaterelay.appleid.com? Apple's relay addresses explained for site owners](https://ffraud.com/blog/what-is-privaterelay-appleid-com): privaterelay.appleid.com addresses come from Sign in with Apple and reach a real person. Why to accept them, how mail gets through, and the 2026 domain change.
- [Gmail plus addressing and dots: how one inbox becomes many signups](https://ffraud.com/blog/gmail-dots-and-plus-addressing): Gmail ignores dots and anything after a plus sign, so one inbox can sign up many times. How it works, which providers allow it, and how to normalize emails.
- [Email aliases and Hide My Email: should you block relay addresses?](https://ffraud.com/blog/email-aliases-hide-my-email): Relay services such as Hide My Email and Firefox Relay give each site a unique address that forwards to a real inbox. How they work and when to allow them.
- [Anonymous proxy detected: what it means and how to fix it](https://ffraud.com/blog/anonymous-proxy-detected): Anonymous proxy detected means a site checked your IP address and found a VPN, relay, proxy or datacenter. Find which one applies to you and how to fix it.
- [Tor exit nodes: what they are, where the live list is, and how to check an address](https://ffraud.com/blog/tor-exit-nodes): A Tor exit node is the relay whose address websites see. Get the Tor Project's live list, check one address by DNS, and read an exit's abuse record correctly.
- [fail2ban, but every ban helps everyone](https://ffraud.com/blog/fail2ban-shared-blocklist): fail2ban only knows the IPs that already attacked you. Wire it to a shared, free abuse database to block attackers early, and each ban protects the next person.
- [Anatomy of a command-and-control IP](https://ffraud.com/blog/anatomy-of-a-c2-ip): What a fraud score of 95 actually means. We walk one real C2 server through every signal FFraud saw, and why the score landed where it did.
- [Block disposable email signups in one request](https://ffraud.com/blog/block-disposable-email-signups): Throwaway inboxes are the cheapest way to fake an account. Here are two free ways to stop them: one API call, or a local list you never have to call at all.

## Open data

- [All datasets](https://ffraud.com/data): Every published dataset, MIT licensed, rebuilt every 30 minutes.
- [Malicious IP database](https://ffraud.com/data/malicious-ip-database): Confirmed-malicious IPs, each independently confirmed at least twice, scored and categorised.
- [Disposable email domains](https://ffraud.com/disposable-email-domains): The throwaway and temporary mailbox list, one domain per line.

Direct downloads:
- https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv
- https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/asn-reputation/high-abuse-networks.csv
- https://raw.githubusercontent.com/FFraud-com/disposable-email-domains/main/disposable-email-domains.txt
- https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/metadata.json (live row counts and build time)