ffraud.com valid

FFraud

Free IP and email fraud intelligence. Public API with no key and no usage caps. The list of confirmed attackers is published as MIT open data on GitHub; the API answers for every address and holds far more than the files.

For agents: Free public API for IP and email fraud intelligence (VPN, proxy, Tor, disposable email checks), with an MIT-licensed confirmed-attacker list on GitHub.

fraud detectionip reputationemail validationdisposable emailvpn proxy detection

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-21T14:15:40.778Z. Cached copy · Source on ffraud.com

# FFraud

> Free IP and email fraud intelligence. Public API with no key and no usage caps. The list of confirmed attackers is published as MIT open data on GitHub; the API answers for every address and holds far more than the files.

- API base: https://api.ffraud.com
- Full docs as Markdown: https://ffraud.com/llms-full.txt
- OpenAPI spec: https://ffraud.com/openapi.json
- Open data: https://github.com/FFraud-com

## Open data or the API?

The open data is the confirmed core. The API is the full answer. The files on GitHub hold the addresses we have confirmed as attackers, so anyone can block them for free. The API answers for every address, with everything we know about it, including what we keep out of the files on purpose.

| | Open data files | API |
|---|---|---|
| Which addresses | Confirmed attackers only: seen at least twice, score 50 or higher | Any address you ask about |
| Addresses confirmed only once | Left out until a second, independent confirmation | Answered, and already weighed into the score |
| VPN, proxy, Tor, datacenter, residential proxy | Only as the type of a listed attacker | For every address |
| When it was active | No dates | First seen, last seen, times seen, recent abuse |
| Why it is flagged | The worst category | Every threat tag and a written reason |
| Its neighbourhood | Not included | How much of its /24 network is abusive |
| Who runs it | Not included | ASN, ISP, organisation, hostname, WHOIS abuse contact |
| Where it is | Not included | Country, region, city, timezone |
| Open ports | Not included | Its open ports |
| Email | The list of disposable domains | Also brand-new throwaway services, caught by their mail servers before any list has them |

What FFraud never publishes, and why:

- **Who reported an address, and the evidence they sent.** People report to us in confidence. Their identity, their logs and their screenshots stay with us.
- **Addresses confirmed only once.** One report is a claim, not proof. It goes public after an independent second confirmation; until then only the API weighs it.
- **Where our sensors are.** A honeypot only works while attackers do not know it is one.
- **Which internet providers have infected customers.** A ranking of consumer networks by infected machines would be a target list for criminals. The networks file names only small networks where almost every address we saw was abusive; large providers are left out on purpose.

Use the files to block known attackers in bulk. Use the API when you decide about a specific visitor: a first-time address, a VPN user, a signup from a datacenter. Both are free.

## Docs

### Start here
- [FFraud API](https://ffraud.com/docs): Free IP and email fraud intelligence. No key needed to start, no usage caps, and the confirmed-attacker list is published as MIT open data on GitHub.
- [Authentication](https://ffraud.com/docs/authentication): Public endpoints need no key. A free API key unlocks batch lookups, usage stats and higher burst
…

Related sites

Other listed sites in Cybersecurity. See the whole category →

Machine-readable: GET /v1/resolve?q=ffraud.com · GET /v1/domain/ffraud.com · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for ffraud.com:
1. POST https://agentwebmap.com/v1/sites/ffraud.com/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://ffraud.com/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/ffraud.com/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/ffraud.com).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.