# FFraud

> Free IP and email fraud intelligence. Public API with no key and no usage caps. The list of confirmed attackers is published as MIT open data on GitHub; the API answers for every address and holds far more than the files.

- API base: https://api.ffraud.com
- Full docs as Markdown: https://ffraud.com/llms-full.txt
- OpenAPI spec: https://ffraud.com/openapi.json
- Open data: https://github.com/FFraud-com

## Open data or the API?

The open data is the confirmed core. The API is the full answer. The files on GitHub hold the addresses we have confirmed as attackers, so anyone can block them for free. The API answers for every address, with everything we know about it, including what we keep out of the files on purpose.

| | Open data files | API |
|---|---|---|
| Which addresses | Confirmed attackers only: seen at least twice, score 50 or higher | Any address you ask about |
| Addresses confirmed only once | Left out until a second, independent confirmation | Answered, and already weighed into the score |
| VPN, proxy, Tor, datacenter, residential proxy | Only as the type of a listed attacker | For every address |
| When it was active | No dates | First seen, last seen, times seen, recent abuse |
| Why it is flagged | The worst category | Every threat tag and a written reason |
| Its neighbourhood | Not included | How much of its /24 network is abusive |
| Who runs it | Not included | ASN, ISP, organisation, hostname, WHOIS abuse contact |
| Where it is | Not included | Country, region, city, timezone |
| Open ports | Not included | Its open ports |
| Email | The list of disposable domains | Also brand-new throwaway services, caught by their mail servers before any list has them |

What FFraud never publishes, and why:

- **Who reported an address, and the evidence they sent.** People report to us in confidence. Their identity, their logs and their screenshots stay with us.
- **Addresses confirmed only once.** One report is a claim, not proof. It goes public after an independent second confirmation; until then only the API weighs it.
- **Where our sensors are.** A honeypot only works while attackers do not know it is one.
- **Which internet providers have infected customers.** A ranking of consumer networks by infected machines would be a target list for criminals. The networks file names only small networks where almost every address we saw was abusive; large providers are left out on purpose.

Use the files to block known attackers in bulk. Use the API when you decide about a specific visitor: a first-time address, a VPN user, a signup from a datacenter. Both are free.

## Docs

### Start here
- [FFraud API](https://ffraud.com/docs): Free IP and email fraud intelligence. No key needed to start, no usage caps, and the confirmed-attacker list is published as MIT open data on GitHub.
- [Authentication](https://ffraud.com/docs/authentication): Public endpoints need no key. A free API key unlocks batch lookups, usage stats and higher burst limits. How to create one and send it with each request.

### API reference
- [IP intelligence](https://ffraud.com/docs/ip-intelligence): Full fraud intelligence for any IP address: fraud score, VPN, proxy and Tor flags, network owner, geolocation and threat tags, from one free API call.
- [Email checks](https://ffraud.com/docs/email): Detect disposable, throwaway and community-blacklisted email addresses before they cost you a fake signup. One free API call per address, no key needed.
- [Domain reputation](https://ffraud.com/docs/domain): Check whether a domain is a disposable email provider or linked to phishing, with one combined risk level. One free API call, no key needed.
- [Community reporting](https://ffraud.com/docs/reporting): Report abusive IPs (no account needed), read reports, and vote. Confirmed reports roll into the open-data build, rebuilt every 30 minutes.
- [Migrate in one line](https://ffraud.com/docs/migrate): Drop-in replacement endpoints for AbuseIPDB, IPQualityScore and ipinfo. Change one URL, keep your code, and get the response shape it already expects.

### Open data
- [Open data](https://ffraud.com/docs/open-data): Download the confirmed-attacker list and 220,000 disposable email domains from GitHub, MIT licensed. What the files hold, and what only the API answers.
- [How we score](https://ffraud.com/docs/methodology): How an IP gets listed, how the 0-100 fraud score is built, and why we publish our conclusions but verify every one independently.
- [Feed the database](https://ffraud.com/docs/contribute): Turn every ban you already make into a community report: point fail2ban at a drop-in endpoint, or POST from any script or honeypot. Every block helps.

### Reference
- [Rate limits & fair use](https://ffraud.com/docs/rate-limits): No daily or monthly caps. Just fair-use burst limits to keep the API fast for everyone, and how to raise yours.
- [Errors](https://ffraud.com/docs/errors): The error response shape, the stable error codes (bad key, invalid IP, batch too large, rate limits) and the HTTP status that goes with each class.

## Free tools

No account, no API key, no usage caps. Each page runs the check in the browser and explains how to read the result.

- [IP blacklist check](https://ffraud.com/tools/ip-blacklist-check): Check any IPv4 or IPv6 address against our abuse database. See if it is listed, why, and how recently.
- [IP reputation](https://ffraud.com/tools/ip-reputation-check): A 0 to 100 fraud score for any IP address, with every signal that produced it shown in the open.
- [Email blacklist check](https://ffraud.com/tools/email-blacklist-check): Paste any email address. Disposable, phishing, role account, known spammer, and community reports, in one verdict.
- [Domain reputation](https://ffraud.com/tools/domain-reputation-checker): Look up any domain for phishing, scam, and disposable-mailbox history, with the evidence shown.
- [Proxy and VPN detection](https://ffraud.com/tools/proxy-vpn-detection): Test whether an address is seen as a VPN, proxy, Tor node, or datacenter host, and what to do about it.
- [What is my IP](https://ffraud.com/tools/what-is-my-ip): Your public address, plus the risk score, VPN classification, and network reputation that sites see with it.
- [Free IP lookup](https://ffraud.com/free-ip-lookup): Owner, network, autonomous system, reverse DNS, and approximate location for any address.
- [Free IP abuse check](https://ffraud.com/free-ip-abuse-check): See whether an address has been reported for attacks, for what, and how much those reports weigh.
- [Free email checker](https://ffraud.com/free-email-checker): Format, disposable providers, role accounts, phishing domains, and known spam addresses in one verdict.
- [Free temp email API](https://ffraud.com/free-temporary-email-api): Detect disposable addresses from your own code with one unauthenticated call, or download the whole list.
- [Website safety check](https://ffraud.com/free-website-safety-check): Paste a link to check it against millions of known phishing and scam domains, plus the checks to run yourself.
- [Reverse DNS lookup](https://ffraud.com/free-reverse-dns-lookup): Find the PTR record for any address, the network behind it, and what the hostname gives away.
- [ASN lookup](https://ffraud.com/free-asn-lookup): Find the organisation behind any network by AS number or IP, and how abusive its observed traffic is.
- [Disposable email checker](https://ffraud.com/tools/disposable-email-checker): Check whether an email domain hands out throwaway mailboxes, and whether to block it at signup.

## Open data

- [All datasets](https://ffraud.com/data): Every published dataset, MIT licensed, rebuilt every 30 minutes.
- [Malicious IP database](https://ffraud.com/data/malicious-ip-database): Confirmed-malicious IPs, each independently confirmed at least twice, scored and categorised.
- [Disposable email domains](https://ffraud.com/disposable-email-domains): The throwaway and temporary mailbox list, one domain per line.

Direct downloads:
- https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv
- https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/asn-reputation/high-abuse-networks.csv
- https://raw.githubusercontent.com/FFraud-com/disposable-email-domains/main/disposable-email-domains.txt
- https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/metadata.json (live row counts and build time)