Fight Fraud.
Fraud, VPN and proxy checks for any IP, plus disposable and temporary email detection. Free, with no signup.
- lookups answered on 23 September 2026
- 678,761
- countries those requests came from
- 137
- confirmed attackers in the open data
- 1,544,269
- disposable email domains
- 223,301
Products
Two checks, one free API.
Score any IP address, and catch throwaway email before it reaches your signup form. Both answer live below: type your own, or click an example.
IP intelligence
Fraud score, VPN, proxy, Tor and datacenter detection, abuse history.
Try
Address
185.220.101.34
Verdict
Critical
Fraud score
100/ 100
Signals
- Tor exit: yes
- VPN: yes
- Proxy: yes
- Datacenter: yes
- Residential proxy: no
- Known abuser: yes
Why
Active command & control (C2) server used to coordinate malware operations. Identified as part of a botnet network. Performing SSH brute force attacks against servers. Exploiting web server vulnerabilities and launching HTTP attacks. Spam and automated registration abuse across multiple platforms. Flagged as an indicator of compromise during active incident response. Persistent high-severity threat, confirmed repeatedly by our honeypot sensors and community reports. VPN connection detected (Tor). Located in a high-risk network neighborhood where 97% of the /24 subnet is flagged for abuse - this level of concentration typically indicates compromised infrastructure or a malicious hosting operation
Full report for 185.220.101.34- 1.5M confirmed attackers, and an answer for every other address too
- Written reason, threat tags, the network around it and who runs it
- No key for single lookups, no daily cap
Email checks
Disposable and temporary addresses, role accounts, reported spammers.
Try
Address
Verdict
Disposable
A throwaway inbox. Block it at signup.
Signals
- Disposable: yes
- Role address: no
- Reported spammer: no
- Valid format: yes
Why
This domain is a known disposable or temporary mailbox provider, confirmed by our own monitoring and by community reports.
Full report for mailinator.com- 223.3K throwaway domains, plus new ones caught by their mail servers
- Gmail, Outlook and other real providers can never be flagged as throwaway
- One call at signup, before the account exists
Already in production: clients that named themselves on 23 September 2026
Requests that day by each client type. 678,761 lookups in total, most of them from apps that do not name themselves.
Migration
Coming from AbuseIPDB, IPQualityScore or ipinfo?
Change the base URL and the key. The answer comes back in the shape your code already parses, with an ffraud_extras object on top.
Requestone line changes
GET https://api.abuseipdb.com/api/v2/check?ipAddress=185.220.101.34
GET https://api.ffraud.com/compat/abuseipdb/v2/check?ipAddress=185.220.101.34
Key: ff_live_your_key
Same Key header, your free FFraud key in it.
- Your parser
- unchanged
- Fields it reads
- 4, same names
- Added
- ffraud_extras
Response200 OK, AbuseIPDB shape
{"data": {"ipAddress": "185.220.101.34","abuseConfidenceScore": 100,"countryCode": "DE","usageType": "Data Center","isp": "TORSERVERS-NET","isTor": true,"ffraud_extras": {"fraud_score": 100,"vpn": true,"proxy": true,"risk": "critical","threat_tags": ["c2_server", "botnet_node", "ssh_brute_force"],"confidence": "high"}}}
fields your code readsonly in FFraud
Live answer for 185.220.101.34, a Tor exit node, reshaped exactly as the compatibility endpoint does it.
Honeypot network
Our honeypot community, all over the world.
People all over the world volunteer to run honeypots and share what hits them with us, next to the reports our community sends in. The globe shows where the addresses they confirmed most often are.
1,000most confirmed addresses
52countries they come from
Where the most come from
- United States423
- Netherlands119
- Germany102
- Portugal47
- Sweden37
- United Kingdom29
- France25
- Vietnam18
Sample taken on 15 September 2026 and located with the FFraud API.
Open data and the API
The download is the list. The API is the full answer.
The files on GitHub hold the addresses we have confirmed as attackers, so anyone can block them for free. The API answers for every address, with everything we know about it, including what we keep out of the files on purpose.
| What you want to know | Open data files | API |
|---|---|---|
| Which addresses | Confirmed attackers only: seen at least twice, score 50 or higher | Any address you ask about |
| Addresses confirmed only once | Left out until a second, independent confirmation | Answered, and already weighed into the score |
| VPN, proxy, Tor, datacenter, residential proxy | Only as the type of a listed attacker | For every address |
| When it was active | No dates | First seen, last seen, times seen, recent abuse |
| Why it is flagged | The worst category | Every threat tag and a written reason |
| Its neighbourhood | Not included | How much of its /24 network is abusive |
| Who runs it | Not included | ASN, ISP, organisation, hostname, WHOIS abuse contact |
| Where it is | Not included | Country, region, city, timezone |
| Open ports | Not included | Its open ports |
| The list of disposable domains | Also brand-new throwaway services, caught by their mail servers before any list has them |
Never published, by design
- Who reported an address, and the evidence they sent
- People report to us in confidence. Their identity, their logs and their screenshots stay with us.
- Addresses confirmed only once
- One report is a claim, not proof. It goes public after an independent second confirmation; until then only the API weighs it.
- Where our sensors are
- A honeypot only works while attackers do not know it is one.
- Which internet providers have infected customers
- A ranking of consumer networks by infected machines would be a target list for criminals. The networks file names only small networks where almost every address we saw was abusive; large providers are left out on purpose.
Use the files to block known attackers in bulk. Use the API when you decide about a specific visitor: a first-time address, a VPN user, a signup from a datacenter. Both are free.
Comparison
Free where others cap or charge.
How FFraud compares with three well-known IP intelligence APIs, going by their public plans.
| Feature | FFraud |  AbuseIPDB |  |  |
|---|---|---|---|---|
| Price | Free, forever | Free tier, then paid | Paid, per lookup | Free tier, then paid |
| Daily cap | None | Capped on free | Billed per lookup | Capped on free |
| Fraud score | Yes | Confidence score | Yes | No |
| VPN, proxy and Tor detection | Yes | Limited | Yes | On paid plans |
| Open ports and CVEs | Yes | No | No | No |
| WHOIS abuse contact | Yes | No | No | Gated |
| Blocklist published as open data | 1.5M IPs, MIT | No bulk export on free | No | No |
Summarised from each provider's public plans. Plans change, so check theirs before you decide. Full comparisons: AbuseIPDB, IPQualityScore and ipinfo.
FAQ
Common questions
What people ask before they send their first request.
Yes. Lookups through the API and the open data cost nothing, with no daily or monthly caps and no credit card. FFraud is an anti-fraud project, not a sales funnel. Fraud data gets better the more people use it and report to it, so a paywall would make it worse.
No. Single lookups work without signing up. A free key adds batch lookups and usage stats.
There are no daily or monthly caps. Short bursts are rate limited to keep the API fast for everyone: cross the limit and you get a 429 for a moment, not a paywall. If you need sustained heavy traffic, email us and we raise your limit for free.
No. The open data is the confirmed core: the addresses we have caught attacking at least twice, with a score and a category, made for blocking in bulk. The API answers for every address, including ones confirmed only once, with the VPN and proxy verdict, when it was active, every threat tag and a written reason, the network around it and who runs it. Some things never leave the private database at all: who reported an address and the evidence they sent, where our sensors are, and which internet providers have infected customers, because a list like that would help criminals more than defenders.
Yes, both the API and the open data. The data is MIT licensed, so you can use it in commercial products, redistribute it and even build a paid product on top. Attribution is appreciated, never required.
Check an address now.
Single lookups need no signup. A free key adds batch calls, usage stats and the reporting API.
Or get a free API key, or read the docs.