Check
Open data
IP address
Email
Domain and DNS
Build
$ curl api.ffraud.com/public/ip/185.220.101.34
How fraud detection works, what our signals mean, and how to use the free API and the open data.
October 26, 2026 · 9 min read · Email
Email validation regex that will not reject real users (and what a regex cannot catch)
A tested email regex for JavaScript, Python and PHP that accepts plus signs and long domains, and the throwaway and dead domains no regex can catch.
Read the post
October 26, 2026 · 11 min read · Blocking
Stop form spam without a CAPTCHA: a honeypot field plus free IP and email checks
Stop form spam without a CAPTCHA: an accessible honeypot field, a signed time check and free IP and email checks, with tested Node.js and PHP code.
Block disposable emails in Django and Python (free API, offline fallback)
Block throwaway email signups in Python and Django with a free API and a free list of 224,174 domains as backup, in tested code that keeps relay addresses.
October 26, 2026 · 11 min read · Email
Block disposable emails in Supabase Auth with a free hook (no API key)
Block throwaway signups in Supabase Auth with a before-user-created hook: a free Edge Function or a SQL list, both tested, and the 200 answer Auth expects.
Block disposable emails in Next.js and Express (middleware, no API key)
Block throwaway email signups in Next.js and Express with no API key: one small module, a free API call, a free list of 224,174 domains and tested code.
October 26, 2026 · 8 min read · Email
Block disposable emails in Laravel with a free validation rule
Block throwaway email signups in Laravel with one validation rule, a free API call and a free list of 224,174 domains, with tested PHP code and measured costs.
October 26, 2026 · 10 min read · Email
Block disposable emails in WordPress and WooCommerce with one plugin file
One free plugin file refuses throwaway emails at WordPress signup, both WooCommerce checkouts and Contact Form 7. It keeps relay addresses and needs no API key.
October 26, 2026 · 7 min read · IP
Detect proxies and VPNs in PHP and Laravel with a free API (no key)
Detect proxy, VPN and Tor visitors in PHP and Laravel with one free API call, a 5-minute cache file and tested middleware, and why header checks fail.
Detect VPN and proxy users in JavaScript and Node.js (free API, no key)
Detect VPN, proxy, Tor and data center visitors in Express and Next.js with one free API call, tested on 80 public addresses, and why browser tricks fail.
Detect VPN and proxy IPs in Python: Flask, Django and FastAPI (free API)
Detect VPN, proxy and Tor visitors in Flask, Django and FastAPI with one standard-library module and a free API call, tested, with a 5-minute cache.
October 26, 2026 · 11 min read · IP
Minecraft anti-VPN: block VPN, proxy and Tor players on Paper for free
Turn away Tor, VPN, proxy and data center players before they join your Paper server, with a tested two-class plugin and FFraud's free IP API.
October 25, 2026 · 11 min read · Blocking
Add a free attacker blocklist to pfSense (pfBlockerNG), OPNsense and MikroTik
Add a free list of confirmed attacker IPs to pfBlockerNG, an OPNsense URL table alias or a MikroTik address list, with tested settings and a safe refresh.
October 25, 2026 · 6 min read · Help
Why is my IP location wrong? The causes, the checks, and where to send a correction
Your IP location can show the wrong city or country because of relays, mobile networks, shared addresses or slow databases. Check which one, then fix it.
October 25, 2026 · 6 min read · Blocking
Block a list of IPs in Cloudflare: an IP list, one rule, and a script that keeps it current
Block thousands of IPs in Cloudflare on any plan: an IP list, one WAF custom rule, and a tested script that refreshes the list from a free feed every six hours.
October 24, 2026 · 6 min read · Blocking
SSH brute force attacks: where they come from and what stops them
SSH brute force means bots guessing your server's passwords. Our data on 358,485 attackers, the tested OpenSSH settings that stop them, and where fail2ban fits.
October 23, 2026 · 6 min read · Data
Malicious IP statistics: what 1.58 million confirmed attackers have in common
We counted FFraud's open list of 1,580,496 confirmed malicious IPs: what they do, which networks they use, how often each was confirmed, and how to recount it.
October 23, 2026 · 8 min read · Blocking
Free IP blocklists compared: what each one holds, its terms and how often it changes
Eight free IP blocklists counted on one day: what earns a listing, how many addresses each holds, how often it updates, its terms, and which one to load first.
October 23, 2026 · 7 min read · IP
What is an IP fraud score, and how is it calculated?
An IP fraud score rates how likely traffic from an address is to be abusive. How the number is built, what each band means, and real examples.
October 23, 2026 · 9 min read · Help
Why is my IP blocked? Find the reason and fix it
A site blocked your IP address? What each block message means, the usual causes, how to check your own address for free, and how to get it unblocked.
October 23, 2026 · 8 min read · Help
Why is my IP blacklisted, and how do I get it removed?
Your IP is on a blacklist? Find out which kind of list it is (mail, abuse or fraud), why the address was listed, and the removal path for each one.
October 23, 2026 · 10 min read · Help
"Unusual traffic from your computer network": why Google shows it and how to fix it
"Our systems have detected unusual traffic" means requests from your IP address looked automated to Google. The causes, a free check and the fixes in order.
Block known attackers in nginx with a free list that updates itself
Block known attackers in nginx with a geo map and a free list rebuilt every six hours: tested config, a safe update script, Cloudflare setup and real numbers.
Block thousands of bad IPs with iptables and ipset, using a free list that updates itself
Block thousands of known attackers at the Linux firewall with ipset or nftables and a free list rebuilt every six hours. Tested scripts and measured numbers.
October 23, 2026 · 12 min read · Developers
How to get the real client IP from X-Forwarded-For behind Cloudflare, nginx and load balancers
X-Forwarded-For carries a visitor's IP, and the visitor can forge it. Which entry to trust behind Cloudflare, nginx and load balancers, with tested code.
October 23, 2026 · 8 min read · Fraud
How to stop fake and spam signups with IP and email checks
Spam signups come from scripts and account farms. Check the IP and the email at the form, challenge the doubtful ones and confirm the inbox, with tested code.
October 23, 2026 · 5 min read · IP
What is IP reputation, and how do you check it?
IP reputation is the record of what an address has done: abuse, network type, neighbors and timing. What builds it, how long it lasts, and how to check it.
October 23, 2026 · 7 min read · Help
What is IP abuse, and how do you report an abusive IP address?
IP abuse is spam, attacks or fraud sent from an IP address. What counts, how to find the network's abuse contact for free, and what to put in the report.
October 23, 2026 · 6 min read · IP
What is CGNAT, and why does it get innocent users blocked?
CGNAT puts many customers of an internet provider behind one public IPv4 address. How it works, how to tell if you are behind it, and why sites block it.
What is an ASN (autonomous system number)?
An ASN is the number that identifies one network on the internet. How AS numbers work, how many exist, how to look one up, and why it matters for traffic.
October 23, 2026 · 4 min read · Threat intel
What is a botnet, and how do you spot its traffic?
A botnet is a network of infected computers, routers and cameras run from command servers. How botnets work, how big they get, and how to spot their traffic.
October 23, 2026 · 5 min read · Fraud
What is credential stuffing, and how do you stop it?
Credential stuffing tests stolen username and password pairs on other sites. How it works, where the traffic comes from, and the defenses that stop it.
October 23, 2026 · 4 min read · Fraud
What is card testing, and how do merchants stop it?
Card testing is fraud that checks stolen cards with many small payments. How it shows up at checkout, what it costs a merchant, and the fixes that stop it.
October 23, 2026 · 5 min read · Email
What is a disposable email address, and should you block it?
A disposable email address is a throwaway inbox for one signup. How it works, how it is detected, what 224,090 known domains look like, and when to block.
October 23, 2026 · 6 min read · Email
What is privaterelay.appleid.com? Apple's relay addresses explained for site owners
privaterelay.appleid.com addresses come from Sign in with Apple and reach a real person. Why to accept them, how mail gets through, and the 2026 domain change.
Gmail plus addressing and dots: how one inbox becomes many signups
Gmail ignores dots and anything after a plus sign, so one inbox can sign up many times. How it works, which providers allow it, and how to normalize emails.
Email aliases and Hide My Email: should you block relay addresses?
Relay services such as Hide My Email and Firefox Relay give each site a unique address that forwards to a real inbox. How they work and when to allow them.
Anonymous proxy detected: what it means and how to fix it
Anonymous proxy detected means a site checked your IP address and found a VPN, relay, proxy or datacenter. Find which one applies to you and how to fix it.
Tor exit nodes: what they are, where the live list is, and how to check an address
A Tor exit node is the relay whose address websites see. Get the Tor Project's live list, check one address by DNS, and read an exit's abuse record correctly.
July 3, 2026 · 5 min read · Guides
fail2ban, but every ban helps everyone
fail2ban only knows the IPs that already attacked you. Wire it to a shared, free abuse database to block attackers early, and each ban protects the next person.
July 2, 2026 · 5 min read · Threat intel
Anatomy of a command-and-control IP
What a fraud score of 95 actually means. We walk one real C2 server through every signal FFraud saw, and why the score landed where it did.
July 2, 2026 · 4 min read · Email
Block disposable email signups in one request
Throwaway inboxes are the cheapest way to fake an account. Here are two free ways to stop them: one API call, or a local list you never have to call at all.