The whole database, published.
Not a sample, not a trial slice, not a teaser behind an email form. The data behind every check on this site, in plain files, MIT licensed, rebuilt every 30 minutes. Last built 12 September 2026.
1,268,415
confirmed-malicious addresses
Malicious IP database
Every address we have independently confirmed at least twice, scored 50 or above, tagged with what it was caught doing and what kind of infrastructure it runs on. Ships alongside a smaller file of the networks where the traffic we observed was overwhelmingly abusive.
219,617
throwaway domains
Disposable email domains
One of the most complete throwaway and temporary mailbox lists published anywhere, one domain per line. Major providers such as Gmail and Outlook sit on a hard allowlist and can never appear in it, so screening against this file cannot cost you a real customer.
The IP repository also carries a smaller file listing 537 networks where the addresses we observed were overwhelmingly abusive. It reflects traffic we saw, not a judgment about the operator, and corrections are welcome.
Grab it now.
No signup, no key, no download gate. These commands work as they are, right now.
# confirmed-malicious IPs, scored and categorised curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv # disposable and temporary email domains, one per line curl -s https://raw.githubusercontent.com/FFraud-com/disposable-email-domains/main/disposable-email-domains.txt # how big and how fresh the current build is curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/metadata.json
Questions people ask
Why give the whole database away?
Because most of this industry sells access to lists assembled from public sources and calls the packaging a product. A fraud database also gets better the more people check against it and correct it, so keeping it closed makes it worse. We publish the data and sell the things that are genuinely hard: the sub-millisecond API, the enrichment, the support, and the scale.
What does the MIT license let me do?
Effectively anything, including commercial use. Use it in a product you sell, redistribute it, modify it, embed it in a firewall or a signup form. The only requirement the license itself carries is that the copyright notice travels with substantial copies. Attribution on your website is appreciated and never required.
How fresh is the data?
Both repositories are rebuilt every 30 minutes directly from the live engine. Each build writes a metadata.json with the exact generation time and the row counts, so you can always verify the age of a copy rather than trust a claim on a web page. The numbers on this page are read from that file, not typed into it.
Do I need an account to download?
No. There is no signup, no key, no email capture, and no download gate. The files sit on GitHub and you can fetch them with curl right now. An account exists only for the API, where it raises limits and enables batch calls.
Can I contribute data back?
Yes, and corrections are as welcome as additions. Reports go through the report page and are weighted by a reporter trust tier earned over time rather than granted at signup. If something in a list should not be there, we would rather hear it than have it quietly wrong.
Rather not host it yourself?
The same data answers a free API endpoint that needs no key, and a set of free tools in the browser. Nothing about the download is a reduced version of either.