Every confirmed attacker, published.
Every address we have caught attacking at least twice, and every disposable email domain we know, in plain files, MIT licensed. No sample and no email form in front of it. For a decision about one visitor, the API knows more than the files. Last built 11 October 2026.
1,476,687
Malicious IP database
Every address we have independently confirmed at least twice, scored 50 or above, tagged with what it was caught doing and what kind of infrastructure it runs on. Ships alongside a smaller file of the networks where the traffic we observed was overwhelmingly abusive.
222,710
Disposable email domains
One of the most complete throwaway and temporary mailbox lists published anywhere, one domain per line. Major providers such as Gmail and Outlook sit on a hard allowlist and can never appear in it, so screening against this file cannot cost you a real customer.
The IP repository also carries a smaller file listing 550 networks where the addresses we observed were overwhelmingly abusive. It reflects traffic we saw, not a judgment about the operator, and corrections are welcome.
Open data and the API
The files are the list. The API is the full answer.
The files on GitHub hold the addresses we have confirmed as attackers, so anyone can block them for free. The API answers for every address, with everything we know about it, including what we keep out of the files on purpose.
| What you want to know | Open data files | API |
|---|---|---|
| Which addresses | Confirmed attackers only: seen at least twice, score 50 or higher | Any address you ask about |
| Addresses confirmed only once | Left out until a second, independent confirmation | Answered, and already weighed into the score |
| VPN, proxy, Tor, datacenter, residential proxy | Only as the type of a listed attacker | For every address |
| When it was active | No dates | First seen, last seen, times seen, recent abuse |
| Why it is flagged | The worst category | Every threat tag and a written reason |
| Its neighbourhood | Not included | How much of its /24 network is abusive |
| Who runs it | Not included | ASN, ISP, organisation, hostname, WHOIS abuse contact |
| Where it is | Not included | Country, region, city, timezone |
| Open ports | Not included | Its open ports |
| The list of disposable domains | Also brand-new throwaway services, caught by their mail servers before any list has them |
Never published, by design
- Who reported an address, and the evidence they sent
- People report to us in confidence. Their identity, their logs and their screenshots stay with us.
- Addresses confirmed only once
- One report is a claim, not proof. It goes public after an independent second confirmation; until then only the API weighs it.
- Where our sensors are
- A honeypot only works while attackers do not know it is one.
- Which internet providers have infected customers
- A ranking of consumer networks by infected machines would be a target list for criminals. The networks file names only small networks where almost every address we saw was abusive; large providers are left out on purpose.
Use the files to block known attackers in bulk. Use the API when you decide about a specific visitor: a first-time address, a VPN user, a signup from a datacenter. Both are free.
Download
Grab it now.
No signup, no key, no download gate. These commands work as they are, right now.
# confirmed-malicious IPs, scored and categorised curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv # disposable and temporary email domains, one per line curl -s https://raw.githubusercontent.com/FFraud-com/disposable-email-domains/main/disposable-email-domains.txt # how big and how fresh the current build is curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/metadata.json
FAQ
Questions people ask
No. The files hold what we have confirmed: every address seen attacking at least twice, with a score and a category, and the disposable email domains. That is what bulk blocking needs. The API answers for any address, including ones confirmed only once, with the VPN and proxy verdict, when it was active, every threat tag and a written reason, the network around it and who runs it. Some things never leave the private database at all: who reported an address and the evidence they sent, where our sensors are, and which internet providers have infected customers.
Because blocking a known attacker should not cost anything, and a list gets better the more people check against it and correct it. We publish what we have confirmed. What needs judgement about one visitor, and what would hurt people if it were public, stays in the API and the private database.
Effectively anything, including commercial use. Use it in a product you sell, redistribute it, modify it, embed it in a firewall or a signup form. The only requirement the license itself carries is that the copyright notice travels with substantial copies. Attribution on your website is appreciated and never required.
Both repositories are rebuilt every 30 minutes directly from the live engine. Each build writes a metadata.json with the exact generation time and the row counts, so you can always verify the age of a copy rather than trust a claim on a web page. The numbers on this page are read from that file, not typed into it.
No. There is no signup, no key, no email capture, and no download gate. The files sit on GitHub and you can fetch them with curl right now. An account exists only for the API, where it raises limits and enables batch calls.
Yes, and corrections are as welcome as additions. Reports go through the report page and are weighted by a reporter trust tier earned over time rather than granted at signup. If something in a list should not be there, we would rather hear it than have it quietly wrong.
Need an answer about one visitor?
The API answers for any address, with the VPN and proxy verdict, recency, the reason and the network around it. No key for single lookups, no daily cap. The free tools run the same checks in the browser.