The malicious IP database, free to download.
1,476,687 confirmed-malicious addresses, each independently confirmed at least twice and scored 50 or above, categorised by what it was caught doing and the infrastructure it runs on. MIT licensed, rebuilt every 30 minutes. Last built 11 October 2026.
The file
What a row looks like
ip,ffraud_score,confirmations,category,type 80.82.77.33,95,41,c2,proxy 2.57.121.112,95,39,c2,proxy 195.178.110.137,95,38,c2,proxy 45.148.10.121,95,32,c2,datacenter
ip
The address. IPv4 and IPv6 both appear in the same file.
ffraud_score
Our own 0 to 100 score. Nothing below 50 is exported, so every row in this file is already past the threshold where we would act on it ourselves.
confirmations
How many times the abuse was independently observed. An address needs at least two before it can appear here at all, which is what keeps single-source noise out.
category
The worst behavior observed: c2, malware, botnet, brute_force, web_attack, scanner, phishing, spam, or abuse.
type
Infrastructure where known: proxy, vpn, tor, datacenter, or mobile. Blank when we could not classify it, rather than guessed.
Open data and the API
What the file leaves out
The file is made for blocking known attackers in bulk. For a decision about one visitor, the API answers with far more, and some things never leave the private database.
| What you want to know | Open data files | API |
|---|---|---|
| Which addresses | Confirmed attackers only: seen at least twice, score 50 or higher | Any address you ask about |
| Addresses confirmed only once | Left out until a second, independent confirmation | Answered, and already weighed into the score |
| VPN, proxy, Tor, datacenter, residential proxy | Only as the type of a listed attacker | For every address |
| When it was active | No dates | First seen, last seen, times seen, recent abuse |
| Why it is flagged | The worst category | Every threat tag and a written reason |
| Its neighbourhood | Not included | How much of its /24 network is abusive |
| Who runs it | Not included | ASN, ISP, organisation, hostname, WHOIS abuse contact |
| Where it is | Not included | Country, region, city, timezone |
| Open ports | Not included | Its open ports |
| The list of disposable domains | Also brand-new throwaway services, caught by their mail servers before any list has them |
Never published, by design
- Who reported an address, and the evidence they sent
- People report to us in confidence. Their identity, their logs and their screenshots stay with us.
- Addresses confirmed only once
- One report is a claim, not proof. It goes public after an independent second confirmation; until then only the API weighs it.
- Where our sensors are
- A honeypot only works while attackers do not know it is one.
- Which internet providers have infected customers
- A ranking of consumer networks by infected machines would be a target list for criminals. The networks file names only small networks where almost every address we saw was abusive; large providers are left out on purpose.
Threat categories
What the addresses were caught doing
Every category in the file has its own page: what the signature means, how severe it is, and what usually comes with it.
Use it
Three lines of shell
Download it
One file, no key, no rate limit, no account. Point curl at it and you have the whole list.
curl -sO https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv
Filter to what you care about
Most people do not want everything. Pull only the categories that matter to you, or only the rows above a score you choose.
curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv \
| awk -F, '$2 >= 90 && $4 == "c2" { print $1 }' > c2.txtFeed it to a firewall
The addresses are plain text in the first column, which is the format every blocklist tool already expects.
curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv \ | tail -n +2 | cut -d, -f1 > /etc/blocklist.txt
A companion file lists 550 networks where the traffic we observed was overwhelmingly abusive. It sits in the same repository under asn-reputation, with wording that reflects observed traffic rather than a judgment about the operator.
FAQ
Questions people ask
The file lists addresses we have confirmed as attackers, with a score, one category and the infrastructure type. The API answers for any address, including ones confirmed only once, with VPN, proxy, Tor, datacenter and residential proxy detection, first and last seen, every threat tag and a written reason, how abusive its /24 neighbourhood is, the network owner and WHOIS abuse contact, and the location. Who reported an address, where our sensors are, and which providers have infected customers are never published at all.
Yes. It is published on GitHub under the MIT license, which means you can use it commercially, redistribute it, and build products on it. There is no account, no API key, no rate limit, and no clause that changes the terms later for what you have already downloaded. Attribution is appreciated and never required.
It is rebuilt every 30 minutes straight from the live engine. That is not a daily dump on a schedule; it tracks what is attacking the internet now. Each build stamps a metadata.json with the exact generation time and the row counts, so you can always tell how fresh the copy you hold is.
Two independent confirmations minimum, and a score of at least 50. Confirmations come from our own honeypot sensors and from community reports weighted by a trust tier reporters earn over time. One noisy feed shouting about an address is not enough to list it, which is the single biggest difference between this and a list assembled by concatenating other people's feeds.
It can, if you apply it bluntly. Addresses get recycled, and shared infrastructure such as carrier-grade NAT, VPN endpoints, and mobile carriers puts innocent users behind addresses that have genuinely hosted abuse. The type column exists precisely so you can treat a datacenter address differently from a mobile one. Score with it rather than hard-blocking on it, especially on anything a real customer touches.
A DNSBL such as Spamhaus answers a mail-delivery question: should this server accept mail from that address. This dataset answers a fraud and abuse question: has this address been confirmed attacking, and what was it doing. They overlap but are not substitutes, and if your mail is being rejected you need the specific DNSBL that rejected it, not this file.
Yes, and the list is better for it. Reports go through the report page and are weighted by reporter trust, which is earned through a track record rather than granted at signup. Corrections matter just as much as additions: if something on this list should not be, tell us and we will look at the evidence behind it.