The malicious IP database. Yours.
Every address we have confirmed malicious, scored and categorised, in one file. MIT licensed, rebuilt every 30 minutes, no account and no API key. Download it and you owe us nothing.
1,268,512
confirmed-malicious IP addresses
537
high-abuse networks
MIT
license, commercial use included
What a row looks like
ip,ffraud_score,confirmations,category,type 80.82.77.33,95,41,c2,proxy 2.57.121.112,95,39,c2,proxy 195.178.110.137,95,38,c2,proxy 45.148.10.121,95,32,c2,datacenter
ip
The address. IPv4 and IPv6 both appear in the same file.
ffraud_score
Our own 0 to 100 score. Nothing below 50 is exported, so every row in this file is already past the threshold where we would act on it ourselves.
confirmations
How many times the abuse was independently observed. An address needs at least two before it can appear here at all, which is what keeps single-source noise out.
category
The worst behavior observed: c2, malware, botnet, brute_force, web_attack, scanner, phishing, spam, or abuse.
type
Infrastructure where known: proxy, vpn, tor, datacenter, or mobile. Blank when we could not classify it, rather than guessed.
Using it
Download it
One file, no key, no rate limit, no account. Point curl at it and you have the whole list.
curl -sO https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv
Filter to what you care about
Most people do not want everything. Pull only the categories that matter to you, or only the rows above a score you choose.
curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv \
| awk -F, '$2 >= 90 && $4 == "c2" { print $1 }' > c2.txtFeed it to a firewall
The addresses are plain text in the first column, which is the format every blocklist tool already expects.
curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv \ | tail -n +2 | cut -d, -f1 > /etc/blocklist.txt
What this list is not.
It is not a mail-delivery blacklist, and it is not a substitute for one. It is not a list of guilty people: an address is a lease, and the tenant changes. Plenty of addresses in this file are shared by thousands of innocent users behind carrier-grade NAT or a VPN endpoint, which is exactly why the type column exists.
Treat it as evidence to weigh, not a verdict to enforce. If you believe something in here is wrong, tell us: every entry carries the evidence that put it there, so a correction is a conversation about specifics rather than an argument. Report a correction.
Questions people ask
Is the malicious IP database really free to download?
Yes. It is published on GitHub under the MIT license, which means you can use it commercially, redistribute it, and build products on it. There is no account, no API key, no rate limit, and no clause that changes the terms later for what you have already downloaded. Attribution is appreciated and never required.
How often is the list updated?
It is rebuilt every 30 minutes straight from the live engine. That is not a daily dump on a schedule; it tracks what is attacking the internet now. Each build stamps a metadata.json with the exact generation time and the row counts, so you can always tell how fresh the copy you hold is.
How do you decide an IP belongs on the list?
Two independent confirmations minimum, and a score of at least 50. Confirmations come from our own honeypot sensors and from community reports weighted by a trust tier reporters earn over time. One noisy feed shouting about an address is not enough to list it, which is the single biggest difference between this and a list assembled by concatenating other people's feeds.
Will this block legitimate users?
It can, if you apply it bluntly. Addresses get recycled, and shared infrastructure such as carrier-grade NAT, VPN endpoints, and mobile carriers puts innocent users behind addresses that have genuinely hosted abuse. The type column exists precisely so you can treat a datacenter address differently from a mobile one. Score with it rather than hard-blocking on it, especially on anything a real customer touches.
What is the difference between this and a DNSBL?
A DNSBL such as Spamhaus answers a mail-delivery question: should this server accept mail from that address. This dataset answers a fraud and abuse question: has this address been confirmed attacking, and what was it doing. They overlap but are not substitutes, and if your mail is being rejected you need the specific DNSBL that rejected it, not this file.
Can I contribute to it?
Yes, and the list is better for it. Reports go through the report page and are weighted by reporter trust, which is earned through a track record rather than granted at signup. Corrections matter just as much as additions: if something on this list should not be, tell us and we will look at the evidence behind it.
Or check one address.
You do not have to take the whole file. Look up a single address and get the same verdict, with the evidence behind it, in the browser.