Documentation

Two endpoints.
Both free.

Public unauthenticated lookups for casual use. Authenticated endpoint for higher rate limits, batch lookups, and usage stats.

Public · no auth

GET /public/ip/{ip}

No API key required. Edge-cached for 5 minutes. 100 calls per day per IP. Use it from anywhere. Your backend, an edge worker, a shell script, even the browser.

curl https://api.ffraud.com/public/ip/8.8.8.8
Authenticated · 10,000/day

POST /v1/ip/check

Higher rate limits, full threat-tag detail, batch support. Sign up free and grab a key from your dashboard.

curl https://api.ffraud.com/v1/ip/check \
  -H "X-API-Key: ff_live_***" \
  -H "Content-Type: application/json" \
  -d '{"ip":"8.8.8.8"}'
Response

What you get back

Same JSON shape on both endpoints. Optional fields are omitted when we don't have data. There's no "null soup".

{
  "ip": "8.8.8.8",
  "fraud_score": 100,
  "risk": "critical",
  "vpn": true,
  "tor": false,
  "proxy": false,
  "hosting": true,
  "mobile": false,
  "is_abuser": true,
  "connection_type": "Data Center",
  "ASN": 15169,
  "organization": "Google LLC",
  "ISP": "Google LLC",
  "cloud_provider": "Google Cloud",
  "geo": {
    "country": "US",
    "country_name": "United States",
    "region": "California",
    "city": "Mountain View",
    "latitude": 37.386,
    "longitude": -122.0838,
    "timezone": "America/Los_Angeles"
  },
  "confidence": "high",
  "data_completeness": 0.83,
  "threat_tags": [...],
  "subnet_abuse_ratio": 0.02
}

Need 1M / day?

Enterprise tier is also free, just email us with a sentence about what you're building.

[email protected]