Open data

Feed the database

Turn every ban you already make into a community report: point fail2ban at a drop-in endpoint, or POST from any script or honeypot. Every block helps.

You are already stopping attackers. fail2ban bans the SSH brute-forcer, your firewall drops the scanner, your honeypot logs the bot. Right now that signal dies on your box. Point it at FFraud and every block becomes a community report: verified, then shipped to everyone in the next open-data build, rebuilt every 30 minutes. Three ways in, from zero code to bulk.

Every attack you already block can protect the next person. Ban an IP and it just leaves your box. Report it and it ships to everyone in tonight's build, blocked before it reaches the next login page or checkout. Catch it once, help everyone.

#fail2ban, drop-in

If you run fail2ban you are one file away. Add an action that reports each ban to our AbuseIPDB-compatible endpoint, wire it into your jails, and you are done. It speaks the exact request fail2ban's AbuseIPDB action already sends, so there is nothing new to learn. Grab a free key so your bans get leaderboard credit.

POST/compat/abuseipdb/v2/reportkeyAbuseIPDB-compatible report. Drop-in for fail2ban's AbuseIPDB action.

# /etc/fail2ban/action.d/ffraud.conf
# Report every fail2ban ban to FFraud's open database.
# Same shape as fail2ban's built-in AbuseIPDB action, pointed at FFraud.

[Definition]
actionban = curl -sSf "https://api.ffraud.com/compat/abuseipdb/v2/report" \
              -H "Key: <ffraud_key>" \
              -H "Accept: application/json" \
              --data-urlencode "ip=<ip>" \
              --data-urlencode "comment=<matches>" \
              --data "categories=<categories>"

[Init]
# Free key from https://ffraud.com/register
ffraud_key =
# AbuseIPDB numeric categories. 18 = brute force, 22 = SSH. We map them for you.
categories = 18,22

fail2ban sends AbuseIPDB's numeric category codes (18 = brute force, 22 = SSH); we map them to our own categories automatically. Run fail2ban-client reload and your next ban lands in the database. The same trick works for any tool that already talks to AbuseIPDB (a WAF plugin, a router script): change the one URL, keep the request.

#Any script, WAF, or honeypot

Not on fail2ban? Anything that can make an HTTP request can report. One POST per IP, no key, no account. Perfect for a WAF hook, a honeypot, a cron that tails your logs, or a one-off script.

POST/public/ip/{ip}/reportno keyReport one IP from any script, WAF, or honeypot. No key.

curl https://api.ffraud.com/public/ip/45.148.10.35/report \
  -H "Content-Type: application/json" \
  -d '{
    "category": "web_attack",
    "comment": "WordPress xmlrpc.php probing, 300 hits in 5 min.",
    "reporter": "your-handle"
  }'

Only category is required. comment and evidence_url add context, and reporter (any handle) credits the report to you. Pick the category that fits:

Category	Report it when
brute_force	Repeated failed logins: SSH, RDP, FTP, webmail, admin panels.
spam	Comment, form, or email spam, including contact-form floods.
vpn	Abuse arriving through a VPN exit you want on record.
tor	Abuse arriving from a Tor exit node.
fraud	Payment fraud, carding, or fraudulent checkout attempts.
port_scan	Port or service scanning across your hosts.
web_attack	SQLi, XSS, path traversal, and other web exploit attempts.
phishing	Hosting or sending phishing pages or lures.
malware	Serving malware, or command-and-control / botnet traffic.
bot	Automated abuse from a bot that is not a known-good crawler.
scraping	Aggressive scraping that ignores robots.txt or your rate limits.
other	Abuse that does not fit the buckets above (add a comment).

#Bulk, for honeypot operators

Running honeypots or a fleet of sensors? Submit up to 1000 IPs in a single call with a free key. Dump a whole hour of catches at once instead of one call per IP.

POST/v1/report/bulkkeyReport up to 1000 IPs at once, trust-weighted. Free key.

curl https://api.ffraud.com/v1/report/bulk \
  -H "X-API-Key: ff_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "ips": [
      { "ip": "218.92.0.112", "category": "brute_force" },
      { "ip": "45.148.10.35", "category": "web_attack" },
      { "ip": "193.32.162.7", "category": "port_scan", "comment": "TCP SYN sweep across /24" }
    ]
  }'

Each entry takes ip and category (both required) plus an optional comment. Send up to 1000 per call.

Bulk reports are weighted by your reporter trust score, so established contributors move faster. New keys start quarantined and earn weight with accurate reports, which keeps the open data clean no matter who submits.

#What happens to your report

We verify it. Reports are checked, not trusted blindly, and weighted by your reporter trust score.
Two independent confirmations list the IP. Your report plus a honeypot hit or another contributor's report is enough. One signal never lists an IP on its own.
It ships in the next build. The IP lands in the public open-data dataset on GitHub within the half hour, free for everyone to block.
You get credit. Report with a handle, or a signed-in key, and every confirmed report builds your trust score, so your next reports carry more weight.

Want to see exactly how a report turns into a listing and a score? Read how we score. It is the same two-signal rule for everyone, honeypots and contributors alike.

Report an IPSend one address with its category and evidence, no account needed.How we scoreThe two-signal rule, and how a confirmed report becomes a 0-100 score.Open dataDownload the confirmed blocklist from GitHub. MIT, rebuilt every 30 minutes.Get a free keyUnlocks bulk reporting, batch lookups, and leaderboard credit.

PreviousHow we score NextRate limits & fair use