API reference

IP intelligence

Full fraud intelligence for any IP: score, detection flags, network identity, geo, and threat tags.

GET/public/ip/{ip}no keyCheck one IP, no key

POST/v1/ip/checkkeyCheck one IP with a key (same response body)

Both endpoints return the same IpResponse. The public GET is the fastest way to try it; the authenticated POST is for programmatic use once you have a key.

#Request

curl https://api.ffraud.com/public/ip/80.82.77.33

#Response fields

Optional fields are omitted when we have no data. The core fields below are always present.

Field	Type	Meaning
fraud_score	int 0-100	Overall risk. 75+ is critical, 40-74 elevated.
risk	string	none / low / medium / high / critical
reason	string	Plain-English explanation of the score (omitted when clean).
proxy, vpn, tor, relay	bool	Anonymization detection.
hosting	bool	IP belongs to a datacenter / cloud range.
mobile	bool	Mobile carrier IP.
is_abuser	bool	Confirmed in threat intelligence.
recent_abuse	bool	Abuse confirmed within the last 30 days.
connection_type	string	Residential, Data Center, Mobile, Relay, etc.
is_residential_proxy	bool	Seen in a residential proxy pool (high-value e-commerce signal).
ISP, organization, ASN	string/int	Network identity.
vpn_provider, cloud_provider	string	Named operator when known (NordVPN, Google Cloud, ...).
threat_tags	string[]	What it was caught doing: c2_server, ssh_brute_force, port_scan, ...
subnet_abuse_ratio	float 0-1	Fraction of the /24 flagged abusive (neighborhood signal).
confidence	string	How sure we are: high / medium / low.
data_completeness	float 0-1	Fraction of our data layers that had data for this IP.
geo	object	country, region, city, lat/lon, timezone.

Richer nested objects appear when available: residential_proxy (persistence and recency), carrier (MCC/MNC), company, and whois. See the OpenAPI spec for the exhaustive schema.

#How to use the score

Block at fraud_score >= 75 (or when risk is critical).
Challenge (CAPTCHA, step-up) in the 40-74 band.
Allow below 25.
Prefer threat_tags and reason over a raw boolean when you want to explain a decision to a user or an audit log.

PreviousAuthentication NextEmail checks