Open data
How we score
How an IP gets listed, how the 0-100 fraud score is built, and why we publish our conclusions but verify every one independently.
FFraud is only useful if you can trust the number. This page explains exactly how an IP earns a place in the database and how its score is built, so you can audit our conclusions instead of taking them on faith.
#The two-signal rule
An IP is never listed on the strength of a single signal. It enters the public database only once we have at least two independent confirmations that it is abusive: a hit on our honeypot sensors, a verified community report, or both, from unrelated origins. Two unrelated confirmations is real corroboration, not an echo.
We publish our conclusions and our methodology, but never the internal detection mechanics: the value is the verified answer, and exposing exactly how an IP gets caught would let bad actors game or poison it. The methodology is open; the machinery stays ours to keep it honest.
#What the score is built from
The 0-100 fraud_score is computed per lookup from independent layers. No single layer can max the score alone; they combine, with protective ceilings so shared infrastructure is not over-penalized.
| Signal | What it contributes |
|---|---|
| Threat intelligence | Confirmed abusive behavior (C2, botnet, brute-force, scanning, phishing, spam) with a category tag. |
| Anonymization | VPN, proxy, Tor, and residential-proxy detection, with the operator named when known. |
| Infrastructure | Datacenter vs residential vs mobile, from IP classification and reverse DNS. |
| Subnet neighborhood | How much of the surrounding /24 is abusive, a strong signal even for a quiet IP in a bad block. |
| Recency | Whether abuse was confirmed recently or is historical. |
| Confidence | How many independent layers agree, and how long we have observed the IP. |
#Ceilings and floors
- Tor exit nodes carry a high floor, they are anonymization infrastructure by definition.
- Shared connections (mobile CGNAT, carrier NAT, relays) get a ceiling, because one bad user among thousands should not condemn the whole gateway.
- Crawlers from known-good search engines are capped low even on hosting IPs.
- Compound signals (e.g. datacenter + confirmed abuse + bad neighborhood) push the score up together.
#Why scores do not decay
A confirmed-abusive IP keeps its score even when it goes quiet. Attackers routinely idle infrastructure between campaigns; letting a score fade just because an IP paused would hand them a clean slate on schedule. We keep the high-water mark and let fresh evidence, not the calendar, change it.
#Dispute a listing
Think an IP or network is listed wrongly? Tell us or open an issue on the data repo. We recheck on the next build and drop anything that no longer holds. The database is a measurement of observed behavior, not a permanent judgment.