Open data
Open data
Download the confirmed-attacker list and 220,000 disposable email domains from GitHub, MIT licensed. What the files hold, and what only the API answers.
The confirmed core of FFraud's data is published as plain files on GitHub under the MIT license: every address we have caught attacking something at least twice, the small networks that are almost entirely abusive, and the disposable email domains we know. Rebuilt from the live engine, free to fork, block with, or build a product on. No signup, no API key. Attribution appreciated, never required.
The open data is the confirmed core. The API is the full answer. The files are made for blocking known attackers in bulk. Deciding about one visitor needs more than that list, and the API has it. See what each one answers.
#The repositories
#Grab it
curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv#What a row looks like
ip,ffraud_score,confirmations,category,type
80.82.77.33,95,40,c2,proxy
2.57.121.25,95,36,c2,proxy
193.46.255.86,95,33,c2,proxy| Column | Meaning |
|---|---|
| ffraud_score | Our own 0-100 fraud score. Everything in the file is 50 or above. |
| confirmations | How many independent times we observed the abuse (honeypot hits + community reports). An IP only lists at 2 or more. |
| category | The worst thing it was caught doing: c2, malware, botnet, brute-force, web-attack, scanner, phishing, spam. |
| type | Infrastructure when known: proxy, vpn, tor, datacenter, mobile. |
#Open data or the API?
The files on GitHub hold the addresses we have confirmed as attackers, so anyone can block them for free. The API answers for every address, with everything we know about it, including what we keep out of the files on purpose.
| Open data files | API | |
|---|---|---|
| Which addresses | Confirmed attackers only: seen at least twice, score 50 or higher | Any address you ask about |
| Addresses confirmed only once | Left out until a second, independent confirmation | Answered, and already weighed into the score |
| VPN, proxy, Tor, datacenter, residential proxy | Only as the type of a listed attacker | For every address |
| When it was active | No dates | First seen, last seen, times seen, recent abuse |
| Why it is flagged | The worst category | Every threat tag and a written reason |
| Its neighbourhood | Not included | How much of its /24 network is abusive |
| Who runs it | Not included | ASN, ISP, organisation, hostname, WHOIS abuse contact |
| Where it is | Not included | Country, region, city, timezone |
| Open ports | Not included | Its open ports |
| The list of disposable domains | Also brand-new throwaway services, caught by their mail servers before any list has them |
Use the files to block known attackers in bulk. Use the API when you decide about a specific visitor: a first-time address, a VPN user, a signup from a datacenter. Both are free.
#What we never publish, and why
- Who reported an address, and the evidence they sent. People report to us in confidence. Their identity, their logs and their screenshots stay with us.
- Addresses confirmed only once. One report is a claim, not proof. It goes public after an independent second confirmation; until then only the API weighs it.
- Where our sensors are. A honeypot only works while attackers do not know it is one.
- Which internet providers have infected customers. A ranking of consumer networks by infected machines would be a target list for criminals. The networks file names only small networks where almost every address we saw was abusive; large providers are left out on purpose.
Every IP on the list was independently confirmed at least twice, by our honeypot sensors and community reports, before it shipped. We publish our conclusions and our method: read how we score.