Frequently asked questions.
Pricing, the API, the open data and the community. If your question is not here, write to [email protected].
Yes. Lookups through the API and the whole open database cost nothing, with no daily or monthly caps and no credit card. FFraud is an anti-fraud project, not a sales funnel. Fraud data gets better the more people use it and report to it, so a paywall would make it worse.
Not for anything that is free today. If paid features come, they will be extras such as custom datasets, dedicated infrastructure or on-premise installs. What is free now stays free.
Yes, both the API and the open data. The data is MIT licensed, so you can use it in commercial products, redistribute it and even build a paid product on top. Attribution is appreciated, never required.
No. Single lookups work without signing up. A free key adds batch lookups and usage stats.
There are no daily or monthly caps. Short bursts are rate limited to keep the API fast for everyone: cross the limit and you get a 429 for a moment, not a paywall. If you need sustained heavy traffic, email us and we raise your limit for free.
A fraud score from 0 to 100 and a risk level, flags for VPN, proxy, Tor, relay and datacenter traffic, abuse history with report counts, threat tags, and network and location details such as ASN, ISP, country and city.
No. FFraud has compatibility endpoints that answer in the same response format. Point your existing client at FFraud, use a free FFraud key, and your code keeps working.
1.3M IP addresses, each seen attacking something and confirmed at least twice, independently. Every one has a score from 0 to 100, a threat category and the network type where it is known. Next to them: 219.7K disposable email domains and a list of 543 high-abuse networks.
The GitHub repositories are rebuilt from the live engine every 30 minutes. The commit history is the changelog, and metadata.json holds the exact build time of each copy.
From our own honeypot sensors and from community reports. An address is only published after it has been confirmed at least twice, independently.
MIT. You can copy it, change it, ship it inside your own product and sell that product.
Use the report page. Anyone can report an IP, attach evidence and vote on other reports. Confirmed reports go into the next build of the database.
Send a correction through the report page. A listing reflects abuse we observed from that address, not a judgment about the network that owns it.
Looking for the technical details?
Endpoints, response fields, rate limits and error codes are in the docs.