IP checkScore any IP for VPN, proxy, Tor, datacenter and abuse.
Email checkCatch disposable addresses before they sign up.
Report an IPSend abuse with evidence to the shared database.
Free toolsIP, ASN, domain and website lookups in the browser.

Free tools

IP lookup
IP abuse check
ASN lookup
Reverse DNS lookup
Website safety check
Email checker
Disposable email domains

DocumentationQuickstart, endpoints and response fields.
PartnersFirewalls, drop-in endpoints, open data and programs.
Migrate in one lineKeep your AbuseIPDB, IPQualityScore or ipinfo code.
OpenAPI specA machine-readable description of the API.

Try it now

$ curl https://api.ffraud.com/public/ip/185.220.101.34

No key and no signup for single lookups.

Open the quickstart

Open data hubEvery dataset, the download commands and the MIT licence in one place.
Malicious IP database1.5M confirmed abusive IPs, scored and categorised.
Disposable email domains223.1K throwaway mail domains in one list.
Open data docsFile formats, fields and how to load them.

Rebuilt every 30 minutes

1.5M

flagged IPs in the current build, made 14 October 2026, 11:30 UTC.

FFraud on GitHub

Threat signatureHighServer Attack

login_brute_force

IPs conducting credential stuffing and login brute-force attacks against web applications, FTP servers, and other authentication endpoints.

Related signatures

ssh_brute_force web_attack credential_stealer

Malicious IP database How the score is built IP reputation check

Check an IP for this and every other signature.

FFraud returns the exact threat tags on any IP, free and without a key. The confirmed addresses, with their worst category, are also on GitHub as open data.

Check an IP See the API