Read this in: English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Русский · Українська · Deutsch · Français · Español · Português (Brasil) · Italiano · Nederlands · Polski · Čeština · Slovenčina · Magyar · Română · Български · Srpski · Hrvatski · Ελληνικά · Türkçe · Azərbaycanca · Қазақша · Oʻzbekcha · فارسی · العربية · עברית · हिन्दी · বাংলা · اردو · தமிழ் · తెలుగు · मराठी · മലയാളം · ไทย · Tiếng Việt · Bahasa Indonesia · Bahasa Melayu · Filipino · မြန်မာ · Kiswahili · Svenska · Dansk · Norsk · Suomi · ქართული · Հայերեն · नेपाली
1,267,917 confirmed-malicious IP addresses and 537 high-abuse networks. Every address scored, categorised, and independently confirmed at least twice.
MIT licensed · no signup, no API key, no rate limits · updated 12.09.2026
This is the open IP-fraud database behind ffraud.com. Every address in it was observed attacking something, confirmed at least twice independently, scored from 0 to 100, and labelled with what it was caught doing and what kind of infrastructure it runs on. Attackers rotate infrastructure constantly, so a blocklist is only worth as much as its last refresh: this one is rebuilt every 30 minutes straight from the live engine. What you download is what is attacking the internet right now. No signup, no API key, no rate limits. Drop it into a firewall, a WAF, a signup form, or a fraud pipeline.
- 1,267,917 confirmed-malicious IP addresses, each seen abusing something two or more independent times
- 537 networks where the addresses we observed were overwhelmingly malicious and proxy-heavy
- 219,610 disposable email domains ship in this repo too, so one clone covers both halves of a signup check
- Every address carries a 0 to 100 score, a threat category, and the infrastructure type when we can see it
- Rebuilt and pushed every 30 minutes. The commit history is the changelog, and
metadata.jsoncarries the exact build time - MIT licensed, commercial use included, no attribution required
- Plain CSV and TXT. No archive to unpack, no schema to learn, no client library to install
| File | Rows | What it is |
|---|---|---|
threat-ips/confirmed-abusive.csv |
1,267,917 | Malicious addresses, each confirmed 2+ times, with our 0 to 100 score, the threat category (c2, malware, botnet, brute force, web attack, scanner, phishing, spam) and the infrastructure type (proxy, vpn, tor, datacenter, mobile) where known |
asn-reputation/high-abuse-networks.csv |
537 | Networks whose observed addresses were overwhelmingly malicious and proxy-heavy: the bulletproof-hosting signature |
disposable-email-domains.txt |
219,610 | Throwaway and disposable email domains, one per line |
ip-intelligence/examples.json |
sample | Full per-address intelligence: the score, a plain-English reason, and every category we attached |
metadata.json |
— | Live counts and the UTC build time, so a script can tell how fresh its copy is |
ip,ffraud_score,confirmations,category,type
80.82.77.33,95,40,c2,proxy
2.57.121.25,95,36,c2,proxy
193.46.255.86,95,33,c2,proxy| Field | What it tells you |
|---|---|
ip |
The address. IPv4 and IPv6 both appear |
ffraud_score |
Our own 0 to 100 fraud score. Everything published here is 50 or above |
confirmations |
How many independent times we observed the abuse. Nothing is listed below 2; the worst addresses carry 30 to 40 |
category |
What it was caught doing: c2, malware, botnet, brute_force, web_attack, scanner, phishing, spam, or abuse |
type |
The infrastructure behind it when visible: proxy, vpn, tor, datacenter, mobile. Blank when we cannot tell |
# Confirmed-malicious IPs, with category and type
curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv
# The worst networks
curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/asn-reputation/high-abuse-networks.csv
# Disposable email domains
curl -s https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/disposable-email-domains.txtEvery file is plain text with a header line and a few leading # comments. Pipe it straight into ipset, iptables, a WAF rule, or a Set in whatever language you already use.
You do not have to take the whole database to check one thing. The public API needs no key, has no daily cap, and answers the same questions this repo answers in bulk:
# Full intelligence for one IP: score, reason, categories
curl -s https://api.ffraud.com/public/ip/80.82.77.33
# Is this address disposable?
curl -s -X POST https://api.ffraud.com/public/email/check -H 'content-type: application/json' -d '{"email":"test@mailinator.com"}'
# Does this domain hand out throwaway mailboxes?
curl -s https://api.ffraud.com/public/domain/mailinator.comFor agents and assistants: ffraud.com/llms.txt is the machine index, ffraud.com/llms-full.txt is every doc page as plain Markdown, and ffraud.com/openapi.json is the OpenAPI spec. All three are public, need no key, and are meant to be fetched directly. Humans who prefer a page can use the free checkers at ffraud.com/tools.
Two things build it: our own honeypot sensor network, which is attacked continuously and records what attacks it, and reports from the people who run the servers being hit. Nothing is republished on someone else's say-so. Every address is scored and verified by the ffraud engine before it appears here.
The bar for listing is two or more independent confirmations, because one sighting is noise. That single rule is why this list is smaller than an unfiltered dump and worth more: it holds the addresses that were really attacking, not everything anyone ever flagged once.
The score, the category and the infrastructure type are our own conclusions, published in full so you can disagree with them. The exact scoring method is written up at ffraud.com/docs/methodology.
How often does it actually update?
Every 30 minutes, rebuilt from the live engine and pushed here. Not a nightly dump. The commit list on this repo is the honest record, and metadata.json holds the exact UTC build time of the copy you have.
Can I use this in a commercial product?
Yes. MIT, no attribution required, no separate commercial licence, no seat count, nobody to ask. If it saves you money we would love to hear about it, but you owe us nothing.
Why is my address on the list?
Because it was observed attacking something at least twice. Look it up at ffraud.com to see the score, the categories, and the plain-English reason. If it is wrong, or the machine has been cleaned up, tell us at ffraud.com/report and it is rechecked on the next build.
How is this different from the big paid providers?
It is free, it is MIT licensed, it has no key and no cap, and you can read exactly why every address is listed. You can also download the entire database, which most paid products will not let you do at any price.
Is there an API for single lookups?
Yes, and it needs no key. See the section above, or the docs at ffraud.com/docs.
This database grows with the people using it. If you run servers, fail2ban, a WAF, or your own honeypots, send us what hits you and we publish it: report at ffraud.com/report, point fail2ban at the drop-in endpoint, or open an issue here. We verify, deduplicate and score every submission, and confirmed ones ship in the next build, within half an hour, with credit if you want it.
high-abuse-networks.csv reports the share of each network's addresses that we observed behaving maliciously. It is a measurement of the traffic that reached our sensors, not a legal judgement about any operator, and legitimate hosts do appear on it when their customers misbehave. If you run a listed network and think the measurement is wrong, tell us and we recheck it on the next build.
- Disposable Email Database: our open list of disposable, temporary and throwaway email domains.
- ffraud.com: free IP and email fraud intelligence: a public API with no key, live checkers, and all of this data.
MIT. Use it anywhere, including in commercial products. Fork it, redistribute it, build a business on it. Attribution is appreciated and never required.
Built by [ffraud.com](https://ffraud.com). Free fraud intelligence, for everyone.