FFraud: free fraud detection API for IPs, emails, devices

# FFraud > Free IP and email fraud intelligence. Public API with no key and no usage caps. The list of confirmed attackers is published as MIT open data on GitHub; the API answers for every address and holds far more than the files. - API base: https://api.ffraud.com - Full docs as Markdown: https://ffraud.com/llms-full.txt - OpenAPI spec: https://ffraud.com/openapi.json - Open data: https://github.com/FFraud-com ## Open data or the API? The open data is the confirmed core. The API is the full answer. The files on GitHub hold the addresses we have confirmed as attackers, so anyone can block them for free. The API answers for every address, with everything we know about it, including what we keep out of the files on purpose. | | Open data files | API | |---|---|---| | Which addresses | Confirmed attackers only: seen at least twice, score 50 or higher | Any address you ask about | | Addresses confirmed only once | Left out until a second, independent confirmation | Answered, and already weighed into the score | | VPN, proxy, Tor, datacenter, residential proxy | Only as the type of a listed attacker | For every address | | When it was active | No dates | First seen, last seen, times seen, recent abuse | | Why it is flagged | The worst category | Every threat tag and a written reason | | Its neighborhood | Not included | How much of its /24 network is abusive | | Who runs it | Not included | ASN, ISP, organization, hostname, WHOIS abuse contact | | Where it is | Not included | Country, region, city, timezone | | Open ports | Not included | Its open ports | | Email | The list of disposable domains | Also brand-new throwaway services, caught by their mail servers before any list has them | What FFraud never publishes, and why: - **Who reported an address, and the evidence they sent.** People report to us in confidence. Their identity, their logs and their screenshots stay with us. - **Addresses confirmed only once.** One report is a claim, not proof. It goes public

{ "openapi": "3.1.0", "info": { "title": "FFraud API", "version": "1.0.0", "summary": "Free, open IP and email fraud intelligence.", "description": "Check any IP or email for fraud, VPN, proxy, Tor, datacenter, and abuse history. Free for everyone, no usage caps. The public endpoints need no API key; a free key adds batch lookups, usage stats, and the community reporting API. The database behind this API is published daily as MIT-licensed open data at https://github.com/FFrau