IP fraud database
An open, MIT-licensed database of confirmed-malicious IP addresses and disposable email domains, rebuilt every 30 minutes from honeypot sensors and community reports, for use in firewalls, WAFs and signup checks.
This repository publishes the open dataset behind the ffraud.com fraud-detection service. It lists IP addresses that have each been observed attacking something and independently confirmed at least twice, with a 0-to-100 score, a threat category and, where known, the infrastructure type behind the address, alongside a separate list of disposable email domains.
The data is rebuilt and pushed every 30 minutes directly from the underlying detection engine, and is distributed as plain CSV and TXT files with no schema or client library required. A separate hosted API covers every address the service has seen, beyond the confirmed core kept in this repository.