Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/ffraud-com:ffraud-com-ip-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: FFraud IP API
version: 1.0.0
summary: Free, open IP and email fraud intelligence.
description: 'Check any IP or email for fraud, VPN, proxy, Tor, datacenter, and abuse history. Free for everyone, no usage caps. The public endpoints need no API key; a free key adds batch lookups, usage stats, and the community reporting API. The database behind this API is published daily as MIT-licensed open data at https://github.com/FFraud-com .
Drop-in compatibility endpoints let you migrate off AbuseIPDB, IPQualityScore, or ipinfo by changing one URL.'
contact:
name: FFraud
url: https://ffraud.com
email: team@ffraud.com
license:
name: MIT
url: https://github.com/FFraud-com/ip-fraud-database/blob/main/LICENSE
servers:
- url: https://api.ffraud.com
description: Production
security:
- {}
- ApiKeyHeader: []
tags:
- name: Ip
description: IP fraud intelligence lookups.
paths:
/public/ip/{ip}:
get:
tags:
- Ip
summary: Check an IP (public, no key)
description: Full fraud intelligence for a single IP. No API key required, no usage caps, edge-cached for 5 minutes. This returns the same body as POST /v1/ip/check.
operationId: publicIpCheck
security:
- {}
parameters:
- name: ip
in: path
required: true
schema:
type: string
example: 80.82.77.33
description: IPv4 or IPv6 address.
responses:
'200':
description: IP intelligence.
content:
application/json:
schema:
$ref: '#/components/schemas/IpResponse'
'400':
$ref: '#/components/responses/Error'
'429':
$ref: '#/components/responses/RateLimited'
/v1/ip/check:
post:
tags:
- Ip
summary: Check an IP (with key)
description: Full fraud intelligence for a single IP. Requires an API key.
operationId: ipCheck
security:
- ApiKeyHeader: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/IpCheckRequest'
responses:
'200':
description: IP intelligence.
content:
application/json:
schema:
$ref: '#/components/schemas/IpResponse'
'400':
$ref: '#/components/responses/Error'
'401':
$ref: '#/components/responses/Unauthorized'
'429':
$ref: '#/components/responses/RateLimited'
/v1/ip/batch:
post:
tags:
- Ip
summary: Check up to 100 IPs
operationId: ipBatch
security:
- ApiKeyHeader: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/BatchIpRequest'
responses:
'200':
description: Results in request order.
content:
application/json:
schema:
type: object
properties:
results:
type: array
items:
$ref: '#/components/schemas/IpResponse'
total:
type: integer
example: 3
'400':
$ref: '#/components/responses/Error'
'401':
$ref: '#/components/responses/Unauthorized'
components:
schemas:
Whois:
type: object
properties:
network:
type: string
netname:
type: string
country:
type: string
org_name:
type: string
status:
type: string
abuse_contact:
type: string
source:
type: string
Carrier:
type: object
properties:
name:
type: string
mcc:
type: string
mnc:
type: string
Company:
type: object
properties:
name:
type: string
domain:
type: string
type:
type: string
enum:
- isp
- hosting
- business
- education
- government
network:
type: string
description: CIDR / range string for the company's network block.
country:
type: string
ResidentialProxy:
type: object
properties:
detected:
type: boolean
confidence:
type: string
enum:
- very_high
- high
- medium
- low
recency:
type: string
enum:
- active
- recent
- aging
- stale
last_seen:
type: string
format: date-time
first_seen:
type: string
format: date-time
persistence_days:
type: integer
times_seen:
type: integer
multi_provider:
type: boolean
provider_count:
type: integer
BatchIpRequest:
type: object
required:
- ips
properties:
ips:
type: array
maxItems: 100
items:
type: string
example:
- 80.82.77.33
- 8.8.8.8
Error:
type: object
properties:
success:
type: boolean
example: false
error_code:
type: integer
example: 1002
error:
type: string
example: INVALID_API_KEY
message:
type: string
example: The API key provided is not valid.
IpCheckRequest:
type: object
required:
- ip
properties:
ip:
type: string
example: 80.82.77.33
IpResponse:
type: object
description: Flat structure for easy consumption. Optional fields are omitted when we have no data (no null soup).
required:
- success
- ip
- fraud_score
- risk
- proxy
- vpn
- tor
- relay
- hosting
- mobile
- is_abuser
- is_crawler
- recent_abuse
- connection_type
- is_residential_proxy
- shared_connection
- is_private
- confidence
- data_completeness
properties:
request_id:
type: string
example: req_1a186e8e3c657e922f10d8a
description: 'Keyed calls only: the id of this request; quote it to support. A batch shares one. The public answer is cached and carries none.'
success:
type: boolean
ip:
type: string
example: 80.82.77.33
fraud_score:
type: integer
minimum: 0
maximum: 100
example: 95
risk:
type: string
enum:
- none
- low
- medium
- high
- critical
reason:
type: string
description: Plain-English explanation of the score.
example: Active command & control (C2) server. Persistent high-severity threat, confirmed repeatedly by our honeypot sensors and community reports.
proxy:
type: boolean
vpn:
type: boolean
tor:
type: boolean
relay:
type: boolean
hosting:
type: boolean
mobile:
type: boolean
is_abuser:
type: boolean
is_crawler:
type: boolean
recent_abuse:
type: boolean
description: Abuse confirmed within the last 30 days.
connection_type:
type: string
example: Data Center
proxy_type:
type: string
description: 'Raw IP2Proxy PX12 class: PUB, VPN, WEB, RES, DCH, SES.'
is_residential_proxy:
type: boolean
shared_connection:
type: boolean
ISP:
type: string
organization:
type: string
ASN:
type: integer
example: 15169
leased_through:
type: object
description: The IP leasing marketplace or IPv4 broker whose geofeed places this address block; the lessee sets that location, so geo keeps the estimate. Information only, not part of the score.
properties:
name:
type: string
example: IPXO
type:
type: string
enum:
- leasing marketplace
- IPv4 broker
tunnel:
type: object
description: 'For a 6to4 or Teredo IPv6 address: the IPv4 address it carries. The verdict is that IPv4''s own.'
properties:
type:
type: string
enum:
- 6to4
- teredo
ipv4:
type: string
example: 87.149.28.42
asn_registered:
type: string
format: date
example: '2000-03-30'
description: When the network (ASN) got its current registration at its regional registry; a number passed to a new holder shows that date. Context only, not part of the score.
vpn_provider:
type: string
example: NordVPN
cloud_provider:
type: string
example: Google Cloud
relay_service:
type: string
example: Apple iCloud Private Relay
threat_type:
type: string
description: 'PX12 threat class: SPAM, SCANNER, BOTNET.'
threat_tags:
type: array
items:
type: string
example:
- c2_server
- ssh_brute_force
is_private:
type: boolean
subnet_abuse_ratio:
type: number
format: float
description: Fraction of the /24 flagged abusive (0.0-1.0).
subnet_total_ips:
type: integer
subnet_abuser_count:
type: integer
confidence:
type: string
enum:
- high
- medium
- low
data_completeness:
type: number
format: float
description: Fraction of data layers that returned data (0.0-1.0).
rdns_classification:
type: string
enum:
- residential
- mobile
- hosting
- vpn
- corporate
- education
- government
- no_ptr
- unknown
hostname:
type: string
description: Reverse-DNS (PTR) hostname, when published.
example: mail.example.com
isp_domain:
type: string
description: Domain of the ISP / network operator.
first_seen:
type: string
format: date-time
description: When this IP was first observed.
last_seen:
type: string
format: date-time
description: When this IP's intelligence was last confirmed.
times_seen:
type: integer
description: Times observed across our cycles.
total_reports:
type: integer
description: Aggregate community + honeypot reports for this IP.
distinct_reporters:
type: integer
description: Distinct independent reporters.
open_ports:
type: array
items:
type: integer
description: Open ports observed by our own scan sensors.
example:
- 22
- 80
- 443
vulnerabilities:
type: array
items:
type: string
description: Known CVE identifiers for services observed on this IP.
example:
- CVE-2021-44228
whois:
$ref: '#/components/schemas/Whois'
residential_proxy:
$ref: '#/components/schemas/ResidentialProxy'
carrier:
$ref: '#/components/schemas/Carrier'
company:
$ref: '#/components/schemas/Company'
geo:
$ref: '#/components/schemas/Geo'
Geo:
type: object
properties:
country:
type: string
example: US
country_name:
type: string
example: United States
region:
type: string
city:
type: string
latitude:
type: number
format: float
longitude:
type: number
format: float
timezone:
type: string
asn:
type: string
asn_org:
type: string
isp:
type: string
responses:
Unauthorized:
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
RateLimited:
description: Fair-use burst limit hit. Retry shortly. There are no daily or monthly caps; email team@ffraud.com to raise sustained throughput.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Error:
description: Bad request.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
securitySchemes:
ApiKeyHeader:
type: apiKey
in: header
name: X-API-Key
description: Your FFraud API key (ff_live_...). Create one free at https://ffraud.com/register .
AbuseIpdbKey:
type: apiKey
in: header
name: Key
description: Your FFraud API key, sent in AbuseIPDB's `Key` header for the compatibility endpoint.
IpinfoToken:
type: apiKey
in: query
name: token
description: Your FFraud API key, sent as ipinfo's `token` query param.
externalDocs:
description: Full docs
url: https://ffraud.com/docs