Email and IP Risk Analyzer

Email and IP Risk Analyzer

What it does

Fraudox OSINT analyzes an email address and an IP address in one request, then returns a risk-focused decision you can use in signup, lead, or abuse workflows.

Send an email and an ip, and you get back the same values plus a verdict, risk_score, and timestamp. The response can also include module-level findings for DNS checks, typo-squat detection, disposable-email detection, social footprint lookup, and IP port scanning. When a module cannot complete, partial_result tells you the result is incomplete.

Use Fraudox OSINT when you need to screen registrations, flag suspicious accounts, or add friction to high-risk logins and contact forms. The DNS analysis shows whether the email domain resolves and whether it publishes MX, SPF, and DMARC records. The IP scan checks for open ports associated with VPN, proxy, or Tor services, which is useful for abuse prevention and risk scoring.

Because the response separates each module, you can decide how to handle ALLOW, REVIEW, and BLOCK outcomes in your own application logic without guessing how the score was built.

curl -X POST "http://localhost:8080/egemenkto/analyze-email-ip" \ -H "apy-token: $APY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "email": "[email protected]", "ip": "8.8.8.8" }'

What you'll get back

Returns a JSON object with top-level fields such as ip and email (the analyzed inputs), verdict (ALLOW, REVIEW, or BLOCK), timestamp, and risk_score, plus analysis objects like dns_analysis, port_scan_analysis, typo_squat_analysis, disposable_email_analysis, and social_footprint_analysis when available.

{
  "email": "[email protected]",
  "ip": "8.8.8.8",
  "risk_score": 5,
  "verdict": "ALLOW",
  "typo_squat_analysis": {
    "domain": "gmail.com",
    "is_known_provider": true,
    "is_suspicious_typosquat": false,
    "risk_contribution": 0
  },
  "dns_analysis": {
    "domain": "gmail.com",
    "domain_resolvable": true,
    "has_mx_record": true,
    "mx_records": [
      "gmail-smtp-in.l.google.com.",
      "alt1.gmail-smtp-in.l.google.com.",
      "alt2.gmail-smtp-in.l.google.com.",
      "alt3.gmail-smtp-in.l.google.com.",
      "alt4.gmail-smtp-in.l.google.com."
    ],
    "has_spf_record": true,
    "spf_record": "v=spf1 redirect=_spf.google.com",
    "has_dmarc_record": true,
    "dmarc_record": "v=DMARC1; p=none; sp=quarantine; rua=mailto:[email protected]",
    "from_cache": true,
    "risk_contribution": 0
  },
  "social_footprint_analysis": {
    "email_md5": "1aedb8d9dc4751e229a335e371db8058",
    "gravatar_exists": false,
    "gravatar_url": "https://www.gravatar.com/avatar/1aedb8d9dc4751e229a335e371db8058?d=404",
    "http_status_code": 404,
    "from_cache": true,
    "risk_contribution": 5
  },
  "port_scan_analysis": {
    "ip": "8.8.8.8",
    "valid_ip": true,
    "scanned_ports": [
      {
        "port": 8080,
        "is_open": false,
        "service_hint": "HTTP Proxy / Alt-HTTP"
      },
      {
        "port": 1194,
        "is_open": false,
        "service_hint": "OpenVPN"
      },
      {
        "port": 3128,
        "is_open": false,
        "service_hint": "Squid HTTP Proxy"
      },
      {
        "port": 1080,
        "is_open": false,
        "service_hint": "SOCKS Proxy"
      }
    ],
    "any_proxy_port_open": false,
    "scan_duration_ms": 501,
    "from_cache": true,
    "risk_contribution": 0
  },
  "disposable_email_analysis": {
    "domain": "gmail.com",
    "is_disposable": false,
    "database_size": 8069,
    "database_last_updated": "2026-07-20T08:33:21.872928281Z",
    "risk_contribution": 0
  },
  "partial_result": false,
  "processing_time_ms": 0,
  "timestamp": "2026-07-20T08:42:39.917789898Z"
}

About this endpoint

What it does

Analyzes the provided email address and IP address in one request and returns an aggregated fraud-risk assessment. The response includes the analyzed inputs, an overall verdict, a risk score, timing metadata, and module-level analysis objects for DNS, port scanning, typo-squatting, disposable-email detection, and social footprint checks.

Request Body

Parameter	Type	Mandatory	Description
email	String	Yes	Target email address for typo-squatting, DNS, social footprint, and disposable checks. Must be a valid email format.
ip	String	Yes	Target IP address for open port scanning (VPN, Proxy, Tor nodes).

Response

Returns a JSON object with top-level fields for the analyzed ip and email strings, a verdict string enum, timestamp string, risk_score integer, several nested analysis objects, and timing / completeness flags. The response includes the overall decision and the detailed module results used to derive it.

Parameter	Type	Mandatory	Description
ip	String	No	The IP address that was analyzed.
email	String	No	The email address that was analyzed.
verdict	ENUM	No	Actionable decision derived from the risk score. Allowed values: `ALLOW`, `REVIEW`, `BLOCK`.
timestamp	String	No	UTC timestamp at which the analysis was completed. Format: date-time.
risk_score	Integer	No	Aggregate risk score from 0 to 100.
dns_analysis	Object	No	Validates the email domain's DNS configuration, including MX, SPF, and DMARC records. Nested fields include `domain`, `from_cache`, `mx_records`, `spf_record`, `dmarc_record`, `has_mx_record`, `has_spf_record`, `has_dmarc_record`, `domain_resolvable`, and `risk_contribution`.
partial_result	Boolean	No	True if one or more OSINT modules failed to complete, indicating the result is incomplete.
port_scan_analysis	Object	No	Scans the target IP for open ports commonly associated with VPN, proxy, or Tor services. Nested fields include `ip`, `valid_ip`, `from_cache`, `scanned_ports`, `scan_duration_ms`, `risk_contribution`, and `any_proxy_port_open`. The `scanned_ports` array items contain `port`, `is_open`, and `service_hint`.
processing_time_ms	Integer	No	Total time taken to process the request, in milliseconds.
typo_squat_analysis	Object	No	Checks whether the email domain is a typo-squat of a well-known email provider. Nested fields include `domain`, `closest_match`, `is_known_provider`, `risk_contribution`, `similarity_percent`, `levenshtein_distance`, and `is_suspicious_typosquat`.
disposable_email_analysis	Object	No	Checks the email domain against a database of known disposable/temporary email providers. Nested fields include `domain`, `database_size`, `is_disposable`, `risk_contribution`, and `database_last_updated`.
social_footprint_analysis	Object	No	Checks whether the email address has an associated Gravatar profile. Nested fields include `email_md5`, `from_cache`, `gravatar_url`, `gravatar_exists`, `http_status_code`, and `risk_contribution`.

Body

Name

Type

Description

bodyREQUIRED

object

—

Email and IP Risk Analyzer

What it does

Quickstart

What you'll get back

About this endpoint

What it does

Request Body

Response

Body

Errors any endpoint can return