Reputation & risk
An infrastructure / risk classification from our own ASN analysis (datacenter/hosting/CDN/VPN) plus current Tor-exit status — a plain-language verdict, not a third-party “abuse score”.
// IOC Enrichment · IP Threat Intelligence
Everything about one IP, on one page.
Paste an IPv4 or IPv6 address. We orchestrate our own existing tools — infrastructure / risk classification (ASN analysis), Tor exit detection, curated DNSBLs, and reverse DNS — concurrently, with per-source attribution. Each section degrades gracefully if any one source is slow or unavailable.
Please enter a valid IPv4 or IPv6 address.
[ 01 ] — What you get
Five signals, one screen.
Network & geo
Country, region, city (GeoLite2), the announcing ASN + organisation, our datacenter/hosting/CDN/VPN classification, and current Tor-exit status.
Blacklist summary
A curated DNSBL summary for the headline verdict — a few commercial-OK lists (IPv4 addresses). The full run lives at /blacklist/.
Reverse DNS
PTR record via Cloudflare DoH — what the address calls itself.
Honest attribution
Every signal is labelled with its source. No opaque composite “risk score” — when something is unavailable, the section says so and the rest of the report still renders.
What an indicator of compromise is
An indicator of compromise, or IOC, is an artefact that suggests something unwanted happened on a network: an IP address, a domain name, a URL, a file hash. On its own an indicator is close to useless. A single address in a firewall log tells you an address connected. It does not tell you whether that address belongs to a home broadband customer in Ohio, a virtual machine rented by the hour, a Tor exit relay, or your own monitoring vendor.
Enrichment is the step that closes that gap. You start with a bare indicator and attach context until it can be triaged: whose network it sits on, what kind of network that is, whether the traffic is anonymised, whether the address has a history of mail abuse, and what the address calls itself in DNS. This page does that for IPv4 and IPv6 addresses, in one request.
The four questions this report answers
- Whose network is this, and where? The announcing autonomous system and its organisation, plus country, region and city from MaxMind GeoLite2. Ownership is usually more useful than geography: “AS16509, Amazon” explains far more about a log line than “Virginia” does.
- What kind of network is it? Our own classification of the ASN as datacenter, hosting, cloud, CDN or known VPN infrastructure, against residential. A login attempt from a rented server carries different weight to one from a consumer connection.
- Is the traffic anonymised? Whether the address is a current Tor exit relay, checked against the list the Tor Project publishes itself.
- Does it have a mail-abuse history? A summary across a curated set of DNS blocklists: SpamCop, DroneBL and PSBL. These are IPv4-only zones, so IPv6 addresses return no blocklist result.
Each answer names its source. There is no blended score, because a single number would hide which signal actually fired.
A worked example
An address appears repeatedly in your SSH logs. The report comes back: datacenter classification on a low-cost hosting ASN, not a Tor exit, listed on one blocklist, reverse DNS of vps-1042.example-host.net.
Read together, that is a rented virtual server with generic provider-assigned reverse DNS and some history of abuse reports. It is a reasonable candidate for rate-limiting or blocking, and the hosting provider's abuse contact is the place to report it. What the report has not told you is that the address is malicious. It has told you the address is cheap to rent, disposable, and has been noticed before, which is what actually informs the decision.
Change one detail. Same logs, but the classification is residential, no blocklist entries, and reverse DNS resolves to a consumer ISP's pattern. Now blocking the address is a weaker move: residential addresses are frequently reassigned, so today's attacker is next week's ordinary customer.
Common questions
Is this a threat feed?
No. It reports infrastructure facts and mail-blocklist status. It does not claim to know whether an address is malicious, and no result here should be read as that claim.
Why is there no abuse score?
The widely used community abuse feeds forbid commercial use on their free tiers. Rather than quietly break those terms, we left the signal out and say so. The data sources page carries the full reasoning.
Why no open ports or CVE list?
The same licensing problem. The obvious free source for passive port and vulnerability data is non-commercial-only, so that section is disabled rather than served under terms we cannot meet.
Does looking up an address contact it?
No. Everything here is passive: DNS lookups, a public exit-node list, and our own datasets. Nothing is sent to the address being examined, so an investigation cannot tip off whoever is on the other end.
Limitations and honest caveats
- Residential proxy networks look residential. Services that route traffic through real home connections are indistinguishable from ordinary consumer addresses without a commercial proxy database, which we do not use.
- Classification lags reality. ASN ownership changes, and networks start and stop offering VPN service. A recently repurposed network can be labelled wrongly until the underlying data catches up.
- Blocklist coverage is deliberately narrow. Three lists give a fast headline, not a verdict. Run the full blacklist check before acting on a listing, and note these lists are about mail abuse specifically.
- Geolocation is approximate. GeoLite2 is reliable at country level and much less so at city level, particularly for addresses on cloud and CDN networks.
- An address is not a person. Carrier-grade NAT, shared hosting, and corporate egress all put many users behind one address.
For the deeper view of any single signal, use IP lookup for full geolocation, IP reputation for the classification detail, reverse DNS for the PTR record, or the ASN lookup for the network itself.
Corrections welcome — see our editorial policy.