Where the data comes from.

Most lookup tools quietly proxy a handful of third-party APIs and call it a day. We've tried to be more explicit. This page lists every dataset we draw on, why we chose it, and how often it refreshes — so you can judge the freshness and provenance of any answer the site gives you.

IP geolocation & ASN

MaxMind GeoLite2 is the primary source for country, region, city, postal code, coordinates, timezone, and Autonomous System Number lookups. We host the .mmdb files ourselves on Cloudflare R2 and read them at the edge with mmdb-lib. There is no per-request call to an external geolocation API on the hot path; the lookup is a binary tree walk in memory.

Three databases are loaded:

• GeoLite2-Country — fast country-level fallback (~7 MB).
• GeoLite2-City — region, city, postal code, lat/lon, timezone, accuracy radius (~70 MB).
• GeoLite2-ASN — autonomous system number and the registered organization name (~9 MB).

Refresh cadence is weekly. A separate Cloudflare Worker runs every Sunday at 04:00 UTC, downloads the current .tar.gz for each edition from MaxMind's permalink, and writes the new .mmdb back to the R2 bucket. MaxMind themselves publish updates on Tuesdays and Fridays; weekly refresh keeps us well within their licensing requirement to update at least every 30 days.

Per MaxMind's licensing terms:

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

DNS

Cloudflare DNS over HTTPS (cloudflare-dns.com) is queried server-side for the SPF / DMARC / DKIM / DNSSEC / CAA / MTA-STS / BIMI checks and for reverse-DNS (PTR) in the bulk IP tool. The DNS records, reverse DNS, and typosquatting tools query it directly from your browser — the resolver sees your IP alongside the queried name, exactly as if you used 1.1.1.1 yourself. Reverse DNS's "Look up my IP" button also asks cloudflare.com/cdn-cgi/trace directly from your browser for your own address. Cloudflare's 1.1.1.1 resolver does not log query IPs per their stated policy.

Separately, the propagation checker queries eight public DoH resolvers in parallel — Cloudflare (standard, security, and family variants), Google, NextDNS, dns.sb, AliDNS, and DNSPod — and shows each one's answer side by side. The DNS leak test's whoami probe uses Google DoH (dns.google) only: the equivalent Cloudflare probe returns NXDOMAIN when queried from inside Cloudflare's own network — which is where our functions run.

WHOIS & domain registration

IP and ASN lookups were retired here in August 2026. RDAP serves registry data for IP ranges and autonomous systems too, and we used to offer it. The Regional Internet Registries restrict what an ad-supported product may do with that data: ARIN prohibits use of its Whois Service “as part of a commercial service or product” and “for advertising, direct marketing, marketing research”, and its permitted use excludes “make publicly available” outright; RIPE and APNIC carry equivalent advertising clauses. LACNIC gates access behind a signed agreement, and AFRINIC publishes no reachable terms at all. Rather than serve that data on terms we cannot meet, we removed the IP side. Domain registration data carries no such restriction, and everything below concerns domains only.

The WHOIS lookup and the registration panel of the Domain Health report use RDAP — the Registration Data Access Protocol (RFC 9082–9083), the structured-JSON successor to legacy port-43 WHOIS (ICANN-mandated for gTLDs, with ccTLD adoption still uneven). We resolve the authoritative RDAP server for each domain through IANA's public bootstrap registries (data.iana.org/rdap), then query that registry or registrar over HTTPS and cache successful responses at the edge. TLDs that don't publish an RDAP endpoint aren't covered.

BGP & routing

RouteViews (routeviews.org), an academic BGP route-collector project, backs the announced IPv4/IPv6 prefixes and the neighbour list in the ASN Explorer, under CC BY 4.0. We parse its RIB dumps offline rather than querying anything at page load, so each ASN page reports what specific collectors observed at a stated timestamp — a snapshot, not a live reading, and one taken through those collectors' own peers, which under-counts networks they do not see.

The CAIDA AS Relationships Dataset supplies the provider / customer / peer labels in that same section, under CAIDA's Public AUA. These are inferences drawn from observed BGP paths and are published monthly, so they carry an older date than the prefix data beside them and establish no commercial arrangement between two networks. Where CAIDA has no inference for a pair, the page shows a dash rather than guessing.

IANA's AS Numbers registry supplies each ASN's allocation block and the RIR that administers that range.

Certificate Transparency

crt.sh, operated by Sectigo, is the public Certificate Transparency log aggregator we query for the CT search tool. crt.sh indexes across every publicly-trusted CT log (Google, Cloudflare, DigiCert, Let's Encrypt, and others) so a single query covers the lot. The API is rate-limited; we cache responses for ten minutes at the edge to reduce upstream load.

The SSL Inspector uses a second CT-backed source: SSLMate's Cert Spotter API (api.certspotter.com), which returns a domain's certificate issuances newest-first with the fingerprints and issuer details the grade card needs. Pages Functions can't open raw TLS connections, so the certificate record comes from CT logs; a parallel request to the domain itself confirms it serves HTTPS and reads its HSTS header.

HSTS preload

The HSTS Preload Checker asks hstspreload.org — the Chromium project's preload-list service — for a domain's current status, and in parallel fetches the domain itself to read its Strict-Transport-Security header. We don't bundle the preload list: it's large and changes frequently, so the live service is the honest answer; if it's unreachable the tool reports preload status as unknown rather than guessing. Results are edge-cached for ten minutes.

MAC addresses

The IEEE OUI registry is the authoritative source for MAC-to-manufacturer mappings. We bundle the oui-data npm package directly into the Worker — about 39,000 entries covering the IEEE MA-L (24-bit) registry. MA-M (28-bit) and MA-S (36-bit) blocks are not covered; the MAC tool says so when a prefix falls in those ranges. The lookup is a hash-table hit in memory; no upstream call per request. The list is updated on each Worker deploy from the latest IEEE publication.

Ports

Port assignments come from IANA's Service Name and Transport Protocol Port Number Registry, supplemented with nmap's nmap-services for frequency data. For commonly-used ports (HTTP/443, SSH/22, SMTP/25, etc.) we maintain hand-written editorial content layered on top of the IANA assignment.

IP reputation & risk classification

The IP reputation tool and the reputation panel of IOC Enrichment are built entirely from first-party and openly-licensed signals — there is no third-party abuse-score feed:

• Network / infrastructure classification — our own curated map of cloud, hosting, CDN, VPN, and transit ASNs, derived from the GeoLite2 ASN data above. This is Network Lookup's own analysis: it labels an address as datacenter vs residential and names the operator.
• Tor exit status — the Tor Project publishes a public list of current exit relays at check.torproject.org/torbulkexitlist. We cache it for 24 hours and check each looked-up IP against it.

We deliberately do not use feeds whose free tier forbids commercial use on an ad-supported site. That rules out AbuseIPDB's free tier (so we show no community “abuse score”) and Shodan's InternetDB (so we don't offer an open-ports / exposure lookup).

IP blacklist (DNSBLs)

The blacklist checker queries a curated set of IPv4 blocklists in parallel — SpamCop, PSBL, DroneBL, GBUdb Truncate, SpamEatingMonkey, Interserver, and JustSpam. We don't editorialise on whether a listing is "correct" — we surface what each list says, with its own delisting link where one is published. Results are edge-cached briefly (about five minutes per address) to stay within fair-use limits.

Several once-common lists were deliberately dropped in a June 2026 licensing review because their terms don't permit use on an ad-supported site, or because they refuse queries from public resolvers: Spamhaus (its free Data Query Service is licensed for non-commercial use only, and the public mirror blocks public resolvers), Barracuda (requires registering the querying resolver), URIBL and SURBL (block public DNS), Abusix and Invaluement (paid keys), SpamRATS / UCEPROTECT / Backscatterer (non-commercial or pay-to-delist), Mailspike (commercial subscription), and CBL (folded into Spamhaus). Domain-reputation checking was retired along with Spamhaus, since its DBL was the only commercial-OK list backing it. The SORBS and NiX Spam zones shut down in 2024–2025 and are not queried.

Email validation

Disposable-domain detection uses the disposable-email-domains npm package — about 121,000 exact-match domains plus 399 wildcard patterns covering Mailinator, Guerrilla Mail, Temp Mail, Yopmail, and the long tail of throwaway providers. List updates ship with each deploy. MX, SPF, and DMARC checks for the validator use Cloudflare DoH as above.

Vulnerabilities & exploitation status

The CVE Explorer draws on two sources, and both were chosen partly for what their licences permit.

• NVD (NIST National Vulnerability Database) — the CVE description, CVSS scores, weakness classifications and reference count, read live from the NVD API. NVD data is in the public domain as a work of the US government. NIST requires the following statement, which appears with every result: “This product uses data from the NVD API but is not endorsed or certified by the NVD.” Where several CVSS versions exist for one CVE we report the newest, because an older v2 score can materially understate a flaw.
• CISA Known Exploited Vulnerabilities catalog — whether a CVE has confirmed evidence of exploitation in the wild, plus the federal remediation deadline and the known-ransomware flag. Published under Creative Commons Zero 1.0, which explicitly permits commercial use. The licence also states that using the data does not authorise use of the CISA logo or DHS seal and implies no endorsement — so we credit CISA in text, display no government marks, and claim no endorsement. We hold a periodically refreshed copy rather than fetching it per request, so the exploitation answer survives an NVD outage; every result names the catalog version and its release date.

Bulk CVE Triage carries those two and adds a third, because ordering a scan by severity alone puts the wrong things at the top.

• EPSS (FIRST's Exploit Prediction Scoring System) — the probability that a vulnerability will be exploited in the near term, used to rank a pasted list once KEV membership has been applied. FIRST's EPSS FAQ states that scores are “published freely via CSV download and API with no registration required” and that “attribution is requested when EPSS data is used in publications or products”; its data page names this exact access pattern — one CVE or a small batch, integrated into a tool — as intended use. The requested credit, “EPSS data provided by FIRST.org.”, is returned with every response and displayed with the results. FIRST also asks that the API not be used to mirror the full score set, so we look up only the CVEs someone actually pastes in, cap a request at a hundred of them, and keep no copy.

That reversed an earlier decision, and the reason it was reversed is narrower than it looks. Until August 2026 this page said EPSS was deliberately not carried, because it publishes no explicit licence text and first.org's copyright page says permission to reproduce may be required. None of that was found to be wrong and none of it has changed — there is still no licence. What changed is the weight given to the FAQ and data-page wording quoted above, which plainly contemplates this use; the call was made in full view of the remaining ambiguity rather than because it went away. The single-CVE endpoint behind CVE Explorer still does not call EPSS, and that is a scope decision rather than a licensing one.

A “not listed” result from the KEV catalog means only that CISA has published no confirmed exploitation as of that catalog date; it is not evidence that a vulnerability is safe.

Breached passwords

The password breach check queries Have I Been Pwned's Pwned Passwords corpus directly from your browser — the request does not pass through our servers at all, and that page sends us no analytics about it whatsoever.

It uses k-anonymity: your browser computes the SHA-1 hash locally and sends only the first five hexadecimal characters, one of 1,048,576 buckets. HIBP returns every breached hash sharing that prefix and the match happens in the page, so the service never sees your password or the other 35 characters of its hash. The request asks for padding, so the response size cannot be used to infer which bucket was requested. The trade for calling them directly is that HIBP sees your IP address alongside that five-character prefix; routing it through us would hide your address from them and show the prefix to us instead, and we would rather not be in the path.

HIBP states that its Pwned Passwords API needs no key, has no rate limit, and carries “no licencing or attribution requirements … although it is welcomed”. We credit it because it is worth crediting. The Creative Commons Attribution 4.0 requirement on haveibeenpwned.com applies to its breach and paste APIs, which we do not use. A password absent from the corpus has not been shown to be safe — only that it has not appeared in a breach that has been collected and published; the tool says so rather than showing a pass.

Windows event IDs

The Windows Event ID decoder is built on Appendix L: Events to monitor, the Security-log event list Microsoft publishes as part of its Active Directory monitoring guidance. It supplies the event identifiers, the one-line summaries, the pre-Vista legacy identifiers each event replaced, and Microsoft's own “potential criticality” rating.

It is published under Creative Commons Attribution 4.0 International, which permits commercial use and modification with attribution — the reason it is usable here at all, on the same test applied to every other source on this page. Per the licence we name Microsoft as the creator, link the source and the licence, carry its disclaimer of warranties, and state that the material was modified: the table has been reshaped into a searchable index and the legacy-ID column expanded from comma-and-range notation into individual identifiers. No summary text was altered.

Two things are worth stating because they change how the tool should be read. First, the criticality rating is Microsoft's, in an Active Directory monitoring context — there, a failed logon is rated Low because a domain controller writes thousands a day, which is a statement about volume and not about whether the one in front of you matters. The tool labels the rating as theirs and flags the events where reading it as a severity would mislead. Second, the analyst notes on the page are our own work, not part of the licensed material, and are not covered by that attribution.

The corpus is Security-log focused, so System-log events are largely absent. Microsoft's deeper per-event documentation, which covered the individual fields within each event, is no longer published in a form we can carry, so the tool offers one line per event rather than a field reference and says so.

Sigma rule specification

The Sigma rule linter checks a pasted rule against the Sigma specification (v2.1.0) — the required fields, the permitted status and level values, the identifier and date formats, and the list of value modifiers. Its authors place the specification in the public domain: its licence file reads, in full, that the Sigma specification and the Sigma logo are public domain. There is no commercial restriction and no attribution obligation; we name it here because this page records every input, not because the licence asks us to.

Sigma rules are a different licence, and we ship none. The rules in the SigmaHQ repository are released under the Detection Rule License 1.1, which permits commercial use but attaches conditions when you reproduce a rule or display matches against one: keep the author, link the rule, and name the licence. Rather than carry those obligations, the linter ships no SigmaHQ rule at all — the worked example on the page is our own, and the rule you check is yours and never leaves your browser. Nothing on that page is derived from the SigmaHQ rule corpus.

Two limits worth stating. The linter reads the narrow slice of YAML that Sigma rules use in practice and says so, naming the construct and the line, when a rule uses syntax it cannot parse — it reports nothing further rather than risk a confident wrong verdict. And it checks structure only: it does not convert rules to any SIEM backend, judge whether a detection works, or validate field names against a product's log schema.

Protocol specifications

Where our tools claim to implement a protocol, the corresponding RFC is the source of truth. The implementations follow:

• SPF — RFC 7208 (sender policy framework), 10-lookup ceiling enforced
• DMARC — RFC 7489 (policy + alignment + reporting)
• DKIM — RFC 6376 (signature, canonicalisation, key publication)
• DNSSEC — RFC 4033 / 4034 / 4035 (chain of trust, key types, signatures); key-tag computation per RFC 4034 Appendix B
• CAA — RFC 8659 (certificate-issuance authorisation, hierarchy walk)
• Certificate Transparency — RFC 6962 (Merkle log structure, SCTs)
• HTTP security headers — MDN / W3C specifications for CSP (Level 3), HSTS (RFC 6797), Referrer-Policy, Permissions-Policy

Infrastructure

The site runs on Cloudflare Pages with Pages Functions for the dynamic routes. The cron Worker that refreshes the geolocation databases runs on Cloudflare Workers. The .mmdb files live in Cloudflare R2.

This means a single provider sees a lot of the request lifecycle. We make this trade-off deliberately — it gives us free TLS, a global edge, native bindings to R2, and good ergonomics for cron jobs — but it's worth knowing. If you'd rather not query Cloudflare, you can run any of these lookups locally with the same datasets.

What we don't use

We do not use any IP-to-identity providers, fingerprinting services, or paid geolocation APIs that promise “~99% accuracy” via undisclosed methods. Geolocation of an IP address is a registry-level signal, not a precise location lookup, and we'd rather show you the limits of that signal than dress it up.

Reporting data issues

If a lookup returns wrong or stale data, the cause is almost always upstream — MaxMind has the IP allocated to a different geography than the operator currently uses, or the registered ASN organization name lags real-world ownership changes. You can submit corrections directly to MaxMind via their GeoIP correction form; their corrections eventually flow through to us via the weekly refresh.

For anything else — tooling bugs, missing fields, reproducible inaccuracies — please contact us.