Approximate location
© OpenStreetMap contributors
Full IP Details: Network, RDAP, Geolocation & Security Report
This report covers everything the main IP lookup page does not: the full RDAP registry record and ASN organization, extended geolocation with source licensing, VPN/proxy/Tor and censorship signals, a fraud risk score, and MISP threat-intel evidence. Some of the data below is verbose-only, visible to signed-in accounts on a verbose-entitled tier — read on for what each signal means even when the values are empty for you.
Our main IP lookup page already resolves your address, its baseline network facts (ASN, announced prefix, registry), reverse DNS and a country-level geolocation the moment it loads. This page picks up exactly where that one stops: the full RDAP registry record and ASN organization, city/region/timezone geolocation with alternative-source licensing, VPN/proxy/Tor and censorship signals, a fraud risk score, and the full threat-intel evidence behind a match.
Nothing here duplicates the lookup page — if you want the baseline report for this address, use the link below.
Could not load IP information
- Currently analyzing
Network
Network type/provider, AS number, announced prefix and registry are already on the baseline lookup page; this section adds the full RDAP registry record (registration events, remarks, abuse contact) and the ASN organization/domain from the offline ASN dataset.
Security
Proxy/VPN/Tor, threat intel, censorship and a fraud risk-score for this IP.
Loading…
No security signals are available for this IP.
Active-Recon / Scanner Signal
The recon signal comes from Dataplane.org's per-service brute-force/recon feeds — lists of addresses recently observed attempting SSH, Telnet, RDP and similar login/probing activity across the internet. It is deliberately kept separate from the threat-intel verdict below: being seen scanning is an advisory reputation signal, not a confirmed-malicious verdict.
Sources names which specific signal(s) picked up the address (e.g. sshpwauth, telnetlogin); last seen is the most recent contributing observation, since Dataplane's recon lists churn quickly and rows age out of the underlying matcher after a configurable decay window rather than staying flagged forever.
This signal is only computed when the feature is enabled and a dataset is loaded server-side — on a deployment where it's off, this section doesn't render at all; a plain "not evaluated" notice appears in its place instead.
- Scanner activity
- Sources
- Last seen
This IP was not evaluated for active-recon/scanner activity — the feature is disabled, or no dataset is loaded, on this deployment.
Threat-Intel Evidence
Threat level aggregates the most severe MISP threat_level_id across every matching threat-intelligence entry for this address: High, Medium, Low or Undefined. It is independent of whether you're signed in.
Evidence reports below list every persisted threat-intel event backing the verdict — reporting organization, description, date, per-event severity and the specific indicators of compromise (IPs, CIDRs, domains, URLs, hashes) that matched. Evidence at this level of detail is reserved for signed-in accounts on a tier that includes verbose access — everyone else sees the aggregate verdict only.
This IP was not evaluated against our threat-intelligence feeds — the feature is disabled, or no dataset is loaded, on this deployment.
- Malicious
- Sources
- Threat level
This address has a threat-intel match, but the underlying evidence reports are verbose-tier data — sign in on an account whose tier includes verbose access to see the organizations, dates and indicators of compromise behind it.
This address's threat-intel match comes from a list-only feed, which carries no per-event detail (no organization, date or indicators of compromise) beyond the aggregate verdict above.
Evidence reports
| Source | Organization | Description | Date | Indicators (IOCs) |
|---|---|---|---|---|
Privacy
- Tor
- VPN
- Anonymous
- Proxy
- Residential proxy
- Relay
Censorship
- Censored
- Confirmed rate
- Sample size
Fraud risk
- Risk score
- Signals
Geo
The baseline lookup page shows only the winning source's country; clicking below loads the full picture for this address — city, region, timezone, every alternative source that also has a reading, and the licensing behind each one.
Every geolocation reading on this site is sourced from an offline database (DB-IP City Lite) or an RFC 8805 geofeed, and every one of those sources carries its own data license and reference URL. License/URL below name the license and homepage of the winning (highest-trust) source for this address.
When more than one source has a reading for this address, the losing sources are listed as alternatives below; license/URL name which of those alternative sources carry their own recorded provenance.
Source licensing/provenance is verbose-tier data (the same gate as the threat evidence above): sign in on an account whose tier includes verbose access to see it; everyone else sees only that a winning source exists.
- Country
Loading…
No geolocation source is available for this address.
- Source
- Date
- City
- Region
- Timezone
- Alternatives
-
:
This address has a resolved geolocation, but source licensing/provenance is verbose-tier data — sign in on an account whose tier includes verbose access to see it.
- License
Frequently asked questions
- Why can't I see the full threat-intel evidence or geo source licensing?
- The aggregate threat level is visible to everyone once the security group loads, but the full evidence records (reporting organization, date, indicators of compromise) and the geolocation source's license/URL are served only to signed-in accounts on a tier that includes verbose access — see the pricing page for which tier that is.
- Does loading this page's sections cost part of my daily quota?
- Loading the page itself is free — only the three buttons above (network details, security details, geo details) call our metered API groups, and only once per unique address per day; repeat visits for the same address don't cost anything further. Pricing Read the docs