Turn every address in an alert into a lead.
An alert names an address and nothing else. One lookup adds whose network and company it is, the registry record and abuse contact behind it, what runs on it and the domains it hosts, so triage starts from who rather than what.
- RDP brute force203.0.113.24HostingBlock prefix
- Password spray198.51.100.7Residential ProxyEscalate
- Customer range192.0.2.140SSHPort 22Notify owner
- VPN log-in203.0.113.91VPNMullvadWatchlist
From one address to the infrastructure behind it.
Block by network
A brute-force run moves across a hosting provider's addresses. Block the prefix it comes from, which the same answer names.
Answered byasn.prefixis_hostingAbuse reports
Traffic you want stopped comes from someone else's network. Send the report to the contact the registry lists, with the network it covers.
Answered byabusewhoisExposed services
Ranges you look after run services nobody remembers. See which addresses answer as SSH, mail, web or an open resolver.
Answered byis_sshis_dns_resolverPhishing infrastructure
A phishing domain resolves to a handful of addresses. Read the domain's records, then what else each address hosts.
Answered bydnshosted_domains
Ownership, registry, services and flags in one answer.
The network, company, abuse email, hostname, services and Tor flags answer with no key and no daily or monthly cap. WHOIS, VPN, proxy and hosting flags, service detail and hosted domains come with every paid plan, and Pricing lists every field by plan.
asn, companyThe network announcing the address, with its prefix, and the organization using it.Unlimitedabuse.emailWhere to report abuse; a paid plan adds the contact's name, phone and network.Unlimitedwhois, rwhoisThe registry's record for the address's range, and the operator's own where it publishes one.Paid plansis_ssh, is_smtp, is_webWhich services answer on the address, is_dns_resolver and is_bittorrent too; a paid plan adds ports, banners and certificates.Unlimitedis_tor, is_relayTor nodes and privacy relays.Unlimitedis_vpn, is_resproxyVPN exits and residential proxies, each with its provider.Paid planshosted_domainsHow many registered domains resolve to the address, and the ten most popular.Paid plans
Wire it into the tools your team already runs.
- 01
In the playbook
Add a lookup step before triage, so the playbook reads the network and the flags first. It can then close an alert from a known business network and escalate one from a residential proxy without an analyst.
- 02
At the abuse desk
Look up the source of each incident and send the report to its abuse contact. The registry record in the same answer says which network the report covers.
- 03
In your asset inventory
Look up the ranges you or your customers hold and see which addresses run SSH, mail, web or an open resolver. A paid plan adds the ports and banners.
Start free, then add every field.
The same code runs with no key and with one: without a key it answers the free fields, and an upgrade adds the rest with no change to the code.
- 1
Call it with no key
UnlimitedRun the code on this page as it is, with no account.
- 2
Sign up for a key
No cardYour account's first 100 lookups each day answer every field, so you can try the WHOIS and the service detail on your own alerts.
- 3
Upgrade for every lookup
From $39 a monthEvery paid plan answers every field on every lookup, and takes up to 1,000 lookups in one request.
import { InternetData } from "@internetdata/internetdata";// A batch takes a paid plan's key: up to 1,000 a request,// and the client splits a longer list for you.const client = new InternetData({ apiKey: process.env.INTERNETDATA_API_KEY });const answers = await client.lookupBatch(alertIps);for (const [ip, r] of answers) {if (r instanceof Error) {continue;}if (r.isHosting && !r.isRelay) {blockPrefix(r.asn.prefix);}notifyAbuse(r.abuse.email, ip);}
Also available for Web, .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →
Common questions
Can it look up a whole AS?
Yes. GET /AS15169 answers the AS's registry row on every plan, and on a paid plan its prefixes with their RPKI status, its WHOIS, its rank, whether it is Tier 1, its upstreams, peers and downstreams, the domains it hosts, and how many addresses and prefixes it holds.
Does a lookup touch the address?
No. Every answer is read from the databases' latest builds, so a lookup sends nothing to the address or its network and never tips off whoever runs it.
How fresh is a service finding?
A paid answer's ssh, smtp, web, dns_resolver and bittorrent objects carry the first and last day each service was seen, so a stale finding reads as one.
Whose abuse contact is it?
The one the registry lists for the address's range. A paid plan adds its name, phone, postal address and the network it was derived from, and whether it answered ARIN's yearly validation.
Can our tools call it in bulk?
Yes, on a paid plan: POST /batch takes up to 1,000 addresses, AS numbers and domains a request, and every official client splits a longer list for you.
Other industries
All industries →- FintechOnboarding by country, sanctioned regions and account takeoverlocation.countrylocation.region_codeasn, company
- SaaSAccount enrichment, trial abuse and data residencycompanycompany.type, countrylocation.country, continent
- AdvertisingInvalid traffic, local targeting and business audiencesis_hostingis_dcproxy, is_resproxylocation.country, timezone
Unlimited lookups, no sign-up.
Paste it into a terminal. Any address answers with its country, network, company and hostname, with no key and no daily or monthly cap. ASes and domains answer too.
{"ip": "8.8.8.8","is_bogon": false,"is_tor": false,"is_relay": false,"is_anycast": true,"is_carrier": false,"is_satellite": false,"is_ssh": false,"is_smtp": false,"is_web": true,"is_dns_resolver": true,"is_bittorrent": false,"hostname": "dns.google","location": {"continent": "NA","continent_name": "North America","country": "US","country_name": "United States","timezone": "America/Los_Angeles","currency_code": "USD","currency_name": "Dollar","currency_symbol": "$","flag_emoji": "🇺🇸","flag_unicode": "U+1F1FA U+1F1F8"},"asn": {"asn": 15169,"name": "Google LLC","domain": "google.com","type": "hosting","prefix": "8.8.8.0/24"},"company": {"name": "Google LLC","domain": "google.com"},"tor": {},"relay": {},"abuse": {"email": "network-abuse@google.com"}}
All of the data on a paid plan.
A free API key answers every field for its first 100 lookups each day, with no card.