Skip to content
InternetData
Log inSign up
Threat intelligence

Enrich alerts with who is behind an address

A lookup answers whose network an address is on, how to reach its abuse desk, which services it runs and whether it hides behind a VPN, a proxy or Tor. Add it to a SIEM, a firewall's logs or an investigation.

Get a free API keySee pricing →

The network, the company, the abuse email, Tor, relays and the open-service flags are free. VPNs, proxies, hosting and the details behind each flag are on every paid plan, which also batches 1,000 lookups in one request. A free account's first 100 lookups each day answer every field.

What people use it for

  • Alert triage

    Attach the network, the company and the anonymity flags to each alert, so an analyst starts with the context.

  • Scanners and bad networks

    Find the hosting networks a scan or a brute-force run comes from, and block by AS rather than one address at a time.

  • Abuse reports

    The abuse contact for any address, from the registry's records, to report what came from it.

  • Infrastructure

    What an address runs (SSH, mail, web, DNS, BitTorrent), its reverse DNS, and how many domains it hosts.

What the answer says

Free fields answer with a key or without one, with no cap. Paid ones come with every paid plan, and a field your plan doesn't include is left out of the answer, never sent as false.

Every field, plan by plan, is on Pricing, and each one is described in the documentation.

asn, company
The network an address is on, and the organization using itFree
abuse.email
The registry's abuse contactFree
hostname
The address's reverse DNSFree
is_tor, is_relay
Tor exits and privacy relaysFree
is_ssh, is_smtp, is_web
Open services we found on the address, as is_dns_resolver and is_bittorrentFree
is_vpn, is_resproxy
VPN exits and proxies, with when we last saw eachPaid
is_hosting
A hosting or cloud provider's serverPaid
whois
The registry's record for the address's networkPaid
hosted_domains
How many domains resolve to the addressPaid

Enrich a list

One request takes up to 1,000 addresses on a paid plan; the SDKs split a longer list for you.

There are SDKs for 12 languages, a CLI and an MCP server. The API has the endpoints and limits.

import { InternetData } from "@internetdata/internetdata";
 
const client = new InternetData({
    apiKey: process.env.INTERNETDATA_API_KEY,
});
 
const answers = await client.lookupBatch(alertIps);
for (const [ip, r] of answers) {
    if (r instanceof Error) continue;
    console.log(ip, r.asn.name, r.abuse.email, r.isHosting);
}
app.mjsnpm install @internetdata/internetdata
00 · Try

Look one up now.

Unlimited answers with no key and no cap, and a free account's first 100 lookups each day answer every field.

Get a free API keyRead the docs
01 · Scale

Then pick a plan.

Every field, VPN and proxy detection included, on every paid plan.
Up to 1,000 lookups in one request.
Enterprise terms, with the databases themselves, by contract.
See pricingTalk to sales