⌖ I have an ip / asn

Crowd-sourced database of IPs reported for abuse (brute force, spam, scanning), with confidence scores, reporter comments, ISP and usage type.

LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.

Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.

Modern BGP and ASN explorer with live routing data, upstream/downstream graphs, prefix history and DNS data per network.

Threat-focused internet asset search engine with IP and domain risk scoring, exposed services, vulnerabilities and screenshot reports.

Searchable breach database that queries by email, username, name, IP, phone, address, or password hash and returns raw leaked records.

Multi-purpose DNS toolkit for bulk resolving, record querying, wildcard filtering and subdomain brute-forcing.

Free WHOIS lookup with hosting history and reverse IP hints. The paid Iris platform adds historical WHOIS, reverse WHOIS and infrastructure pivoting.

Cyberspace mapping search engine with rich fingerprinting (icon hash, cert, header, body). Strong coverage of Asian and Chinese hosts.

Tells you whether an IP is mass-scanning the internet or belongs to a benign service (search engines, researchers), so you can separate background noise from targeted activity.

Domain data API and lookup showing backlinks, redirects, co-hosted domains, and domains sharing the same analytics or tracking IDs.

HTTP probing toolkit that checks which hosts are live and grabs titles, status codes, tech stack, TLS details and favicon hashes in bulk.

BGP and ASN explorer covering prefixes announced by an ASN, peers, upstreams, IRR records and organization search across registries.

Search engine and archive of leaks, pastes, dark-web pages, and historical data. Supports email, domain, IP, CIDR, URL, and crypto address selectors.

IP address intelligence covering geolocation, ASN, company, hosting/VPN/proxy detection and abuse contacts. Also has reverse IP and ranges per ASN.

Breach data search engine with a free check of which breaches contain a selector, and paid access to the full records.

Search engine focused on exposed services and leaks, such as open databases, exposed .git and .env files, and misconfigured services, indexed by IP and domain.

Graph-based link-analysis platform. Run "transforms" against entities (people, domains, emails, companies) to pull data from dozens of integrated sources.

Internet scan search engine covering hosts, DNS, WHOIS and certificates, with an attack surface discovery graph and a generous free tier.

In-depth attack surface mapping and subdomain discovery. Combines passive sources with optional DNS brute-forcing, permutations and ASN or netblock expansion.

Community database of networks, data centers and internet exchanges. Shows where an ASN physically peers and who operates it.

Free threat intel platform that enriches IPs, domains and URLs with risk scores, linked threats, feeds and WHOIS/DNS context.

RDAP bootstrap redirector that sends a query for any domain, IP or ASN to the authoritative registry's RDAP server and returns structured JSON.

Metasploit-style modular reconnaissance framework in Python, with a marketplace of modules and a built-in workspace database and reporting.

RIPE NCC's analysis platform for IPs, prefixes, ASNs and countries, covering routing history, registration, reverse DNS and geolocation, with a full data API.

DNS and IP relationship lookup covering forward and reverse DNS, shared nameservers and mail servers, ASN data and graphs of related hosts.

Historical DNS records, subdomains, associated domains and reverse lookups by IP, nameserver or mail server, from a very large passive DNS dataset.

Paid breach search engine with a large indexed corpus, searchable by email, username, name, IP, password, or hash, with hash lookup.

OSINT automation framework with 200+ modules. Give it a domain, IP, email, name or username and it recursively correlates findings in a web UI.

Free US lookup by name, address, phone, email, IP, or VIN that returns linked identities and contact details.

abuse.ch database of malware IOCs (C2 IPs, domains, URLs, hashes) tagged by malware family, free to search and export.

abuse.ch database of URLs used for malware distribution, searchable by URL, host, hash or tag, with downloadable feeds.

Sandbox that loads a URL and records the requests, IPs, domains, screenshots and DOM. Its search across millions of past scans is a pivot goldmine.

Swiss-army collection of DNS tools including reverse IP, reverse WHOIS, IP history, DNS records, reverse MX/NS and port checks.

Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.

Chinese cyberspace search engine (Knownsec) that indexes devices and web services. Often has coverage of Asian infrastructure that Shodan misses.