AbuseIPDBabuseipdb.com
Crowd-sourced database of IPs reported for abuse (brute force, spam, scanning), with confidence scores, reporter comments, ISP and usage type.
ip / asndetails
tools / greynoise
GreyNoise
Tells you whether an IP is mass-scanning the internet or belongs to a benign service (search engines, researchers), so you can separate background noise from targeted activity.
freemiumacct optionalapiweb
used in playbooks
similar tools
VirusTotalvirustotal.com
Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.
file / docurldomainip / asndetails
AlienVault OTXotx.alienvault.com
LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.
ip / asndomainfile / docurldetails
Censyssearch.censys.io
Internet-wide scan data on hosts, services and certificates, with a powerful query language. Strong for certificate pivoting and finding related infrastructure.
ip / asndomaincompanydetails
Criminal IPcriminalip.io
Threat-focused internet asset search engine with IP and domain risk scoring, exposed services, vulnerabilities and screenshot reports.
ip / asndomaindetails
EmailRepemailrep.io
Reputation API for email addresses that reports age, breach exposure, social profiles, disposable/free provider status, and suspicious activity flags.
emaildetails