Loading
IP lookups, blacklist feeds, STIX/TAXII, alerts, and community reporting. Start free, scale as you grow. Read the docs or see our FAQ.
A lookup is any request to the /v1/key/check/{ip} endpoint. Web-based lookups on the website are free and don't count. Quota resets daily at midnight UTC. Exceeding your limit returns HTTP 429 with a Retry-After header.
All plans include scripts for Fail2Ban, CSF, nginx, and iptables/ipset. The blacklist API generates filtered IP lists for any firewall. Our STIX/TAXII feed integrates with Splunk, Sentinel, Elastic, and QRadar.
A global network of honeypot sensors emulating 16 protocols (SSH, HTTP, SMTP, MySQL, and more), plus community-submitted IP reports and bulk submissions. Both sources are weighted in the scoring algorithm and processed in real-time. See behind the scenes for the full pipeline.
Range alerts monitor a CIDR block and notify you when any IP in that range is detected by our honeypot sensors or flagged through community reports. Maximum CIDR size scales with your plan — /28 (16 IPs) on Free to /16 (65,536 IPs) on Business plans. Configure from your dashboard.
Confidence levels (0–100) combine two evidence sources: honeypot sensor data (attack behaviors, command patterns, protocol diversity) and community-submitted reports (unique reporters, report volume, bulk submissions). When both sources corroborate, a multiplier boosts the score. See the full methodology or check any IP to see it in action.
Yes. Upgrade, downgrade, or cancel anytime from your dashboard. Changes are immediate with prorated billing. No contracts, no lock-in.