Find virtual hosts, server info and IP address reputation of a server or IP address. Shared hosting using virtual hosts can have your web property residing on the same host as other sites with poor reputation.

Gather IP address intelligence including hosting provider, ASN, Netblock and IP Geolocation.

IP Address Lookup & Analysis

Enter an IP address (or hostname) to begin the information gathering process.

Valid Target(s)
192.168.1.1
example.com

IP Reputation Check

If you have queries related to being listed in an IP reputation database, I would suggest initially confirming your IP address is in the most recent list available from Emerging Threats.

Note that these lists that are compiled and maintained by different organizations (dshield, spamhaus, etc). You should contact the relevant organization directly for more information or removal requests.

Being on a host with sites that are blacklisted or have a bad reputation can be damaging to your brand. Shared web hosting providers can have thousands of sites on one IP address, this report shows not only other websites but also checks if they are reputable and trustworthy.

List Name Description Link
DShield A database of IP addresses reported for suspicious activities maintained by the well known SANS Institute. dshield.org
AlienVault OTX An open threat exchange platform providing access to a global community-driven threat data. Alienvault
Cisco Talos Offers advanced threat intelligence and protection against Internet security risks. Cisco Talso
abuse.ch (Feodo) Tracks and monitors Feodo Trojan botnet activities and malware. abuse.ch
Spamhaus (Drop / eDrop) Maintains lists of IPs from which unsolicited bulk emails are received. Spamhaus
Firehol (level 3) A blocklist aggregating various feeds to protect against the most severe attacks. Firehol 3
Tor Network Provides information on Tor nodes, focusing on anonymity and privacy online. Tor Project

OSINT and the Recon phase of a vulnerability assessment

Open source intelligence gathering is the process of collecting information about a target through publicly available information sources. This IP address research tool can be used in the early stages when profiling a target server.

In a targeted attack against a web site or server; an attacker may choose to exploit a website on the server that is not the actual target. By exploiting another site on the server, the attacker may discover information to assist in the attack of the original target; or even gain administrator access on the server which gives them full control over all sites on the server.

"If you know the enemy and know yourself, you need not fear the result of a hundred battles.