Product
Threat Intelligence
An actionable verdict on an address, with the reasoning attached, so your risk team can defend the decision.
What you get
| abuse_score / trust_score | 0–100, mirror images of each other |
| risk_band | minimal · low · moderate · high · critical |
| recommendation | allow · challenge · block, under your chosen policy |
| assurance | How much weight to put on the verdict, given recency and confidence |
| fraud_indicators.compromised_host | The machine is not under its owner’s control |
| fraud_indicators.recent_attacks | We have observed attacks from this address |
| signals[] | Every contributing factor with its numeric impact |
Live example · 45.83.104.137
Where it earns its keep
Credential stuffing
Addresses with a login-attempt history score higher before they reach you.
Abuse triage
Rank a queue of reports by how dangerous the source actually is.
Post-incident review
The signals array explains what you knew, and when.
We sell our assessment and its reasoning. The underlying attack ledgers and operator dossiers belong to our data supplier and are not redistributed.
Try it on your own traffic
1,000 queries a day on the free plan, no card required.