7 tools. 7 run with ot in a sandbox on Windows, macOS and Linux. Compare them side by side ↓
IP geolocation estimates where an address is used from registry data, routing and measurements. The country is usually right, the city often is, and anything finer is a guess. It locates the network, not the person: a VPN, a mobile carrier or a cloud provider places an address where its infrastructure is, which is why the useful lookups also say whether an address is a proxy, VPN or Tor exit.
Windows, macOS and Linux, with Docker or Podman. Each tool runs in a read-only container that can reach only the sites it declares, and every result comes back in the same JSON shape.
Looks up an IP address in IPinfo: host name, location, time zone, network owner and ASN, and whether it is anycast
Looks up an IP address in ipdata: location, network owner, ASN, time zone and threat flags such as Tor or proxy
Looks up an IP, prefix, AS number, hostname or organisation: ASN, BGP, RPKI, geolocation and reputation
Checks an IP address in AbuseIPDB: abuse confidence score, reports and what for, ISP, usage type, Tor, country
Shows what Censys has seen on an IP address: open ports, services and software, network, location, host names
Summarises what ONYPHE's internet scans know about an IP address: open ports, services, domains, owner, location
Shows what Shodan has seen on an IP: open ports, services, banners, vulnerabilities, location
ot install osintverse-community/ipinfo osintverse-community/ipdata osintverse-community/asn osintverse-community/abuseipdb osintverse-community/censys-hostInstalls the first 5 in one go; ot auto ip:… then runs every installed tool that takes an IP address and saves the results. No ot yet? Install it in one line.
| osintverse-community/ | domain, ip, location, organization | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | ip, location, organization, other | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | domain, ip, location, organization… | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | location, organization, other | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | domain, ip, location, organization | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | domain, ip, location, organization… | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | location, organization, other | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
Facts from each tool's manifest and what people report about whether it works. "Reaches" says whether a run stays offline, reads public sources, sends requests about the target, or may notify them.
Every registry tool here runs on your machine in a sandbox, and ot auto ip:… runs all the installed ones on one value.
No. Public geolocation stops at a city or region, and the records of which customer used an address are the ISP's, available to law enforcement through legal process.
They use different sources and update at different times, and mobile and cloud ranges move. A disagreement is itself a sign that the city is uncertain.
No. ot runs each tool on your own machine in a read-only container that can only reach the sites the tool declares, and results stay in your results folder. The registry only counts installs.
Most tools here work without one; the row says "Key required" when one is needed, and ot keys set stores it in your OS keychain so only that tool's container sees it.
Owner and ASNDomains on itReputationOpen portsCDN or originAll IP address tools