7 tools. 7 run with ot in a sandbox on Windows, macOS and Linux. Compare them side by side ↓
Before you treat an address in your logs as an attacker, check what others know about it. Abuse databases count reports and what they were for, GreyNoise knows whether it is an internet-wide scanner or a known benign service, and threat feeds list the malware, phishing and campaigns it has been tied to. Each source sees a different slice, so a clean answer from one is not a clean bill of health.
Windows, macOS and Linux, with Docker or Podman. Each tool runs in a read-only container that can reach only the sites it declares, and every result comes back in the same JSON shape.
Looks up an IP address in GreyNoise to see whether it is internet background noise or a known benign service
Checks an IP address in AbuseIPDB: abuse confidence score, reports and what for, ISP, usage type, Tor, country
Looks up an IP, domain, URL or file hash in AlienVault OTX: the threat reports that mention it, malware, tags
Looks up an IP, domain or URL in Pulsedive: risk level and factors, linked threats and feeds, ports, technologies
Looks up an IP, domain, URL or file hash in VirusTotal: engine verdicts, reputation, tags, owner, DNS records
Looks up a URL, domain, IP address or file hash in abuse.ch URLhaus: malware URLs, their status, tags and payloads
Looks up an IP address in ipdata: location, network owner, ASN, time zone and threat flags such as Tor or proxy
ot install osintverse-community/greynoise osintverse-community/abuseipdb osintverse-community/otx-indicators osintverse-community/pulsedive osintverse-community/virustotalInstalls the first 5 in one go; ot auto ip:… then runs every installed tool that takes an IP address and saves the results. No ot yet? Install it in one line.
| osintverse-community/ | domain, ip, location, organization | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | ip, organization, other | Required | Online, passive | No | Python | No reports yet | fewer than 10 |
| osintverse-community/ | location, organization, other | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | document, domain, ip, location… | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | domain, ip, location, organization… | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | document, domain, ip, url | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | dns record, document, domain, ip… | Required | Online, passive | No | Docker | No reports yet | fewer than 10 |
Facts from each tool's manifest and what people report about whether it works. "Reaches" says whether a run stays offline, reads public sources, sends requests about the target, or may notify them.
Every registry tool here runs on your machine in a sandbox, and ot auto ip:… runs all the installed ones on one value.
No. Reports describe the past, and cloud, VPN and mobile addresses change hands often. Look at the dates of the reports and at who holds the address today.
OTX and Pulsedive answer without one. AbuseIPDB, GreyNoise, VirusTotal, URLhaus and ipdata need a key from their own sites, each with a free allowance for small numbers of lookups; ot keys set stores it in your OS keychain.
No. ot runs each tool on your own machine in a read-only container that can only reach the sites the tool declares, and results stay in your results folder. The registry only counts installs.
Owner and ASNDomains on itOpen portsLocationCDN or originAll IP address tools