Help & frequently asked questions

Who is it for?

• Website and server owners reviewing unusual activity.
• Email administrators checking PTR and blacklist signals.
• Support teams troubleshooting access and connection issues.
• Hosting companies, MSPs and IT professionals.
• Businesses reviewing suspicious orders, registrations or logins.

How to use it

1. Enter an IPv4 address, IPv6 address or supported domain.
2. Press Check.
3. Read the IP and Reputation sections first.
4. Open Network and Technical details when you need more information.

Address and identity details

• IPv4
  Uses four number groups, such as 192.0.2.25.
• IPv6
  Uses the newer, longer format, such as 2001:db8::25. Some older reputation services do not support IPv6.
• PTR record
  Reverse DNS that connects an IP address to a hostname. It is especially important for mail servers.
• Forward-confirmed reverse DNS
  The PTR hostname resolves back to the same IP address.
• IP type
  An estimate such as residential, mobile, business, datacentre, VPN/proxy, Tor or unknown.

Location terms

• Estimated location
  Where the address appears to be actively used.
• Registry country
  The country recorded for the registered network owner.

These countries can differ when infrastructure is hosted, leased, mobile or operated across borders.

Reputation signals

• Risk score
  Combines available blacklist, abuse and technical signals. A high score means review is advised, not that guilt is proven.
• Threat listing
  A blacklist connected the address to suspicious or abusive activity.
• Policy listing
  The address is not expected to perform a certain action directly, such as sending outbound email. This is not the same as a malicious detection.
• Unknown listing
  A blacklist returned a code that cannot be classified safely without a local mapping.

AbuseIPDB

• Guest and Free
  Receive a small useful summary when enabled by the administrator.
• Pro
  Can use a personal API key for fuller checks.
• Reporting
  Never available to Guest or Free users. It is enabled only for administrators and individually trusted Pro users.

Network and ownership terms

• ASN
  An Autonomous System Number identifies the network announcing an IP range.
• Provider or organisation
  May be an ISP, hosting company, mobile carrier, cloud platform or business.
• Network range
  The wider address block containing the checked IP. The registered organisation may differ from the current customer.
• RDAP
  The modern structured protocol for registration, range and contact information.
• WHOIS
  An older registration lookup system still used by some registries and tools.

Network ownership data should not be treated as the exact physical location of a person or server.

What are related domains?

Related domains are domain names that have been observed using the same IP address.

• Local observations
  The checker builds its own index from domain reports and monitoring checks performed on this installation.
• Optional external enrichment
  The administrator may connect a supported external provider to broaden the result set.
• Shared hosting warning
  Several unrelated websites can legitimately share one server or cloud address. A shared IP does not prove common ownership.

What do first seen and last seen mean?

• First seen
  The earliest date this installation or an enabled dataset observed the domain on the IP.
• Last seen
  The most recent observation date. It is not necessarily the date the domain moved or was registered.

Are the results complete?

No. Domains can use multiple IP addresses, content delivery networks and frequently changing DNS. Treat related-domain results as investigation leads, not a complete inventory.

Website and HTTPS security check

This optional on-demand check reviews the public website connected to a domain. It does not run during every normal domain report.

• HTTPS response
  Confirms whether the site answers over an encrypted HTTPS connection.
• HTTP to HTTPS redirect
  Checks whether visitors using an old http:// link are redirected to HTTPS.
• TLS certificate
  Shows the issuer, validity period, hostname match and remaining lifetime.
• TLS protocol support
  Tests the protocol versions supported by the server where the PHP/OpenSSL build allows it.
• Security headers
  Checks HSTS, Content Security Policy, frame protection, MIME sniffing protection, Referrer Policy and Permissions Policy.
• Cookies
  Reviews cookies returned by the checked page for Secure, HttpOnly and SameSite attributes.
• Mixed content
  Looks for obvious http:// resources inside the limited HTML sample.

Safety and scope

• Only public HTTP and HTTPS destinations on standard web ports are contacted.
• Private, local and reserved IP ranges are blocked.
• Redirects, response size and connection time are limited.
• Fresh checks have a per-plan rolling daily allowance. Cached results do not use that allowance.
• Only administrators can bypass the cache before it expires.
• Results are cached and can change after the check was made.

Saved, shared and downloadable reports

• Stored snapshot
  A report uses the saved result from the time of the check. Opening a share link does not perform another live lookup.
• Private share link
  Create an expiring link that can be revoked from the dashboard.
• Password protection
  Add an optional password before sharing sensitive investigation notes.
• PDF, CSV and JSON
  Download a human-readable PDF or structured data from the saved snapshot.
• Branding
  Pro users can add a company name and logo to printable and shared reports.

Important

IP, DNS, reputation, website and certificate data can change. Always consider the report creation date before relying on a saved snapshot.

Custom IP action buttons

A custom action sends the IP shown in a report to your own HTTPS endpoint after you confirm the request.

• Manual by design
  Nothing is sent until you press the button and confirm the destination.
• No automatic retry
  A potentially destructive action, such as blocking an IP, is never repeated automatically.
• Safer authentication
  Use a bearer token or dedicated request header. Avoid secrets in URLs because URLs can appear in logs and history.
• Protected destination
  HTTPS is required. Private, local and reserved destinations are blocked for normal users. Redirects are not followed.
• Controlled request
  Ports, DNS resolution, certificate verification, timeouts and response size are restricted.

Before using a block button

1. Test the receiving endpoint with a harmless address.
2. Make the receiving system validate its own authorisation token.
3. Log the unique delivery ID on the receiving side.
4. Require an allowlisted action name or route rather than accepting arbitrary commands.

Automatic monitoring webhooks

A webhook sends selected monitoring changes to your own HTTPS endpoint. It uses a fixed JSON payload and cannot run custom PHP, JavaScript or templates.

• Verified before arming
  Your endpoint must return the one-time challenge plus an HMAC proof created with the signing secret. A simple echo response is not enough.
• Signed delivery
  Every request includes a timestamp, unique delivery ID and HMAC-SHA256 signature.
• Replay and duplicate protection
  The delivery ID is also sent as an idempotency key. Reject old timestamps and ignore IDs already processed.
• Controlled retries
  Only temporary network failures, rate limits and server errors are retried. Permanent client errors are not repeatedly sent.
• Minimal payload
  Webhooks contain the monitored item, selected changes and safe summary fields. They never contain the account email address, password, API key or stored authentication secret.

Complete the endpoint test

1. Verify the signed test request using the normal delivery steps below.
2. Read the challenge value from the JSON body.
3. Create an HMAC-SHA256 digest of webhook.test.<challenge> with the signing secret.
4. Return JSON containing challenge and proof, or use the X-IPIC-Challenge and X-IPIC-Challenge-Proof headers.

Verify each delivery

1. Read the raw request body exactly as received.
2. Combine X-IPIC-Timestamp, a full stop and the raw body.
3. Create an HMAC-SHA256 digest with your signing secret.
4. Compare it with X-IPIC-Signature-256 using a timing-safe comparison.
5. Reject timestamps outside a short acceptance window.
6. Ignore a repeated X-IPIC-Delivery or Idempotency-Key.

Keep a webhook paused until its receiver has been tested and its own authorisation rules are active.

Investigation cases group IP addresses, domains, reports, monitoring changes, notes and actions into one controlled record. Each case has a numbered register entry, clear status and priority, an evidence timeline, a required resolution for resolved or closed cases, and a permanent audit trail showing who changed what, when and from where.

Open investigations

DNS record types

• A
  Points a hostname to an IPv4 address.
• AAAA
  Points a hostname to an IPv6 address.
• MX
  Identifies the mail servers that receive email for a domain.
• NS
  Identifies the authoritative name servers.
• PTR
  Provides reverse DNS from an IP address to a hostname.
• TXT
  Stores text policies, ownership verification and other machine-readable information.

Email and domain security

• SPF
  Identifies which mail servers are permitted to send email for the domain.
• SPF include and redirect chain
  Follows referenced SPF policies such as include: and redirect=, with loop and depth limits. This maps dependencies but is not a complete SPF pass/fail evaluation.
• DMARC
  Tells receiving mail systems how to handle messages that fail SPF or DKIM checks and can specify where reports should be sent.
• CAA
  Can restrict which certificate authorities may issue TLS certificates for the domain.
• DNSKEY
  Shows that a DNSSEC public key is published. The complete chain of trust still needs separate validation.
• CNAME
  Makes one hostname an alias of another hostname.
• SOA
  Contains the main administrative and timing information for the DNS zone.

Why TXT is off by default

TXT data can be large and is not required for every check. Access is controlled by plan and can be overridden per user.

Caching and speed

• Normal reports
  Recent results are cached to reduce repeated DNS, registry, location and reputation requests.
• Related domains
  Local observations are read from this installation. Optional external enrichment only runs on demand and has a separate cache.

Guest provides a quick trial. Free adds an account and higher limits. Light is a lower-cost paid option with more detail and saved history. Pro is the full investigation plan.

Paid licences

Free, Light and Pro use the same login. Purchase the chosen licence, enter it in the dashboard and the extra features unlock after validation. Licences are checked immediately and then automatically, normally daily.

Monitoring overview

• Watchlist
  Light and Pro users can save IP addresses and domains for scheduled checks.
• Meaningful changes
  The system records differences rather than emailing after every routine check.
• Retries
  Failed checks are retried using the administrator’s retry setting.

Possible alert types

• PTR, estimated location or registry location changes.
• ASN, provider or network-range changes.
• DNSBL, AbuseIPDB, risk-level or IP-type changes.
• Domain A, AAAA, MX and NS changes.
• SPF, DMARC, DNSKEY, CAA or primary-IP changes.

History and comparison

Detected changes are shown as a timeline. Users can compare two successful snapshots, while retention follows the administrator’s settings.

Account security

• Password recovery
  Use the Forgot password link. Reset links are time-limited and single use.
• Two-factor authentication
  Scan the QR code with an app such as 2FAS, verify the generated six-digit code and save the one-time recovery codes.
• Recovery codes
  Shown once only. Each can be used once and a newly generated set invalidates the old set.

Responsible use

An IP address does not prove who performed an action. Shared networks, VPNs, mobile carriers and reassignment can affect results. Use the report together with logs and your own evidence.

Why do other sites show a different country?

Services use different databases and definitions. One may show the registered owner country while another estimates the server location. The checker keeps both concepts separate.

Why is a residential IP listed?

It may be a policy listing rather than a malicious detection.

Why is there no PTR?

The operator may not have configured reverse DNS or may not allow the customer to set it.

Can I check private addresses?

Private addresses such as 192.168.x.x and 10.x.x.x are not publicly routed and cannot produce a meaningful public report.