Free IP threat intel without signup limits, but MaxMind GeoIP2, AbuseIPDB, and similar already dominate cheaper or free.
Security engineers, developers building abuse prevention, incident responders needing quick IP enrichment
MaxMind GeoIP2 · AbuseIPDB · IP2Location
The problem I kept hitting: most IP lookup tools are either paywalled after a handful of queries, return stale data, or both. I wanted something I could hit from a script at 2am without worrying about rate limits or reaching for a credit card.
How it works:
- Enter an IP and get back geolocation (country, region, city, coordinates, timezone), ISP/org data, and a threat assessment. - The threat data is cross-referenced against 24+ blacklist sources, refreshed every 4 hours. - Nearly 300k blacklisted IPs indexed currently, growing with every cycle. - Free API — register for a key and integrate it into whatever you're building.
The stack is PHP on Apache/Ubuntu with MySQL and Redis. Nothing exotic.
It's free and will stay free. No freemium trap, no "enterprise tier coming soon". The more people using it and feeding back, the better the intelligence gets for everyone — it's a network effect thing.
I'd appreciate any feedback on the tool, the API, or the data quality. Happy to answer questions about the architecture or the threat sources.
The site turns any IP into a readable profile with geolocation, ASN/operator info, a trust score, blocklist counts and a short analysis blurb — very handy for fast triage. The Mapbox globe, 'me' and 'random' endpoints, and threat flags make it pleasant to explore, but it’s essentially a nicer UI on top of an IP geolocation/threat API rather than a novel data source.
IP lookup without meter anxiety, but MaxMind and Cloudflare already own this.
DSL for security scripting compiles to standalone binaries, but Nmap and Metasploit already exist.
STIX ontology and threat actor alias resolution beat Mem0 and Graphiti for CTI.
Polished training UI, but Maltego and commercial CTI platforms already cover this ground.
Clean IP lookup interface, but ipinfo.io and similar tools already dominate this space.
