IP Intelligence¶

IP Intelligence helps you investigate the current public exposure of an IP address, a domain, an autonomous system, a small IPv4 network, a service, or an organization. Results are grouped by unique IP address and are based on the latest stored protocol observations available to Alpha Strike.

This page describes the currently implemented search capabilities. It is published at docs.ip.alphastrike.io and is written in standard Markdown so it can also be included in the Alpha Strike Platform's own documentation site.

Tech Preview¶

IP Intelligence is currently a Tech Preview. Every page carries a Tech Preview banner across the top of the screen — including the sign-in, registration, and terms pages — and it stays in place while you scroll, so it is always visible that this is a preview rather than a generally available product. The preview is free of charge, its functions and limits can change at any time, and the terms of service you accept at registration apply to every account.

Signing in¶

IP Intelligence requires an account. Searching, and every page except the ones below, is available only while you are signed in.

If you have an account. Select Sign in. You are taken to the Alpha Strike sign-in page, and back to IP Intelligence once you have entered your credentials.

If you do not have one yet. Select Create an account. The form asks for two things, both required: your business email address, and the organization you work for. You are not asked for a password here: we send you a link that confirms your address and lets you choose one. That mail arrives from Alpha Strike IP Intelligence, and the link expires after a while, so open it before you use it. The link is the only way to finish, so use an address you can read. Temporary and disposable email domains are not accepted.

The organization is the name of the business you are registering on behalf of — the Tech Preview is offered to businesses only. Type it as you would write it; we record what you enter and do not check it against anything, and nothing about your access depends on it.

Before Create account does anything you have to tick the box agreeing to the Terms of Service. That one tick also covers the consent in § 8 (4) to receive marketing emails from Alpha Strike, which is why the line says so. You can withdraw that consent at any time — use the unsubscribe link in any such email, or write to datenschutz@alphastrike.io — and withdrawing it does not affect your access.

Selecting the link in that line opens the full terms in a dialog on top of the form, so you can read them without leaving the page or losing what you have typed; Close returns you to the form. The same text is also a page of its own at /terms if you want to open it in a separate tab, and ticking the box is a separate action from reading — opening the terms never ticks it for you. We record which version you accepted and when, on your account, and the consent alongside it. The Tech Preview is offered to businesses only, and the terms cover what the service may and may not be used for — § 6 is worth reading before you start.

If you already registered with that address, the page says so and points you at signing in instead of creating a second account.

Nothing to set up. Your account is prepared the first time you sign in, so you can search straight away. Naming your organization on the registration form is the whole of it — there is nothing to create or configure afterwards, and no setup step to complete first.

If a search reports that your account cannot search, that is not something you can fix from the product: it means your access has been set to inactive. Contact us and we will sort it out.

The account menu. Select your email address in the top bar to open it. Besides Sign out, it links to this Quickstart page, to Release notes, and to Report a problem — the first two are readable without an account, so you can point a colleague at either before they sign up.

Reporting a problem. Select Report a problem from the account menu, then describe what happened and select Send. This is signed-in only, description only — there is no file attachment in this version — and the description is limited to 4,000 characters. We do not reply to individual reports.

Signing out. Select Sign out from the account menu. This ends your IP Intelligence session and signs you out of the Alpha Strike sign-in service as well, so signing back in asks for your credentials again. You are taken to the sign-in service briefly while that happens.

Until 12 August 2026 only the IP Intelligence half was ended, and signing back in returned you to the product without asking for anything. If you used a shared or public computer before that date, the advice then was to close the browser afterwards; that is no longer necessary.

If your session ends on its own. Sessions expire after a period of inactivity. When that happens you are taken to a page that says so, rather than being left on a screen that looks signed in but no longer works. Signing in again is enough to carry on; a search you were looking at can simply be run again.

How much you can search¶

During the Tech Preview each account can run 20 searches per day, counted per person.

You are charged when a search answers. If it runs and comes back, it counts — including when the answer is that nothing is exposed there, because that is an answer too. If it does not answer, the allowance is given back: a search declined because the scan data is busy, one that times out, one refused as too broad, and one whose result page has expired all cost you nothing.

Loading more results counts as a search. Each further page of 25 hosts is a fresh lookup across the whole scan catalogue, the same work as the first page, so it is charged the same way. Opening the Globe view, loading a host's details, and reading the suggested filters remain free — none of them starts a new lookup.

Where to see what is left. Open the account menu in the top bar. Above the links you will find a ring with the searches you have left today, the total, and the time the allowance comes back. It updates after every search you run, and it counts searches made with an API key as well, because those draw on the same allowance.

When it resets. The counter rolls over at midnight UTC, which is 01:00 or 02:00 in Central Europe depending on daylight saving. The account menu shows that moment in your own time, so you do not have to convert it. The allowance resets in one step, not gradually: if you reach it, searching pauses until then.

The allowance is a ceiling rather than a promised quantity: during the Tech Preview we may change it, and a search can also be refused because the service as a whole is at its limit. Section 5 of the terms of service says so explicitly.

Using the API¶

Everything in this guide also works from a script, once you have a key. The query syntax is exactly the one described in Supported searches and Common workflows — a script sends the same query text the search box does. This section covers the basics; the API Reference has the complete request and response schemas, every endpoint, every stable error code, and pagination and rate-limit mechanics for building a client against it.

Creating a key¶

Open API access from the account menu. Select Create key, optionally give it a name such as CI runner so you can tell it apart from your other keys later, and copy the key it shows you. A key looks like this:

ipk_live_7pQ2m9XvB4hK1sR6tY0wZ3nC8dF5gJaL

The key is shown once. It is stored hashed, so nobody — including us — can show it to you again later. If you lose it, revoke it on the API access page and create a new one; there is no way to recover the old one.

Making a request¶

Send the key as a bearer credential on the Authorization header. There is no separate token to exchange it for first — the key itself is what you send, on every request:

curl -H "Authorization: Bearer ipk_live_7pQ2m9XvB4hK1sR6tY0wZ3nC8dF5gJaL" \
     -H "Content-Type: application/json" \
     -d '{"query":"203.0.113.10"}' \
     https://api.ip.alphastrike.io/v1/search

This runs the same search as typing 203.0.113.10 into the search box, and answers with the same evidence the result page shows — one entry per host, its current services, and how many searches you have left today:

{
  "request_id": "4f2b6b7a2b6a4c6a9e6e2b7a2b6a4c6a",
  "results": [
    {
      "ip": "203.0.113.10",
      "location": { "country_code": "DE", "country_name": "Germany", "city": "Frankfurt am Main" },
      "network": { "asn": 64496, "organization": "Alpha Strike Labs GmbH" },
      "services": {
        "items": [
          { "port": 443, "protocol": "https", "observed_at": "2026-08-10T03:14:00Z",
            "product": "F5 NGINX", "evidence": [ { "kind": "http", "status_code": 200 } ] }
        ],
        "has_more": false
      }
    }
  ],
  "allowance": { "limit": 20, "used": 7, "remaining": 13, "resets_at": "2026-08-12T00:00:00Z" }
}

A domain, ASN, CIDR, or filter query works the same way, in the same request body:

{"query": "domain:example.com"}
{"query": "asn:64496"}
{"query": "203.0.113.0/24"}
{"query": "port:443 organization:\"Alpha Strike\""}

The API Reference has a fuller example — combining an organization and a service filter, with match_reasons, pagination, and the domain-search shape — plus a worked request and response for every other endpoint below.

Endpoints to start with¶

Endpoint	What it returns
`POST /v1/search`	The matching hosts for a query, exactly like the search box.
`POST /v1/search/count`	The approximate unique-host estimate for an ASN or filter query, independent of the result page.
`POST /v1/search/facets`	Suggested Filters for a service, organization, or country search.
`POST /v1/search/exposure`	The bounded geographic aggregation behind the Globe view.
`POST /v1/hosts/detail`	The complete current service inventory for one exact IP — the same data behind Host investigation and Selected host.
`GET /v1/search/capabilities`	The current list of supported protocol values, the same list Add filter loads automatically.
`GET /v1/allowance`	How many searches you have left today, and when the allowance resets. Asking costs nothing.

Allowance, revocation, and security¶

A key draws on the same daily allowance as the browser: the 20 searches per day, counted per person, described in How much you can search — not a separate allowance for scripts. Whatever a key spends leaves fewer searches for the browser that day, and the other way round.

Only a search spends the allowance. Of everything in Endpoints to start with, only POST /v1/search counts against it. Checking your allowance, loading Suggested Filters, the unique-host estimate, the Globe aggregation, and a host's full service inventory are all free to call as often as you need, whatever they answer.

Two rules matter when you script /v1/search. A request is charged when it answers, so anything that comes back as an error — a busy scan store, a timeout, a too-broad refusal, an expired cursor, an over-quota or over-concurrency refusal — costs you nothing and can be retried without spending your day. A result set with no hosts in it does count, because that is an answer. The complete list of what does and does not cost you is in the API Reference.

And every page is a search. Following next_cursor to fetch the next 25 hosts is charged exactly like the first request, so a loop that pages through a large result set spends one search per page. Read allowance.remaining from each response and stop when it reaches zero, rather than discovering the limit through a 429.

Checking what is left from a script. GET /v1/allowance answers with the limit, how many you have used, how many remain, and the reset instant:

curl -H "Authorization: Bearer ipk_live_7pQ2m9XvB4hK1sR6tY0wZ3nC8dF5gJaL" \
     https://api.ip.alphastrike.io/v1/allowance

{"request_id":"...","allowance":{"limit":20,"used":6,"remaining":14,"resets_at":"2026-08-12T00:00:00Z"}}

resets_at is an instant in UTC, so convert it before showing it to anyone. Asking does not spend a search. Every successful POST /v1/search carries the same allowance object, already counting the search you just ran, so a script that searches in a loop does not need to call this endpoint between searches.

If the response has no allowance field at all, no daily limit applies to your account. That is not the same as none remaining.

Revoking a key on the API access page stops it working immediately; any script still using it fails on its next request.

Treat a key like your own sign-in credentials: keep it out of source control and shared notebooks, and revoke it the moment you suspect anyone else has seen it.

Quickstart¶

Open IP Intelligence at https://ip.alphastrike.io and sign in.
Enter an IP address, domain, ASN, IPv4 CIDR, or supported filter in the search bar.
Select Search.

You do not have to type a prefix for a target the search bar can recognise on its own. Entering example.com runs the domain search, AS64496 runs the ASN search, 203.0.113.0/24 runs the CIDR search, and pasting a URL such as https://example.com/status searches the domain in it. The prefixed forms below always work and are what the search bar shows you afterwards, so you can see exactly which search ran.

Two entries are deliberately not guessed, because either reading would be a different search:

A plain number. 443 could be asn:443 or port:443, so say which.
A two-letter word. de could be country:DE or the start of a domain, so enter the country filter or the full domain.
For an exact IP, review Host investigation directly below the search. For searches returning multiple IPs, select a host row to open Selected host.
Review the five-row Services preview on each result. When your search named a service, the services that answered it are listed first and marked; select the host to load its complete service inventory.

Try one of these searches:

203.0.113.10
domain:example.com
asn:64496
203.0.113.0/24
port:443
protocol:http
protocol:ssh port:22 country:DE
organization:"Alpha Strike"
port:443 organization:"Alpha Strike"
product:"Apache Tomcat"
certificate.name:example.com
country:DE
cpe:"cpe:2.3:a:openbsd:openssh:9.6:*:*:*:*:*:*:*"
cve:CVE-2024-6387
cvss:9.0-10.0 exploit:yes

You can also select Add filter to build a supported query interactively. When adding a filter from an existing result page, applying it immediately runs the updated search. On an Exact IP, CIDR, Domain, or ASN result page, Add filter starts a new filter search because those standalone targets cannot be combined with service filters.

After a filter search succeeds, the Investigation Stream loads Suggested Filters independently from the host results. Expand a category to review values, then select Apply to add the value and immediately rerun the search. A value already in the query is labelled Applied; selecting it removes that field and immediately reruns the updated query. No additional selection of Search is required.

Common workflows¶

Investigate a known host¶

Search the exact IPv4 or IPv6 address and review its geolocation — place, coordinates and accuracy radius — plus network, WHOIS context, reverse DNS, and the complete current service list in Host investigation directly below the search. There is no intermediate result row or separate Selected host panel for an exact-IP query.

Review a small IPv4 network¶

Search a CIDR from /24 through /32. The result list contains every identified IP inside the network. Select individual hosts to inspect their current services.

Find the hosts behind a domain¶

Search domain:example.com. IP Intelligence combines two sources:

the domain's current A and AAAA DNS resolution; and
current stored domain-scan observations whose domain, dns, or rdns value is the requested domain or one of its subdomains.

The resulting IP addresses are merged and deduplicated. Each result previews up to five of the host's current services, and none of them is marked: the domain identifies the host, not one of its services. Select a result to load the host's complete current service list independently of the domain match.

Above the results, the DNS status tells you whether public A/AAAA addresses were resolved, not found, timed out, failed, or were excluded because no public routable address was returned. Stored domain scans are still searched for every status. Each host row explains the match with one or more labels:

Result label	Meaning
DNS resolution	The host IP was one of the domain's current public A/AAAA answers.
Stored domain	The stored `domain` value matched the requested name or a subdomain.
Stored DNS name	A stored `dns` value matched the requested name or a subdomain.
Stored reverse DNS	The stored `rdns` value matched the requested name or a subdomain.

Review an autonomous system¶

Search an exact autonomous-system number such as asn:64496. IP Intelligence finds current IPv4 and IPv6 hosts attributed to that number by any reviewed ASN source. Results are unique IP addresses and include labels explaining which source matched:

Result label	Meaning
CAIDA ASN	The CAIDA best-ASN attribution matched.
BGP ASN	The best BGP attribution matched.
Network ASN	The network/location enrichment ASN matched.

ASN attribution can differ between sources and does not by itself prove asset ownership. Select a host to load its complete current service list independently of the ASN match.

Find a type of exposure¶

Search a port or an exact protocol, optionally combined with an organization or country. Each multi-IP result previews up to five of the host's current services, listing the ones that satisfied the filter first.

You can also search detected products, leaf-certificate DNS names, exact CPE identities, exact CVE identifiers, service-level maximum-CVSS ranges, and scan-time exploit availability. These are service-level filters, so the Services preview identifies the observations that satisfied every clause.

Review exposure by country¶

Search an uppercase ISO-2 GeoIP code such as country:DE. Country describes the host's GeoIP location. It is deliberately separate from WHOIS contact or registration addresses.

Visualize geographic exposure¶

After a supported search returns results, switch from Results to Globe. The Globe loads a separate bounded aggregation; it is not derived from the currently loaded result page. Use the mouse wheel, trackpad, or the + and − controls to zoom. The map starts with Global detail and automatically requests Regional and Local detail as you zoom in. Zooming back out reuses a previously loaded level when available.

Click a location bubble or choose a location from the list to pause rotation, centre that area, and review its approximate unique-IP and matching-service counts. Use Zoom into area or double-click the globe to move to the next detail level. Click empty globe space or press Escape to clear the selection and resume rotation. The focused globe also supports arrow keys for rotation and +/− for zoom; every cluster remains available as a keyboard-accessible button in the location list.

Each geographic cluster represents matching IPs in one Elasticsearch geotile bucket and shows approximate unique-IP and matching-service counts. Clusters are named after the country most of their hosts are located in, by host GeoIP rather than by WHOIS registration address. A cluster covering more than one country adds how many, for example Germany +2 more, because a coarse detail level groups a wide area that can cross borders. A cluster whose hosts carry no GeoIP country is labelled with its coordinates instead. Point density and bubble size are scaled for rendering and must not be read as one visible dot per IP or as an exact IP location. The unique-IP and service totals always describe the full matching result set. At Regional or Local detail, the location list can be limited to the 500 largest buckets; the interface labels that state explicitly while retaining the full totals.

If a finer aggregation times out or fails, the last successful map remains visible and the Globe shows an error notice. Try the zoom action again or narrow the search query.

When you submit another supported search while Globe is selected, the interface stays in Globe and loads the new query at Global detail. A Domain search returns to Results because Domain Globe aggregation is not yet available.

The Globe is exposure-only. It does not add threat scores, severity layers, exploit layers, or correlation corridors. Domain Globe aggregation is not yet available because live-DNS and stored-domain result locations must first be deduplicated in one complete-result query.

Discover an organization's visible footprint¶

Search organization:"name". Review the evidence label on each result before interpreting the relationship. AS, WHOIS, provider, certificate-subject, and certificate-issuer evidence describe different relationships; none should be treated as asset ownership proof without additional validation.

Supported searches¶

Search type	Syntax	Behaviour
Exact IP	`203.0.113.10` or `2001:db8::10`	Returns the requested host when a current protocol observation exists.
Domain	`domain:example.com`	Resolves A/AAAA records and searches current domain scans for the domain and its subdomains, then returns the combined unique IPs.
ASN	`asn:64496`	Returns unique IPv4 and IPv6 hosts whose exact CAIDA, BGP, or network/location ASN attribution matches.
IPv4 CIDR	`203.0.113.0/24` or `cidr:203.0.113.0/24`	Returns unique IPs inside an IPv4 network from `/24` through `/32`. Host bits are normalized automatically, and both forms identify the same search.
Port	`port:443`	Returns hosts with a current protocol observation on exactly that port.
Protocol	`protocol:ssh`	Returns hosts identified as the exact registered protocol. HTTP does not implicitly include HTTPS.
Organization	`organization:"Alpha Strike"`	Searches all reviewed organization evidence sources described below.
Product	`product:"Apache Tomcat"`	Case-insensitive token search over human-readable registered CPE titles. Word order is not required; every token must occur in the same title field.
Certificate name	`certificate.name:example.com`	Exact canonical DNS-name match against registered leaf-certificate SAN and common-name fields.
Country	`country:DE`	Exact uppercase ISO-2 match against host GeoIP country.
Exact CPE	`cpe:"cpe:2.3:a:openbsd:openssh:9.6:::::::*"`	Exact match against the stored CPE 2.3 identity.
CVE	`cve:CVE-2024-6387`	Exact match against a CVE identifier stored on the service observation.
Maximum CVSS	`cvss:9.0-10.0`	Inclusive range over the service-level maximum CVSS summary.
Exploit availability	`exploit:yes` or `exploit:no`	Exact service-level scan-time enrichment flag.

Filters can be combined with spaces or uppercase AND. Both forms represent the same query:

port:443 organization:"Alpha Strike"
port:443 AND organization:"Alpha Strike"

Domain and ASN are separate search targets and cannot currently be combined with filters. At most three filter clauses can be combined, and each field can occur only once. OR, grouping, user-supplied wildcards, regular expressions, raw Lucene, and Elasticsearch Query DSL are not supported.

Supported protocol values¶

Protocol values are exact tokens with case-insensitive input. They are canonicalized to lowercase, then checked against a versioned public registry and a separate reviewed index catalog. The Add filter dialog loads the current list automatically and lets you narrow it by typing. Similar names remain separate: http does not include https, imap does not include imaps, and smtp does not include smtps.

The current public values are:

amqp apc bacnet bgp coap cobaltc2 db2disco dnstcp elastic eniptcp fox ftp
ganglia http https iec104 imap imaps ipmi ipp isakmp iscsi jmxrmi kerberos
kibana knx l2tp ldaptcp ldapudp mdns memcached mikrotikwb modbus mongodb
mssqlmon mssqltcp mumble mysql natpmp netbiosns nntp ntp opcua openvpntcp
openvpnudp oracledb pcanq pcom phoenix pop3 pop3s portmap portmaptcp postgres
pptp rdp redis ripv1 ripv2 rsync rtsp s7 samba saprouter sentinel sip smtp
smtps snmpv1 snmpv2 snmpv3 softethervpn ssh subversion sworionrest telnet
tftp ubiquitidd upnp vmwareauthd vnc wdbrpc webmin winrm winrms wsd zookeeper

Protocol filters always select the latest completed service scans. When a port is combined with a protocol, every clause must match the same service observation:

protocol:ssh port:22 country:DE

This example finds German hosts with one current service observation that is both SSH and on port 22. It does not combine an SSH observation from one port with port 22 from another service. Vulnerability and special-scan names such as heartbleed are deliberately not protocol filters.

Product, CPE, certificate, and vulnerability filters¶

Human product search uses the registered CPE title stored by scan-time enrichment. It does not search service banners, HTTP content, vendor fields, or free-form descriptions. An exact CPE filter searches the stored CPE identity instead. Because the source cpes_detailed array is not nested, IP Intelligence does not claim a product/version relationship across different entries; use an exact CPE when that identity matters.

Certificate-name search checks only registered leaf-certificate SAN and subject common-name paths for supported TLS-capable protocol families. It excludes observations that contain an error field or an error status because the TLS step may be incomplete. Certificate chains, redirect-chain certificates, issuer searches, fingerprints, wildcard query input, and partial-name matching are not part of this filter.

CVE, maximum-CVSS, and exploit filters use the vulnerability enrichment already stored on each current service observation. They do not repeat banner-to-CPE matching at search time. max_cvss is the maximum score across the service summary and is not the score of every listed CVE. A missing vulnerability block means enrichment is unavailable; it must not be interpreted as vulnerability-free. exploit:no means the stored enrichment flag is false, not that exploitation is impossible.

Organization search¶

Enter only the organization name. You do not need to know whether it appears in AS, WHOIS, network-provider, or certificate data.

Organization search is case-insensitive phrase matching. The order of the words remains significant, but the stored value may contain additional words. For example:

organization:"Alpha Strike"

also matches a stored value such as alpha Strike labs gmbh.

What is searched¶

The default organization search checks exactly these six evidence sources on the latest completed service scans:

Result label	Scan data searched	How to interpret it
AS organization	CAIDA and BGP autonomous-system organization names	The organization associated with the AS announcing the IP prefix.
WHOIS description	The embedded service WHOIS description (`whois.descr`)	Registration description stored with the service observation.
WHOIS netname	The embedded service WHOIS network name (`whois.netname`)	Registered network name; it may be an identifier rather than a legal organization name.
Network provider	Provider enrichment from `location.organization`, `location.as_org`, and `location.isp`	The network or connectivity provider associated with the observation.
Certificate subject	Organization value in the leaf certificate subject	The organization named as the certificate subject for that service. The result also shows its port and protocol.
Certificate issuer	Organization value in the leaf certificate issuer	The organization that issued the certificate. The result also shows its port and protocol. This is provenance evidence and does not prove that the issuer owns the host.

Certificate organization values are read through explicit protocol-specific mappings for HTTP/TLS, SMTP, IMAP, POP3, PostgreSQL, MySQL, MSSQL, RDP, OpenVPN, Cobalt C2, and SoftEther observations. Certificate chains and certificates reached through HTTP redirects are not included in the default organization search.

The result row lists the evidence source and the stored value that matched. A host may have more than one matching source, for example both AS organization and Network provider.

Not searched by default¶

The following data is intentionally excluded from the current organization search:

product, vendor, CPE, banner, and general service-description fields;
HTTP titles, response bodies, and other free-form content;
WHOIS contacts, addresses, abuse data, and administrative or technical contacts;
the separate latest_whois index;
certificate organizational units, certificate chains, and redirect-chain certificates;
service-declared organization values such as SIP Organization headers or Ganglia owners.

These are recorded as possible later extensions. They require a separate relevance, performance, privacy, evidence-label, and user-experience review before being added.

Understanding the result list¶

Result count¶

Filter and ASN searches show an estimate of unique IP addresses, not a count of service documents. The ≈ symbol means the total is approximate. The loaded result count is shown separately and remains usable if the total estimate is temporarily unavailable.

Suggested Filters¶

Suggested Filters are available for service, organization, and country filter searches. They are not requested for exact IP, CIDR, Domain, or ASN searches. The six categories cover ports, protocols, products, countries, maximum-CVSS ranges, and exploit availability. Organization is not a suggested category: its evidence spans several sources that cannot be reduced to five representative values, so search it directly with the organization:"phrase" filter described above. Each category contains at most five values.

Counts beside suggested values are distinct unique-IP estimates, not service-document counts. ≈ marks an approximate count; a count without that symbol is exact for the active data source. The short bar compares values within the same category and is not a percentage of all internet hosts.

Suggestions never delay the primary result list or its independent total. If one category is unavailable or times out, the Investigation Stream marks that category while keeping the remaining categories usable. After three filters are active, it shows the active values and asks you to remove one before requesting another filter.

Host row¶

Each row represents one IP address and can include:

geolocation;
AS number and organization;
the organization evidence that matched the query;
the ASN attribution evidence that matched an ASN query;
a bounded preview of the host's current services.

Selecting the result header opens Selected host without changing the service preview.

Matching services¶

Every multi-IP result card previews up to five of the host's current services immediately: port, protocol, product, vulnerability summary, and a bounded protocol-specific server identifier when available.

When your query contains service identity — a port, protocol, product, certificate, CPE, CVE, CVSS, or exploit clause — the services satisfying the complete combined query are listed first and marked with a check, and the heading states how many of the previewed services matched. The remaining rows are the host's other services, shown for context; they did not satisfy your query.

An organization-only, country-only, or CIDR query matches the host rather than any one service, so its preview marks nothing: all five rows are context.

Because the preview is limited to five rows, a heading such as Services (5+) means the host has more services than are shown. Open Selected host for the complete inventory.

Domain and ASN queries are host-level searches whose results carry no services at all.

Selected host¶

The Selected host panel is independent of the search match. It loads all current identified services for that IP, not just services that matched the query. Services are sorted by port number and then protocol.

Alongside geolocation, network, and WHOIS evidence, the panel lists:

Domains: a bounded list of DNS names the current scan data recorded for the IP - its stored reverse-DNS name, its stored forward DNS name, its stored domain, and DNS names from the subject of the leaf certificates its services present. A name recorded in several of those fields is listed once. These are stored scan values and not a lookup performed for your query, so a name can be stale or absent in exactly the way the scan was. The list is not a complete inventory: it is capped per field, per host, and per page, and which names appear depends on how you found the host. A domain search additionally reads the stored domain-scan records for each resolved address, which a search by address does not, so the same host can list more names when a domain search found it. Opening a host never shows fewer names than the row it was opened from.
Open ports with a count: every port the host currently exposes. When your search named a service, the ports that answered it are marked and the note states how many, so you can see the matched exposure against the host's full footprint.

A count shown as N+ means the host has more entries than the current page holds.

An exact-IP query uses the same independently loaded data but presents it directly as Host investigation below the Search Area. Its service accordions open protocol-specific General, CVE, and, when available, Certificate views. Names from a service's leaf certificate appear in the host's Domains list above; the interface derives domain names from certificates nowhere else, and shows no website capture when none was recorded. Coordinates are shown as text rather than on a map; see Geolocation for why.

For HTTP and HTTPS, status, title, and server details are shown only when the registered HTTP exchange completed cleanly. HTTPS may additionally show a bounded TLS summary such as the negotiated version and cipher suite, leaf-certificate validity and fingerprint, issuer common name, and browser-trust result. Full distinguished names, certificate chains, handshake data, keys, cookies, and authorization data are not displayed.

SSH services may show the server protocol and software version, comments, HASSH, and the host-key algorithm and fingerprint. Raw banners, host-key content, complete algorithm lists, authentication methods, usernames, credentials, and authentication attempts are not displayed.

All other registered protocols currently show only a bounded service summary. A service with captured application data remains in the inventory when a later protocol step failed; typed evidence is withheld when its adapter cannot establish the required safe fields. IP Intelligence does not expose a generic complete/incomplete observation state and does not display the scanner's raw error text.

The panel also shows bounded host context:

geolocation: the place from continent down to city, the coordinates, and the accuracy radius;
AS number and organization;
WHOIS organization, netname, CIDR, registry, and country;
reverse DNS.

Geolocation¶

The place is read from coarsest to finest — continent, country, first-level subdivision such as a federal state, second-level subdivision such as a district, and city. A level the scan did not record is left out rather than shown as a gap, so a host known only by country shows only the country. Where GeoIP names two neighbouring levels identically, as it does for city-states, the level appears once.

The coordinates are the position recorded by the scan, written as latitude, longitude. They are not a street address: the accuracy value is the radius the GeoIP source claims the address lies within, and it is often tens or hundreds of kilometres. Read the two together, because the coordinates on their own look far more precise than they are.

Each observation of a host carries its own position, so the one shown is the position of the most recent observation that records one, and its accuracy radius comes from that same observation. Not recorded by the scan means no observation of the host recorded a position; the place above it may still be known.

Geolocation places an address, not a person, and it is regularly wrong about anything finer than the country — providers assign addresses centrally, and the recorded position is frequently a provider's registered location rather than the equipment's. Treat it as one piece of evidence to corroborate, not as a location finding.

There is deliberately no map. Displaying one would load map tiles from an outside provider, which would tell that provider which coordinates you are looking at. The coordinates are given as text so that looking at a host tells nobody but you.

Reverse DNS¶

Reverse DNS is the name recorded by the scan on the most recent observation that carries one. IP Intelligence performs no lookup of its own, so the name can be older than the moment you are reading it, and Not recorded by the scan means no observation stored a name rather than that the address resolves to nothing. Where several names were stored for one host, the one shown is the first of them; the panel does not merge them into a single value.

For an IPv6 host, reverse DNS never appears. The IPv6 scan data carries no reverse-DNS field at all, so the panel always reads Not recorded by the scan there. This says nothing about whether the address has a name — only that this data set does not hold one. Geolocation is unaffected and is recorded for IPv6 as completely as for IPv4.

WHOIS contact, abuse, and address fields are not displayed.

Data scope and current limitations¶

Only the latest completed service scan of each service is returned. A service the scanner reached but could not complete is not treated as a current observation.
ASN search accepts only the standalone decimal form asn:<1..4294967295>. An AS prefix, leading zero, range, wildcard, or combination with another filter is not accepted.
ASN search checks exact values in CAIDA best ASN, BGP best ASN, and network/location ASN attribution. Source disagreement is preserved in the result evidence.
Domain scans are discovered automatically through the internal latestdomain_* index pattern, so newly created current domain-scan aliases are included without an application release.
Domain search accepts Unicode domain names and converts them to their canonical IDNA ASCII form. It normalizes case and one trailing dot and includes subdomains automatically. User-supplied wildcards, URL syntax, and public-suffix-only targets such as co.uk are not accepted.
DNS resolution is best effort, limited to public routable addresses, and reports an explicit outcome. Private, loopback, link-local, carrier-grade NAT, benchmarking, and documentation addresses are not used as DNS-derived search targets. If DNS is unavailable, matching stored domain scans can still return hosts.
Results describe exposure, not threat or ownership attribution.
A search that names no service - an organization or country on its own - is declined when it matches more hosts than one search can return. Very large network operators fall into this category. Combine the filter with a port, protocol, or country and the same search runs normally; organization:"Example" protocol:https answers in about a second where the organization alone would not complete at all.
A result row reads a bounded number of a host's current services, so a host with an unusually large number of services may show fewer of them in the row than it actually runs. The count is marked with + when more exist, and Selected host always loads the complete inventory. One consequence is worth knowing for organization searches: when the only thing tying a host to your organization phrase is the certificate of a service beyond that bound, the row can omit the matched-evidence label even though the host genuinely matched. Open the host to see its full service list.
Geolocation is GeoIP recorded by the scan, not a measured position. Read the coordinates together with their accuracy radius, and expect anything finer than the country to be unreliable. No map is displayed, so no map provider learns which host you are inspecting.
Reverse DNS is never available for an IPv6 host, because the IPv6 scan data holds no reverse-DNS field. For IPv4 it is recorded for about six hosts in ten.
IPv4 CIDR search is limited to /24 through /32.
IPv6 addresses can be searched exactly; IPv6 CIDR search is not yet supported.
Protocol names are exact, but their input is case-insensitive. Queries are normalized to lowercase; for example, protocol:HTTP becomes protocol:http. Families, synonyms, wildcards, and special scans are not expanded.
Product search uses registered CPE titles only. Banner and HTTP-content product inference is excluded.
Certificate-name search is exact, leaf-only, and excludes incomplete error observations.
HTTP/HTTPS error observations remain inventory results, but typed response details are withheld and their bounded service summary explains the limitation.
Vulnerability fields are scan-time service summaries. Missing enrichment is unknown, not a clean result.
Exact-IP and CIDR searches do not use matching-service terminology because the address is the match.
Result pages are ordered by IP address and loaded in bounded pages.
Globe locations use server-controlled Global, Regional, and Local geotile detail. Each level returns at most 500 buckets; a truncated high-detail level is labelled as bounded.
Globe totals still describe the full matching result set even when the high-detail location buckets are bounded.
Domain results do not currently expose the Globe view.
The feature is read-only and does not modify scan data.

Troubleshooting searches¶

Message or behaviour	What to check
No stored hosts	Confirm that the IP, CIDR, or phrase is correct and that current protocol observations exist.
Invalid organization	Put the organization phrase in double quotes, for example `organization:"Alpha Strike"`.
Invalid domain	Use a registrable domain such as `domain:example.com` without a wildcard, URL syntax, public suffix alone, or another filter.
Invalid ASN	Use the decimal form such as `asn:64496`, without an `AS` prefix, leading zero, range, or another filter.
Unsupported protocol	Choose an exact value from the protocol list in Add filter. Letter casing is ignored, but families, aliases, wildcards, and vulnerability scan names are not accepted.
Invalid product	Put the product phrase in double quotes, for example `product:"Apache Tomcat"`.
Invalid certificate name	Use one exact DNS name without a wildcard, for example `certificate.name:example.com`.
Invalid country	Use an uppercase ISO-2 code such as `country:DE`.
Invalid CPE	Put one complete CPE 2.3 URI in double quotes.
Invalid CVE	Use the exact uppercase form `CVE-YYYY-NNNN`.
Invalid CVSS	Use an inclusive `0.0-10.0` interval such as `cvss:9.0-10.0`.
CIDR too broad	Use an IPv4 prefix from `/24` through `/32`.
Query too broad	The organization or country you searched matches more hosts than a single search can return. Add a port, protocol, or country to narrow it. The service declines these before running them, so you get the answer immediately rather than waiting for a timeout. It does not count against your daily allowance.
Total unavailable	The result page is still valid; only the independent unique-IP estimate failed.
Suggested Filters partially unavailable	The host results are still valid. Use the available categories or rerun the search to retry the failed groups.
Suggestions timed out	The host results are still valid. Narrow the current query or rerun it to retry the Suggested Filters.
Search timed out	The current search did not finish within its bounded time window. Try a more specific filter, such as adding a country or product, or run the search again. This does not count against your daily allowance.
Search could not be run just now	The stored scan data was temporarily busy and declined the search before starting it. Nothing is wrong with your query: wait a few seconds and run it again, and it usually goes through. This does not count against your daily allowance. If it keeps happening, adding a port, protocol, or country makes the search smaller and more likely to succeed.
Search is temporarily unavailable	The service itself could not be reached. This is on our side, and unlike the entry above, running the same search again straight away is unlikely to help. Try again shortly. It does not count against your daily allowance.
This result page has expired	Run the search again to start from the first page. The expired page did not count against your daily allowance; the fresh search does.

Account and plan states¶

These are not faults in your search. They are answers about your account, and each is checked before any data is read, so the search does not run at all rather than running and returning less.

Message	What it means and what to do
Your account cannot search right now	Your access to IP Intelligence is not active. An administrator sets this, so contact us and we will sort it out.
Plan expired	Your plan has ended. Searches resume immediately once it is renewed.
Search limit reached	Your plan's search allowance for the current period is used up. It resets at the start of the next period, or contact us to raise it.
Too many searches at once	You already have the maximum number of searches running. Wait for one to finish and try again.
Search capacity is full	The service is at capacity and did not start your search. Try again in a few moments; nothing was counted against your allowance for a search that never ran.
Entitlements temporarily unreadable	Your entitlements could not be checked. Rather than run the search without checking, the service declines it. This is on our side - try again shortly.
Sign in to search	Your session is missing or has expired. Sign in again to continue.
Session service unavailable	Your session could not be verified. This is on our side - try again shortly.

Terminology¶

Term	Meaning
Host	One unique IPv4 or IPv6 address.
Service	A current protocol observation on a port.
Typed protocol evidence	A bounded, reviewed projection for one protocol family. HTTP/HTTPS and SSH currently have typed projections; other protocols use a safe summary.
Matching service	A service observation that satisfies all service clauses in the query.
Product title	Human-readable title from registered CPE scan-time enrichment.
Vulnerability summary	Service-level stored CPE/CVE count, maximum CVSS, and exploit-availability enrichment.
Organization evidence	A matched value from one of the six reviewed organization sources.
Domain search	A merged unique-IP result from live DNS resolution and current stored domain scans.
Domain evidence	The DNS or stored scan field that caused a host to appear in a domain result.
ASN evidence	The CAIDA, BGP, or network/location attribution that caused a host to appear in an ASN result.
Selected host	Independently loaded detail for the currently selected IP.