IP Intelligence

IP Intelligence helps you investigate the current public exposure of an IP address, a domain, an autonomous system, a small IPv4 network, a service, or an organization. Results are grouped by unique IP address and are based on the latest stored protocol observations available to Alpha Strike.

This page describes the currently implemented search capabilities. It is published at docs.ip.alphastrike.io and is written in standard Markdown so it can also be included in the Alpha Strike Platform's own documentation site.

Tech Preview

IP Intelligence is currently a Tech Preview. Every page carries a Tech Preview banner across the top of the screen — including the sign-in, registration, and terms pages — and it stays in place while you scroll, so it is always visible that this is a preview rather than a generally available product. The preview is free of charge, its functions and limits can change at any time, and the terms of service you accept at registration apply to every account.

Signing in

IP Intelligence requires an account. Searching, and every page except the ones below, is available only while you are signed in.

If you have an account. Select Sign in. You are taken to the Alpha Strike sign-in page, and back to IP Intelligence once you have entered your credentials.

If you do not have one yet. Select Create an account. The form asks for one thing, your business email address, and it is required. You are not asked for a password here: we send you a link that confirms your address and lets you choose one. The link is the only way to finish, so use an address you can read. Temporary and disposable email domains are not accepted.

Before Create account does anything you have to tick I agree to the Terms of Service. Selecting the link in that line opens the full text in a dialog on top of the form, so you can read it without leaving the page or losing what you have typed; Close returns you to the form. The same text is also a page of its own at /terms if you want to open it in a separate tab, and ticking the box is a separate action from reading — opening the terms never ticks it for you. We record which version you accepted and when, on your account. The Tech Preview is offered to businesses only, and the terms cover what the service may and may not be used for — § 6 is worth reading before you start.

If you already registered with that address, the page says so and points you at signing in instead of creating a second account.

Nothing to set up. Your account is prepared the first time you sign in, so you can search straight away. You are not asked to create an organization, and there is no setup step to complete first.

If a search reports that your account cannot search, that is not something you can fix from the product: it means your access has been set to inactive. Contact us and we will sort it out.

The account menu. Select your email address in the top bar to open it. Besides Sign out, it links to this Quickstart page, to Release notes, and to Report a problem — the first two are readable without an account, so you can point a colleague at either before they sign up.

Reporting a problem. Select Report a problem from the account menu, then describe what happened and select Send. This is signed-in only, description only — there is no file attachment in this version — and the description is limited to 4,000 characters. We do not reply to individual reports.

Signing out. Select Sign out from the account menu. This ends your IP Intelligence session. If you are on a shared or public computer, close the browser afterwards as well: your organization's identity provider may still remember you, and closing the browser is what clears that.

If your session ends on its own. Sessions expire after a period of inactivity. When that happens you are taken to a page that says so, rather than being left on a screen that looks signed in but no longer works. Signing in again is enough to carry on; a search you were looking at can simply be run again.

How much you can search

During the Tech Preview each account can run 20 searches per day, counted per person.

A search is one search, whatever you do with the results afterwards. Opening the Globe view, loading a host's details, reading the suggested filters, and loading further pages of the same result set are all free. Only starting a new search counts.

The allowance resets daily. If you reach it, searching pauses until the reset.

The allowance is a ceiling rather than a promised quantity: during the Tech Preview we may change it, and a search can also be refused because the service as a whole is at its limit. Section 5 of the terms of service says so explicitly.

Quickstart

1. Open IP Intelligence at https://ip.alphastrike.io and sign in.
2. Enter an IP address, domain, ASN, IPv4 CIDR, or supported filter in the search bar.
3. Select Search.
4. For an exact IP, review Host investigation directly below the search. For searches returning multiple IPs, select a host row to open Selected host.
5. Review the five-row Services preview on each result. When your search named a service, the services that answered it are listed first and marked; select the host to load its complete service inventory.

Try one of these searches:

203.0.113.10
domain:example.com
asn:64496
203.0.113.0/24
port:443
protocol:http
protocol:ssh port:22 country:DE
organization:"Alpha Strike"
port:443 organization:"Alpha Strike"
product:"Apache Tomcat"
certificate.name:example.com
country:DE
cpe:"cpe:2.3:a:openbsd:openssh:9.6:*:*:*:*:*:*:*"
cve:CVE-2024-6387
cvss:9.0-10.0 exploit:yes

You can also select Add filter to build a supported query interactively. When adding a filter from an existing result page, applying it immediately runs the updated search. On an Exact IP, CIDR, Domain, or ASN result page, Add filter starts a new filter search because those standalone targets cannot be combined with service filters.

After a filter search succeeds, the Investigation Stream loads Suggested Filters independently from the host results. Expand a category to review values, then select Apply to add the value and immediately rerun the search. A value already in the query is labelled Applied; selecting it removes that field and immediately reruns the updated query. No additional selection of Search is required.

Common workflows

Investigate a known host

Search the exact IPv4 or IPv6 address and review its geolocation — place, coordinates and accuracy radius — plus network, WHOIS context, reverse DNS, and the complete current service list in Host investigation directly below the search. There is no intermediate result row or separate Selected host panel for an exact-IP query.

Review a small IPv4 network

Search a CIDR from /24 through /32. The result list contains every identified IP inside the network. Select individual hosts to inspect their current services.

Find the hosts behind a domain

Search domain:example.com. IP Intelligence combines two sources:

• the domain's current A and AAAA DNS resolution; and
• current stored domain-scan observations whose domain, dns, or rdns value is the requested domain or one of its subdomains.

The resulting IP addresses are merged and deduplicated. Select a result to load the host's complete current service list independently of the domain match.

Above the results, the DNS status tells you whether public A/AAAA addresses were resolved, not found, timed out, failed, or were excluded because no public routable address was returned. Stored domain scans are still searched for every status. Each host row explains the match with one or more labels:

Result label	Meaning
DNS resolution	The host IP was one of the domain's current public A/AAAA answers.
Stored domain	The stored domain value matched the requested name or a subdomain.
Stored DNS name	A stored dns value matched the requested name or a subdomain.
Stored reverse DNS	The stored rdns value matched the requested name or a subdomain.

Review an autonomous system

Search an exact autonomous-system number such as asn:64496. IP Intelligence finds current IPv4 and IPv6 hosts attributed to that number by any reviewed ASN source. Results are unique IP addresses and include labels explaining which source matched:

Result label	Meaning
CAIDA ASN	The CAIDA best-ASN attribution matched.
BGP ASN	The best BGP attribution matched.
Network ASN	The network/location enrichment ASN matched.

ASN attribution can differ between sources and does not by itself prove asset ownership. Select a host to load its complete current service list independently of the ASN match.

Find a type of exposure

Search a port or an exact protocol, optionally combined with an organization or country. Each multi-IP result previews up to five of the host's current services, listing the ones that satisfied the filter first.

You can also search detected products, leaf-certificate DNS names, exact CPE identities, exact CVE identifiers, service-level maximum-CVSS ranges, and scan-time exploit availability. These are service-level filters, so the Services preview identifies the observations that satisfied every clause.

Review exposure by country

Search an uppercase ISO-2 GeoIP code such as country:DE. Country describes the host's GeoIP location. It is deliberately separate from WHOIS contact or registration addresses.

Visualize geographic exposure

After a supported search returns results, switch from Results to Globe. The Globe loads a separate bounded aggregation; it is not derived from the currently loaded result page. Use the mouse wheel, trackpad, or the + and − controls to zoom. The map starts with Global detail and automatically requests Regional and Local detail as you zoom in. Zooming back out reuses a previously loaded level when available.

Click a location bubble or choose a location from the list to pause rotation, centre that area, and review its approximate unique-IP and matching-service counts. Use Zoom into area or double-click the globe to move to the next detail level. Click empty globe space or press Escape to clear the selection and resume rotation. The focused globe also supports arrow keys for rotation and +/− for zoom; every cluster remains available as a keyboard-accessible button in the location list.

Each geographic cluster represents matching IPs in one Elasticsearch geotile bucket and shows approximate unique-IP and matching-service counts. Point density and bubble size are scaled for rendering and must not be read as one visible dot per IP or as an exact IP location. The unique-IP and service totals always describe the full matching result set. At Regional or Local detail, the location list can be limited to the 500 largest buckets; the interface labels that state explicitly while retaining the full totals.

If a finer aggregation times out or fails, the last successful map remains visible and the Globe shows an error notice. Try the zoom action again or narrow the search query.

When you submit another supported search while Globe is selected, the interface stays in Globe and loads the new query at Global detail. A Domain search returns to Results because Domain Globe aggregation is not yet available.

The Globe is exposure-only. It does not add threat scores, severity layers, exploit layers, or correlation corridors. Domain Globe aggregation is not yet available because live-DNS and stored-domain result locations must first be deduplicated in one complete-result query.

Discover an organization's visible footprint

Search organization:"name". Review the evidence label on each result before interpreting the relationship. AS, WHOIS, provider, certificate-subject, and certificate-issuer evidence describe different relationships; none should be treated as asset ownership proof without additional validation.

Supported searches

Search type	Syntax	Behaviour
Exact IP	203.0.113.10 or 2001:db8::10	Returns the requested host when a current protocol observation exists.
Domain	domain:example.com	Resolves A/AAAA records and searches current domain scans for the domain and its subdomains, then returns the combined unique IPs.
ASN	asn:64496	Returns unique IPv4 and IPv6 hosts whose exact CAIDA, BGP, or network/location ASN attribution matches.
IPv4 CIDR	203.0.113.0/24 or cidr:203.0.113.0/24	Returns unique IPs inside an IPv4 network from /24 through /32. Host bits are normalized automatically, and both forms identify the same search.
Port	port:443	Returns hosts with a current protocol observation on exactly that port.
Protocol	protocol:ssh	Returns hosts identified as the exact registered protocol. HTTP does not implicitly include HTTPS.
Organization	organization:"Alpha Strike"	Searches all reviewed organization evidence sources described below.
Product	product:"Apache Tomcat"	Case-insensitive token search over human-readable registered CPE titles. Word order is not required; every token must occur in the same title field.
Certificate name	certificate.name:example.com	Exact canonical DNS-name match against registered leaf-certificate SAN and common-name fields.
Country	country:DE	Exact uppercase ISO-2 match against host GeoIP country.
Exact CPE	cpe:"cpe:2.3:a:openbsd:openssh:9.6:*:*:*:*:*:*:*"	Exact match against the stored CPE 2.3 identity.
CVE	cve:CVE-2024-6387	Exact match against a CVE identifier stored on the service observation.
Maximum CVSS	cvss:9.0-10.0	Inclusive range over the service-level maximum CVSS summary.
Exploit availability	exploit:yes or exploit:no	Exact service-level scan-time enrichment flag.

Filters can be combined with spaces or uppercase AND. Both forms represent the same query:

port:443 organization:"Alpha Strike"
port:443 AND organization:"Alpha Strike"

Domain and ASN are separate search targets and cannot currently be combined with filters. At most three filter clauses can be combined, and each field can occur only once. OR, grouping, user-supplied wildcards, regular expressions, raw Lucene, and Elasticsearch Query DSL are not supported.

Supported protocol values

Protocol values are exact tokens with case-insensitive input. They are canonicalized to lowercase, then checked against a versioned public registry and a separate reviewed index catalog. The Add filter dialog loads the current list automatically and lets you narrow it by typing. Similar names remain separate: http does not include https, imap does not include imaps, and smtp does not include smtps.

The current public values are:

amqp apc bacnet bgp coap cobaltc2 db2disco dnstcp elastic eniptcp fox ftp
ganglia http https iec104 imap imaps ipmi ipp isakmp iscsi jmxrmi kerberos
kibana knx l2tp ldaptcp ldapudp mdns memcached mikrotikwb modbus mongodb
mssqlmon mssqltcp mumble mysql natpmp netbiosns nntp ntp opcua openvpntcp
openvpnudp oracledb pcanq pcom phoenix pop3 pop3s portmap portmaptcp postgres
pptp rdp redis ripv1 ripv2 rsync rtsp s7 samba saprouter sentinel sip smtp
smtps snmpv1 snmpv2 snmpv3 softethervpn ssh subversion sworionrest telnet
tftp ubiquitidd upnp vmwareauthd vnc wdbrpc webmin winrm winrms wsd zookeeper

Protocol filters always select the latest completed service scans. When a port is combined with a protocol, every clause must match the same service observation:

protocol:ssh port:22 country:DE

This example finds German hosts with one current service observation that is both SSH and on port 22. It does not combine an SSH observation from one port with port 22 from another service. Vulnerability and special-scan names such as heartbleed are deliberately not protocol filters.

Product, CPE, certificate, and vulnerability filters

Human product search uses the registered CPE title stored by scan-time enrichment. It does not search service banners, HTTP content, vendor fields, or free-form descriptions. An exact CPE filter searches the stored CPE identity instead. Because the source cpes_detailed array is not nested, IP Intelligence does not claim a product/version relationship across different entries; use an exact CPE when that identity matters.

Certificate-name search checks only registered leaf-certificate SAN and subject common-name paths for supported TLS-capable protocol families. It excludes observations that contain an error field or an error status because the TLS step may be incomplete. Certificate chains, redirect-chain certificates, issuer searches, fingerprints, wildcard query input, and partial-name matching are not part of this filter.

CVE, maximum-CVSS, and exploit filters use the vulnerability enrichment already stored on each current service observation. They do not repeat banner-to-CPE matching at search time. max_cvss is the maximum score across the service summary and is not the score of every listed CVE. A missing vulnerability block means enrichment is unavailable; it must not be interpreted as vulnerability-free. exploit:no means the stored enrichment flag is false, not that exploitation is impossible.

Organization search

Enter only the organization name. You do not need to know whether it appears in AS, WHOIS, network-provider, or certificate data.

Organization search is case-insensitive phrase matching. The order of the words remains significant, but the stored value may contain additional words. For example:

organization:"Alpha Strike"

also matches a stored value such as alpha Strike labs gmbh.

What is searched

The default organization search checks exactly these six evidence sources on the latest completed service scans:

Result label	Scan data searched	How to interpret it
AS organization	CAIDA and BGP autonomous-system organization names	The organization associated with the AS announcing the IP prefix.
WHOIS description	The embedded service WHOIS description (whois.descr)	Registration description stored with the service observation.
WHOIS netname	The embedded service WHOIS network name (whois.netname)	Registered network name; it may be an identifier rather than a legal organization name.
Network provider	Provider enrichment from location.organization, location.as_org, and location.isp	The network or connectivity provider associated with the observation.
Certificate subject	Organization value in the leaf certificate subject	The organization named as the certificate subject for that service. The result also shows its port and protocol.
Certificate issuer	Organization value in the leaf certificate issuer	The organization that issued the certificate. The result also shows its port and protocol. This is provenance evidence and does not prove that the issuer owns the host.

Certificate organization values are read through explicit protocol-specific mappings for HTTP/TLS, SMTP, IMAP, POP3, PostgreSQL, MySQL, MSSQL, RDP, OpenVPN, Cobalt C2, and SoftEther observations. Certificate chains and certificates reached through HTTP redirects are not included in the default organization search.

The result row lists the evidence source and the stored value that matched. A host may have more than one matching source, for example both AS organization and Network provider.

Not searched by default

The following data is intentionally excluded from the current organization search:

• product, vendor, CPE, banner, and general service-description fields;
• HTTP titles, response bodies, and other free-form content;
• WHOIS contacts, addresses, abuse data, and administrative or technical contacts;
• the separate latest_whois index;
• certificate organizational units, certificate chains, and redirect-chain certificates;
• service-declared organization values such as SIP Organization headers or Ganglia owners.

These are recorded as possible later extensions. They require a separate relevance, performance, privacy, evidence-label, and user-experience review before being added.

Understanding the result list

Result count

Filter and ASN searches show an estimate of unique IP addresses, not a count of service documents. The ≈ symbol means the total is approximate. The loaded result count is shown separately and remains usable if the total estimate is temporarily unavailable.

Suggested Filters

Suggested Filters are available for service, organization, and country filter searches. They are not requested for exact IP, CIDR, Domain, or ASN searches. The seven categories cover ports, protocols, products, countries, organizations, maximum-CVSS ranges, and exploit availability. Each category contains at most five values.

Counts beside suggested values are distinct unique-IP estimates, not service-document counts. ≈ marks an approximate count; a count without that symbol is exact for the active data source. The short bar compares values within the same category and is not a percentage of all internet hosts.

Suggestions never delay the primary result list or its independent total. If one category is unavailable or times out, the Investigation Stream marks that category while keeping the remaining categories usable. After three filters are active, it shows the active values and asks you to remove one before requesting another filter.

Host row

Each row represents one IP address and can include:

• geolocation;
• AS number and organization;
• the organization evidence that matched the query;
• the ASN attribution evidence that matched an ASN query;
• a bounded preview of the host's current services.

Selecting the result header opens Selected host without changing the service preview.

Matching services

Every multi-IP result card previews up to five of the host's current services immediately: port, protocol, product, vulnerability summary, and a bounded protocol-specific server identifier when available.

When your query contains service identity — a port, protocol, product, certificate, CPE, CVE, CVSS, or exploit clause — the services satisfying the complete combined query are listed first and marked with a check, and the heading states how many of the previewed services matched. The remaining rows are the host's other services, shown for context; they did not satisfy your query.

An organization-only, country-only, or CIDR query matches the host rather than any one service, so its preview marks nothing: all five rows are context.

Because the preview is limited to five rows, a heading such as Services (5+) means the host has more services than are shown. Open Selected host for the complete inventory.

Domain and ASN queries are host-level searches whose results carry no services at all.

Selected host

The Selected host panel is independent of the search match. It loads all current identified services for that IP, not just services that matched the query. Services are sorted by port number and then protocol.

Alongside geolocation, network, and WHOIS evidence, the panel lists:

• Domains with a count: the DNS names observed for the IP, from reverse DNS and from leaf-certificate subject names.
• Open ports with a count: every port the host currently exposes. When your search named a service, the ports that answered it are marked and the note states how many, so you can see the matched exposure against the host's full footprint.

A count shown as N+ means the host has more entries than the current page holds.

An exact-IP query uses the same independently loaded data but presents it directly as Host investigation below the Search Area. Its service accordions open protocol-specific General, CVE, and, when available, Certificate views. The interface does not derive domain names from certificates, and shows no website capture when none was recorded. Coordinates are shown as text rather than on a map; see Geolocation for why.

For HTTP and HTTPS, status, title, and server details are shown only when the registered HTTP exchange completed cleanly. HTTPS may additionally show a bounded TLS summary such as the negotiated version and cipher suite, leaf-certificate validity and fingerprint, issuer common name, and browser-trust result. Full distinguished names, certificate chains, handshake data, keys, cookies, and authorization data are not displayed.

SSH services may show the server protocol and software version, comments, HASSH, and the host-key algorithm and fingerprint. Raw banners, host-key content, complete algorithm lists, authentication methods, usernames, credentials, and authentication attempts are not displayed.

All other registered protocols currently show only a bounded service summary. A service with captured application data remains in the inventory when a later protocol step failed; typed evidence is withheld when its adapter cannot establish the required safe fields. IP Intelligence does not expose a generic complete/incomplete observation state and does not display the scanner's raw error text.

The panel also shows bounded host context:

• geolocation: the place from continent down to city, the coordinates, and the accuracy radius;
• AS number and organization;
• WHOIS organization, netname, CIDR, registry, and country;
• reverse DNS.

Geolocation

The place is read from coarsest to finest — continent, country, first-level subdivision such as a federal state, second-level subdivision such as a district, and city. A level the scan did not record is left out rather than shown as a gap, so a host known only by country shows only the country. Where GeoIP names two neighbouring levels identically, as it does for city-states, the level appears once.

The coordinates are the position recorded by the scan, written as latitude, longitude. They are not a street address: the accuracy value is the radius the GeoIP source claims the address lies within, and it is often tens or hundreds of kilometres. Read the two together, because the coordinates on their own look far more precise than they are.

Each observation of a host carries its own position, so the one shown is the position of the most recent observation that records one, and its accuracy radius comes from that same observation. Not recorded by the scan means no observation of the host recorded a position; the place above it may still be known.

Geolocation places an address, not a person, and it is regularly wrong about anything finer than the country — providers assign addresses centrally, and the recorded position is frequently a provider's registered location rather than the equipment's. Treat it as one piece of evidence to corroborate, not as a location finding.

There is deliberately no map. Displaying one would load map tiles from an outside provider, which would tell that provider which coordinates you are looking at. The coordinates are given as text so that looking at a host tells nobody but you.

Reverse DNS

Reverse DNS is the name recorded by the scan on the most recent observation that carries one. IP Intelligence performs no lookup of its own, so the name can be older than the moment you are reading it, and Not recorded by the scan means no observation stored a name rather than that the address resolves to nothing. Where several names were stored for one host, the one shown is the first of them; the panel does not merge them into a single value.

For an IPv6 host, reverse DNS never appears. The IPv6 scan data carries no reverse-DNS field at all, so the panel always reads Not recorded by the scan there. This says nothing about whether the address has a name — only that this data set does not hold one. Geolocation is unaffected and is recorded for IPv6 as completely as for IPv4.

WHOIS contact, abuse, and address fields are not displayed.

Data scope and current limitations

• Only the latest completed service scan of each service is returned. A service the scanner reached but could not complete is not treated as a current observation.
• ASN search accepts only the standalone decimal form asn:<1..4294967295>. An AS prefix, leading zero, range, wildcard, or combination with another filter is not accepted.
• ASN search checks exact values in CAIDA best ASN, BGP best ASN, and network/location ASN attribution. Source disagreement is preserved in the result evidence.
• Domain scans are discovered automatically through the internal latestdomain_* index pattern, so newly created current domain-scan aliases are included without an application release.
• Domain search accepts Unicode domain names and converts them to their canonical IDNA ASCII form. It normalizes case and one trailing dot and includes subdomains automatically. User-supplied wildcards, URL syntax, and public-suffix-only targets such as co.uk are not accepted.
• DNS resolution is best effort, limited to public routable addresses, and reports an explicit outcome. Private, loopback, link-local, carrier-grade NAT, benchmarking, and documentation addresses are not used as DNS-derived search targets. If DNS is unavailable, matching stored domain scans can still return hosts.
• Results describe exposure, not threat or ownership attribution.
• A search that names no service - an organization or country on its own - is declined when it matches more hosts than one search can return. Very large network operators fall into this category. Combine the filter with a port, protocol, or country and the same search runs normally; organization:"Example" protocol:https answers in about a second where the organization alone would not complete at all.
• A result row reads a bounded number of a host's current services, so a host with an unusually large number of services may show fewer of them in the row than it actually runs. The count is marked with + when more exist, and Selected host always loads the complete inventory. One consequence is worth knowing for organization searches: when the only thing tying a host to your organization phrase is the certificate of a service beyond that bound, the row can omit the matched-evidence label even though the host genuinely matched. Open the host to see its full service list.
• Geolocation is GeoIP recorded by the scan, not a measured position. Read the coordinates together with their accuracy radius, and expect anything finer than the country to be unreliable. No map is displayed, so no map provider learns which host you are inspecting.
• Reverse DNS is never available for an IPv6 host, because the IPv6 scan data holds no reverse-DNS field. For IPv4 it is recorded for about six hosts in ten.
• IPv4 CIDR search is limited to /24 through /32.
• IPv6 addresses can be searched exactly; IPv6 CIDR search is not yet supported.
• Protocol names are exact, but their input is case-insensitive. Queries are normalized to lowercase; for example, protocol:HTTP becomes protocol:http. Families, synonyms, wildcards, and special scans are not expanded.
• Product search uses registered CPE titles only. Banner and HTTP-content product inference is excluded.
• Certificate-name search is exact, leaf-only, and excludes incomplete error observations.
• HTTP/HTTPS error observations remain inventory results, but typed response details are withheld and their bounded service summary explains the limitation.
• Vulnerability fields are scan-time service summaries. Missing enrichment is unknown, not a clean result.
• Exact-IP and CIDR searches do not use matching-service terminology because the address is the match.
• Result pages are ordered by IP address and loaded in bounded pages.
• Globe locations use server-controlled Global, Regional, and Local geotile detail. Each level returns at most 500 buckets; a truncated high-detail level is labelled as bounded.
• Globe totals still describe the full matching result set even when the high-detail location buckets are bounded.
• Domain results do not currently expose the Globe view.
• The feature is read-only and does not modify scan data.

Troubleshooting searches

Message or behaviour	What to check
No stored hosts	Confirm that the IP, CIDR, or phrase is correct and that current protocol observations exist.
Invalid organization	Put the organization phrase in double quotes, for example organization:"Alpha Strike".
Invalid domain	Use a registrable domain such as domain:example.com without a wildcard, URL syntax, public suffix alone, or another filter.
Invalid ASN	Use the decimal form such as asn:64496, without an AS prefix, leading zero, range, or another filter.
Unsupported protocol	Choose an exact value from the protocol list in Add filter. Letter casing is ignored, but families, aliases, wildcards, and vulnerability scan names are not accepted.
Invalid product	Put the product phrase in double quotes, for example product:"Apache Tomcat".
Invalid certificate name	Use one exact DNS name without a wildcard, for example certificate.name:example.com.
Invalid country	Use an uppercase ISO-2 code such as country:DE.
Invalid CPE	Put one complete CPE 2.3 URI in double quotes.
Invalid CVE	Use the exact uppercase form CVE-YYYY-NNNN.
Invalid CVSS	Use an inclusive 0.0-10.0 interval such as cvss:9.0-10.0.
CIDR too broad	Use an IPv4 prefix from /24 through /32.
Query too broad	The organization or country you searched matches more hosts than a single search can return. Add a port, protocol, or country to narrow it. The service declines these before running them, so you get the answer immediately rather than waiting for a timeout.
Total unavailable	The result page is still valid; only the independent unique-IP estimate failed.
Suggested Filters partially unavailable	The host results are still valid. Use the available categories or rerun the search to retry the failed groups.
Suggestions timed out	The host results are still valid. Narrow the current query or rerun it to retry the Suggested Filters.
Search timed out	The current search did not finish within its bounded time window. Try a more specific filter, such as adding a country or product, or run the search again.
This result page has expired	Run the search again to start from the first page.

Account and plan states

These are not faults in your search. They are answers about your account, and each is checked before any data is read, so the search does not run at all rather than running and returning less.

Message	What it means and what to do
Your account cannot search right now	Your access to IP Intelligence is not active. An administrator sets this, so contact us and we will sort it out.
Plan expired	Your plan has ended. Searches resume immediately once it is renewed.
Search limit reached	Your plan's search allowance for the current period is used up. It resets at the start of the next period, or contact us to raise it.
Too many searches at once	You already have the maximum number of searches running. Wait for one to finish and try again.
Search capacity is full	The service is at capacity and did not start your search. Try again in a few moments; nothing was counted against your allowance for a search that never ran.
Entitlements temporarily unreadable	Your entitlements could not be checked. Rather than run the search without checking, the service declines it. This is on our side - try again shortly.
Sign in to search	Your session is missing or has expired. Sign in again to continue.
Session service unavailable	Your session could not be verified. This is on our side - try again shortly.

Terminology

Term	Meaning
Host	One unique IPv4 or IPv6 address.
Service	A current protocol observation on a port.
Typed protocol evidence	A bounded, reviewed projection for one protocol family. HTTP/HTTPS and SSH currently have typed projections; other protocols use a safe summary.
Matching service	A service observation that satisfies all service clauses in the query.
Product title	Human-readable title from registered CPE scan-time enrichment.
Vulnerability summary	Service-level stored CPE/CVE count, maximum CVSS, and exploit-availability enrichment.
Organization evidence	A matched value from one of the six reviewed organization sources.
Domain search	A merged unique-IP result from live DNS resolution and current stored domain scans.
Domain evidence	The DNS or stored scan field that caused a host to appear in a domain result.
ASN evidence	The CAIDA, BGP, or network/location attribution that caused a host to appear in an ASN result.
Selected host	Independently loaded detail for the currently selected IP.