IP search

IP search takes one IPv4 or IPv6 address and runs a full investigation on it. The answer has one result per source that found something, each with a readable summary (rows, lists) and its structured record (details):

Source	`source`	What it finds
Location	`location`	Country, region, city, postal code, coordinates and time zone from several geolocation services side by side: the place most of them agree on, how many agree, how close their city-level answers in that country are to it, and whether the address is anycast (answered from many places at once).
Network & routing	`network`	The prefix and the network (ASN) that announces it, its holder, the operator and its kind (CDN, cloud, hosting, ISP, business), the company that uses the address, whether the prefix is announced now, when it was first and last seen in routing, how many route collectors see it, its upstream providers, its address block and the related prefixes; whether the announcement is valid in RPKI, the networks that announced the address over the last 3 years (its origin history), and how many prefixes its network announces. See Routing.
WHOIS (RDAP)	`whois`	The record of the address block at its regional registry (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC): range and CIDR, name, type, parent block, the organization and its address, contacts, the abuse contact, creation and update dates, remarks. RDAP first, RIPEstat when RDAP gives nothing.
Reverse DNS & domains	`dns`	The reverse DNS (PTR) names of the address and whether they point back to it, the other host names seen on it, and the domains hosted on it, from passive DNS and reverse-IP services; and its DNS history: the names seen pointing to the address over the years, with when each was first and last seen, from Mnemonic and AlienVault OTX passive DNS. See DNS history.
Ports & services	`services`	The open ports public scans saw, the service on each (SSH, HTTP, RDP, Tor…), software and versions (CPE), known vulnerabilities (CVE) most dangerous first, each with its summary, CVSS score and severity, exploitation probability (EPSS), whether it is exploited in the wild (CISA KEV) and its NVD page, tags, the address’s own web answer (status, server, page title, redirect) and the TLS certificate it serves.
Reputation & threats	`reputation`	A verdict (clean, suspicious or malicious) and its reasons; VPN, proxy, Tor, hosting, abuser and scanner flags; what GreyNoise saw of the address; the Tor relay when it is one; threat-intelligence reports; the answer of DNS blocklists; and 11 public threat lists (Spamhaus DROP, FireHOL, Feodo Tracker, DShield…), with what each says of the address and on how many public blacklists it is (IPsum). See Threat lists.

Starting from a domain instead? Use Domain search: its hosting result lists the domain’s addresses, each one ready for an IP search.

Request

POST /v1/osint/ip, with a JSON body.

Parameter	Type	Required	What it does
`ip`	string	Yes	One IPv4 or IPv6 address, up to 100 characters, like `8.8.8.8` or `2001:4860:4860::8888`. Surrounding spaces are dropped. Square brackets and a port are dropped too: `[2606:4700:4700::1111]:443` searches `2606:4700:4700::1111`, `1.1.1.1:53` searches `1.1.1.1`. An IPv6 address is searched in its short, lower-case form, and an IPv4-mapped one (`::ffff:1.1.1.1`) as its IPv4 address.

ip is the only field. Refused with 400 invalid_request, nothing charged:

a range (8.8.8.0/24), several addresses, a zone (fe80::1%eth0), a host name, an IPv4 part with a leading zero (8.8.8.08);
an address that is not on the public internet: private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7), loopback (127.0.0.0/8, ::1), link-local (169.254.0.0/16, fe80::/10), shared carrier-grade NAT (100.64.0.0/10), multicast, broadcast, unspecified, documentation (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 2001:db8::/32), benchmarking (198.18.0.0/15, 2001:2::/48) and reserved addresses (240.0.0.0/4, an IPv6 address outside 2000::/3…).

details says why, like That is a private address: it is not on the public internet. Any other field is refused too.

curl https://api.orelys.io/v1/osint/ip \
  -H "Authorization: Bearer $ORELYS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "ip": "8.8.8.8" }' \
  --max-time 100

const response = await fetch("https://api.orelys.io/v1/osint/ip", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ORELYS_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ ip: "8.8.8.8" }),
  signal: AbortSignal.timeout(100_000),
});

const data = await response.json();
if (!response.ok) throw new Error(`${data.error.code}: ${data.error.message}`);

const bySource = Object.fromEntries(data.results.map((result) => [result.source, result.data.details]));
const place = bySource.location?.consensus;
console.log("Location:", [place?.city, place?.region, place?.country].filter(Boolean).join(", "));
const asn = bySource.network?.asn;
if (asn) console.log(`Network: AS${asn.number} ${asn.holder ?? asn.name ?? ""}`);
console.log("Abuse contact:", bySource.whois?.abuse?.email);
console.log("Verdict:", bySource.reputation?.verdict?.level);
const lists = bySource.reputation?.threat_lists_summary;
if (lists) console.log(`Threat lists: listed on ${lists.listed} of ${lists.checked}`);
console.log("RPKI:", bySource.network?.rpki?.status);
const vulns = bySource.services?.vuln_summary;
if (vulns) console.log(`Vulnerabilities: ${vulns.total}, ${vulns.critical} critical, ${vulns.kev} exploited in the wild`);
for (const domain of bySource.dns?.domains ?? []) console.log(domain.name);
console.log(`Cost ${data.cost}, charged: ${data.charged}, credits left: ${data.credits.remaining}`);

import os
import requests

response = requests.post(
    "https://api.orelys.io/v1/osint/ip",
    headers={"Authorization": f"Bearer {os.environ['ORELYS_API_KEY']}"},
    json={"ip": "8.8.8.8"},
    timeout=100,
)
data = response.json()
if not response.ok:
    raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")

details = {result["source"]: result["data"]["details"] for result in data["results"]}
services = details.get("services") or {}
for service in services.get("services", []):
    print(service["port"], service["name"] or "")
# Most dangerous first: exploited in the wild (CISA KEV), then by CVSS score, then by EPSS.
for vuln in services.get("vulns", [])[:10]:
    exploited = "exploited in the wild" if vuln["kev"] else ""
    print(vuln["id"], vuln["cvss"], vuln["severity"] or "unknown", exploited, vuln["url"])
print("Charged:", data["charged"], "- credits left:", data["credits"]["remaining"])

A search runs every source at the same time and usually answers in 10 to 25 seconds, after about 85 seconds at the latest: a source still running then gives what it has, or counts as failed. Set your HTTP client’s timeout to at least 100 seconds, as above.

What you get back

The envelope is module, query, count, results, cost, charged and credits - like the other OSINT modules (see Email search), without their sources tally; query is the address as it was searched, cost is always 1. Each item of results has source, label and data:

{
  "source": "location",
  "label": "Location",
  "data": {
    "found": true,
    "rows": [
      {
        "label": "Location",
        "value": "Mountain View, California, United States"
      },
      {
        "label": "Coordinates",
        "value": "37.404, -122.0844 (city-level answers within 67 km)"
      },
      {
        "label": "Agreement",
        "value": "9 of 9 services say United States; 7 say Mountain View"
      },
      {
        "label": "Timezone",
        "value": "America/Los_Angeles"
      },
      {
        "label": "Anycast",
        "value": "Yes: the same address answers from many places; the location is only one of them"
      }
    ],
    "lists": [
      {
        "label": "Geolocation services",
        "items": [
          "ipinfo.io: Mountain View, California, US (38.0088, -122.1175)",
          "ipwho.is: San Jose, California, US (37.3394, -121.895)",
          "IPLocate: Mountain View, California, US (37.386, -122.0838)"
        ]
      }
    ],
    "details": {
      "ip": "8.8.8.8",
      "version": 4,
      "consensus": {
        "country": "United States",
        "country_code": "US",
        "region": "California",
        "city": "Mountain View",
        "postal": "94043",
        "latitude": 37.404,
        "longitude": -122.0844,
        "timezone": "America/Los_Angeles",
        "continent": "North America",
        "agreement": {
          "country": 9,
          "city": 7,
          "of": 9
        },
        "spread_km": 67
      },
      "providers": [
        { "id": "ipinfo", "name": "ipinfo.io", "country": "United States", "country_code": "US", "region": "California", "city": "Mountain View", "postal": "94043", "latitude": 38.0088, "longitude": -122.1175, "timezone": "America/Los_Angeles" },
        { "id": "ipwho", "name": "ipwho.is", "country": "United States", "country_code": "US", "region": "California", "city": "San Jose", "postal": "95025", "latitude": 37.3394, "longitude": -121.895, "timezone": "America/Los_Angeles" },
        { "id": "iplocate", "name": "IPLocate", "country": "United States", "country_code": "US", "region": "California", "city": "Mountain View", "postal": "94035", "latitude": 37.386, "longitude": -122.0838, "timezone": "America/Los_Angeles" }
      ],
      "anycast": true
    }
  }
}

rows and lists read like the other modules’ results. details is what to use in code. Its fields, by source (any of them can be missing or null, any list can be empty):

`source`	`details`
`location`	`ip`, `version` (`4` or `6`), `consensus` (`country`, `country_code`, `region`, `city`, `postal`, `latitude`, `longitude`, `timezone`, `continent`, `agreement`: how many services agree, `country`, `city` and `of`, `spread_km`: the largest distance, in km, from the consensus point to a city-level answer in the consensus country; answers that give only the country and answers in other countries are not counted, `agreement` counts them; `null` when there is no such answer), `providers[]` (one per geolocation service that answered: `id`, `name`, `country`, `country_code`, `region`, `city`, `postal`, `latitude`, `longitude`, `timezone`), `anycast`.
`network`	`ip`, `version`, `prefix`, `asn` (`number`, `name`, `holder`, `domain`, `type`, `country_code`, `rir`), `operator` (`provider`, `kind`: `cdn`, `cloud`, `hosting`, `isp`, `business` or `other`), `company` (`name`, `domain`, `type`, `country_code`), `hosting` (`provider`, `domain`, `network`), `announced`, `first_seen` and `last_seen` (`time`, `prefix`, `origin`), `visibility` (`seeing`, `total`: the route collectors that see the prefix), `neighbours` (`upstreams`, `downstreams`, `total`), `upstreams[]` (`asn`, `name`, up to 10, strongest first), `block` (`resource`, `name`, `desc`), `related_prefixes[]`, `rpki` (the RPKI validity of the announcement, see Routing: `null` when it could not be checked; else `status`: `valid`, `invalid`, `invalid_asn` (signed for another network), `invalid_length` (signed for a shorter prefix), `unknown` or `not_found` (not signed)…, and `roas[]`: the signed routes (ROAs) for the prefix, `origin`: the network a ROA authorises, `prefix`, `max_length`: the longest prefix it allows), `origin_history[]` (`null` when RIPEstat did not answer; else the networks that announced a prefix containing the address over the last 3 years, one entry per network and relation, latest announcement first, up to 15: `asn`, `relation`: that prefix next to the one announced now, `exact`, `more_specific` (narrower), `less_specific` (a wider, covering prefix) or `null` when no prefix is known, `prefixes[]` (up to 20), `first` and `last`: its first and last announcement (ISO 8601), `current`: still announced), `asn_prefixes` (the prefixes the network announces now: `v4` and `v6`, how many, and `sample[]`, up to 50 of them, IPv4 first, widest first).
`whois`	`source` (`rdap` or `ripestat`), `rir`, `handle`, `name`, `type`, `range` (`start`, `end`), `cidr[]`, `country`, `parent`, `created`, `updated` (ISO 8601), `organization` (`name`, `address`, `country`), `contacts[]` (`role`, `name`, `org`, `email`, `phone`, `address`), `abuse` (`name`, `email`, `phone`), `remarks[]`.
`dns`	`ptr[]`, `forward_confirmed` (the PTR names point back to the address), `hostnames[]` (`name`, `sources[]`), `domains[]` (`name`, `sources[]`), `domains_count`, `sources[]` (`id`, `label`, `ok`, `count`, `error`), `history[]` (the names seen pointing to the address in passive DNS, see DNS history, latest `last_seen` first, up to 500: `name`, `type`: the record type, like `A`, `AAAA` or `PTR`, `first_seen` and `last_seen` (`YYYY-MM-DD`), `times`: how many times Mnemonic saw it, `null` when only AlienVault OTX did, `sources[]`: `Mnemonic`, `AlienVault OTX` or both), `history_count` (how many names in all, before the cut at 500), `history_sources[]` (`id`: `mnemonic` or `otx_pdns`, `label`, `ok`, `count`: the names it gave, `error` when `ok` is `false`).
`services`	`ports[]`, `ports_known` (`false` when Shodan could not be reached: `ports` is then empty because nobody checked, not because no port is open), `shodan_error` (why Shodan failed, a short code like `timeout` or `http_503`, when `ports_known` is `false`; `null` otherwise), `services[]` (`port`, `name`: from the well-known ports, like `SSH`, `HTTPS`, `RDP` or `Tor ORPort`, `null` when unknown), `software[]` (`cpe`, `vendor`, `product`, `version`), `tags[]`, `vulns[]` (the known vulnerabilities, most dangerous first, see Vulnerabilities: `id`, `url`: its NVD page, `summary`, `cvss`: the CVSS base score from 0 to 10, `cvss_version`: `2`, `3`, `3.1` or `4`, `severity`: `critical` from 9, `high` from 7, `medium` from 4, `low` above 0, `none` at 0, `null` without a score, `epss`: the probability, from 0 to 1, that it is exploited in the next 30 days, `epss_rank`: its percentile among all CVEs, from 0 to 1, `kev`: `true` when it is in CISA’s Known Exploited Vulnerabilities catalog, `ransomware`: `Known` when CISA knows of ransomware campaigns using it, `Unknown` when it does not, `null` outside the catalog, `action`: what CISA requires for a catalog entry, `published`: `YYYY-MM-DD`, `references[]`: up to 5 links), `vuln_summary` (`null` without vulnerabilities; else `total`, `described`: how many have details, `critical`, `high`, `medium`, `low`, `none`, `unknown`: how many in each severity, `unknown` counting those without a score, `kev`: how many are exploited in the wild, `ransomware`: how many are known to be used by ransomware campaigns, `top_epss`: the highest `epss`, `null` when none is known), `hostnames[]`, `http[]` (`url`, `status`, `server`, `title`, `location`), `certificate` (`null` when no certificate could be read; else `ok`, `subject`, `issuer`, `names[]`, `valid_from`, `valid_to`, `error`: the TLS error code when `ok` is `false`, and `problem`: why the certificate is not trusted for this address, in plain words: `issued for other names`, `expired`, `not valid yet`, `self-signed`, `unknown issuer`, `revoked` or `could not be verified`; `null` when `ok` is `true`).
`reputation`	`verdict` (`level`: `clean`, `suspicious`, `malicious` or `unknown`, `reasons[]`), `flags` (`vpn`, `proxy`, `tor`, `hosting`, `anonymous`, `abuser`, `scanner`: `true`, `false` or `null` when not known), `greynoise` (`noise`, `riot`, `classification`, `name`, `last_seen`, `link`), `proxycheck` (`proxy`, `type`, `provider`), `tor` (`exit`, `relay`: `nickname`, `fingerprint`, `flags[]`, `running`, `first_seen`, `last_seen`, `contact`, `platform`), `threat_intel` (`pulses`, `names[]`, `malware[]`, `allowlisted[]`), `blocklists[]` (`zone`, `name`, `listed`: `null` when the list refused or did not answer, `answer`), `sources[]` (`id`, `ok`, `error`), `threat_lists[]` (see Threat lists; one per list, in this order: `spamhaus_drop`, `firehol_level1`, `firehol_level2`, `firehol_level3`, `feodo`, `et_compromised`, `cins`, `blocklist_de`, `greensnow`, `dshield`, `ipsum`, only `spamhaus_drop` and `blocklist_de` for an IPv6 address: `id`, `name`, `listed`: `true`, `false` or `null` when the list could not be read, `detail`: what the list says of the address when it is on it, like `SBL256894` (Spamhaus DROP), `QakBot C2, port 443, online, last online 2026-10-07` (Feodo Tracker), `354 attacks over 3 days · HURRICANE (US)` (DShield) or `on 4 blacklists` (IPsum), `null` otherwise, `url`: the address’s page on the list when it is listed there (Feodo Tracker, blocklist.de, GreenSnow, DShield), else the list’s page, `updated`: when Orelys downloaded the copy it read (ISO 8601)), `threat_lists_summary` (`checked`: how many lists could be read, `listed`: how many carry the address, `ipsum_count`: on how many public blacklists IPsum sees it, `0` when none, `null` when IPsum could not be read or for an IPv6 address).

Results are untrusted text published by third parties: host names, page titles, WHOIS remarks, certificates, vulnerability summaries and references. Show them as text, never as HTML, and do not follow their links automatically.

Vulnerabilities

services.vulns lists the CVEs Shodan matched to the software versions its scans saw on the address. Their details come from Shodan CVEDB, and they come most dangerous first: those in the KEV catalog, then by CVSS score, then by EPSS, then the newest.

CVSS rates how severe a vulnerability is, from 0 to 10; severity is its band.
EPSS is the probability, from 0 to 1, that the vulnerability is exploited somewhere in the next 30 days.
KEV is CISA’s catalog of vulnerabilities known to be exploited in the wild: kev: true is the strongest reason to act.

A match is not proof that the address can be exploited: Shodan matches on version numbers, and a server can run a patched build (Linux distributions often fix a flaw without changing the version) or not use the vulnerable feature. Read the list as leads to check. Up to 200 CVEs are described in a search, the newest; the others, and those CVEDB does not know or could not give in time, keep only id and url: their other fields are null, and vuln_summary counts them in unknown, not in described.

Threat lists

reputation.threat_lists looks the address up in 11 public lists of hostile addresses:

Spamhaus DROP: networks hijacked or run by cybercriminals, that nobody should route.
FireHOL level 1, 2 and 3: aggregates of many public lists. Level 1 is safe to block outright (attackers, botnet servers, hijacked networks); level 2 adds the addresses that attacked in the last 2 days, level 3 those of the last 30 days, with more false positives.
Feodo Tracker (abuse.ch): botnet command-and-control (C2) servers, with the malware, port and status.
Emerging Threats (Proofpoint): hosts known to be compromised.
CINS Army (Sentinel IPS): addresses with a poor score on its network of sensors.
blocklist.de: addresses reported for attacks on servers (SSH, mail, FTP, web logins) in the last 2 days.
GreenSnow: addresses seen scanning or brute-forcing its sensors.
DShield (SANS Internet Storm Center): the 20 networks (/24) that attacked the most over the last 3 days.
IPsum: how many of more than 30 public blacklists carry the address (ipsum_count).

Orelys downloads each list whole and keeps the copy for an hour, then looks the address up in its own copy: the address you search is never sent to the lists. updated says when the copy was downloaded; a list that could not be read is listed: null, never a failure of the source. An IPv6 address is only checked on Spamhaus DROP and blocklist.de: the other lists carry IPv4 addresses only. On Spamhaus DROP, Feodo Tracker or FireHOL level 1, the verdict is malicious. On any other list, or on 3 public blacklists or more according to IPsum, it is at least suspicious; fewer IPsum blacklists are only noted in reasons.

Routing

network.rpki says whether the route to the address is signed. In RPKI, the holder of an address block publishes signed records (ROAs) saying which network may announce it, and up to which prefix length:

valid: a ROA authorises the network that announces the prefix: the route is the one the holder signed.
invalid (invalid_asn, invalid_length): the block is signed, but for another network or a shorter prefix: a mistake, or a hijack.
unknown or not_found: no ROA covers the prefix: the route is not signed, which proves nothing either way.

network.origin_history lists the networks (ASN) that announced a prefix containing the address over the last 3 years, as the RIPE RIS route collectors saw them. One origin all along is the usual case. An origin that changes over time can mean a transfer (the block was sold, or moved to another network) or a hijack: a short announcement by an unrelated network, above all of a narrower more_specific prefix, is its classic sign. less_specific entries are wider prefixes that also cover the address, like a transit provider’s aggregate.

DNS history

dns.history lists the names seen pointing to the address over time, from the passive DNS of Mnemonic and AlienVault OTX: they record the DNS answers they see, so each name comes with the day it was first seen on the address (first_seen) and the last (last_seen). Where domains shows what reverse-IP services see on the address now, the history shows who used it before: a name last seen years ago has most likely moved. The latest come first, up to 500; history_count says how many names the sources know.

Cost and limits

1 credit a search, always, never from your daily quota: every source is asked in every search. When no source finds anything, the credit is given back within the daily allowance. Invalid input costs nothing. See Credits and Limits.

Errors

Status	Code	When
`400`	`invalid_request`	`ip` is missing or is not one public IP address, or a field is unknown. `details` says why. Nothing is charged.
`401`	`missing_api_key`, `invalid_api_key`	No key was sent, or it is not a valid one.
`402`	`insufficient_credits`	Your balance is 0: a search costs 1 credit.
`403`	`plan_required`, `account_blocked`	The account is not on Professional or Enterprise, or it is blocked.
`429`	`rate_limited`, `concurrency_limited`, `ip_rate_limited`	A limit is reached. Wait `Retry-After` seconds.
`502`	`sources_unavailable`	Not one source could be reached. The credits are always given back.
`503`	`module_maintenance`, `module_offline`	The Orelys team has paused this module, or all of Orelys OSINT. Nothing is charged.

How Orelys looks

Every source is passive or public: geolocation services, the regional registries (RDAP), routing data, passive DNS and reverse DNS, public scan data, reputation services, the Tor relay list, DNS blocklists and public threat lists (downloaded whole: the address is never sent to them). Nothing is scanned and no port is probed: the open ports come from scans others already ran. The one exception is a visit of the address itself, like a browser would: its home page over HTTPS or HTTP, and the TLS certificate it serves. That visit can show in the server’s logs. The requests leave from Orelys’ network, never from yours.

Tips

Pivot on the domains. Each name in dns.domains, dns.hostnames and dns.history goes straight to Domain search. On a shared host there can be thousands: domains_count says how many the sources know.
Report abuse to the abuse contact. whois.abuse is the contact the address’s registry lists for abuse reports: the place to report an attack, spam or a phishing site on the address.
Read the flags as hints. tor: true means the address is a Tor relay; with tor.exit: true, Tor users’ traffic leaves the Tor network there, so the relay’s operator is not the person behind a connection from it. vpn, proxy and hosting point to an address many people share. The flags come from public lists that can be late; null means not known.
Geolocation is an estimate. Each service guesses from its own data, and they often disagree: compare location.providers. consensus.agreement says how many agree on the country and the city, spread_km how far the farthest city-level answer in that country is from the agreed point (answers in other countries show in providers). A home or mobile address usually points to the operator’s nearest hub, never to a street address.
Anycast addresses have no single place. An anycast address (public DNS resolvers, CDNs) is answered from many data centers at once: anycast is true, and its location is at best the holder’s.

Reference

Request and response schemas, every error, and a playground to try it.

Get started

Essentials

Intelligence X

OSINT

Data breaches

Privacy

IP search

Request

What you get back

Vulnerabilities

Threat lists

Routing

DNS history

Cost and limits

Errors

How Orelys looks

Tips

Reference

IP search

​Request

​What you get back

​Vulnerabilities

​Threat lists

​Routing

​DNS history

​Cost and limits

​Errors

​How Orelys looks

​Tips

​Reference

IP search

Request

What you get back

Vulnerabilities

Threat lists

Routing

DNS history

Cost and limits

Errors

How Orelys looks

Tips

Reference