# IP Insights — llms.txt
# https://ipinsights.io
# This file helps AI systems (Claude, ChatGPT, etc.) understand and navigate this site.

## About

IP Insights (ipinsights.io) is a free, non-commercial IP threat intelligence and enrichment service. It provides instant lookup of any public IP address with geolocation, ISP details, Autonomous System information, blacklist status and a calculated threat score. The platform aggregates data from 73 honeypots, tarpits and deception devices, cross-referenced with 22+ open-source threat intelligence feeds and major blocklists.

Built and maintained by Peter Bassill, supported by UK Cyber Defence Ltd (https://www.cyber-defence.io).

## Key Features

- **IP Lookup**: Full enrichment for any public IPv4 or IPv6 address including geolocation, ISP, AS data and threat scoring. The home page leads with the lookup and the visitor's own IP is pre-filled.
- **Per-IP and Per-ASN Landing Pages**: Canonical, indexable pages at `/ip/{ip}` and `/asn/{asn}` with structured data, plus dynamic sitemaps so long-tail queries are crawlable.
- **Threat Intelligence Dashboard**: Visual analytics of IP threat data across countries, categories and risk levels, with a narrative layer (week-over-week trend, ASN/ISP league table, propagation feed, embeddable badges, opt-in weekly digest).
- **AI Agent Assessment**: Detection and classification of agentic LLM attack traffic across four signal families with confidence bands (`unlikely`, `possible`, `probable`, `confirmed`). Surfaced on every lookup as an additive `ai_agent_assessment` block.
- **Prompt-Injection Corpus**: Browsable, paginated catalogue of anonymised injection payloads observed in the wild, with TXT and STIX 2.1 downloads refreshed every four hours.
- **Campaign Tracker**: Automated clustering of IPs into coordinated attack campaigns using behavioural, temporal, and infrastructure signals.
- **Network Map**: Interactive graph visualisation of threats grouped by Autonomous System with drill-down and filtering.
- **Listing Provenance & Delisting**: Per-IP provenance card on every report (source, category, first-listed/last-updated, active vs. degrading) and a public delisting workflow.
- **Community Voting**: Authenticated users can flag IPs as malicious or clean, factored into threat scoring.
- **Blog**: Threat intelligence articles and automated weekly threat landscape reports.
- **Temporal Analysis**: Time-of-day attack heatmaps, campaign detection signals, and IP lifespan drift analytics.
- **Blocklist Downloads**: Downloadable threat lists in TXT, CSV, iptables, UFW, JSON, Cisco ACL and STIX 2.1 formats, updated every 4 hours.
- **TAXII 2.1 & MISP Feeds**: STIX 2.1 content exposed through a TAXII 2.1 polling server (`/taxii2/`) and a MISP-compatible feed manifest (`/downloads/misp/manifest.json`).
- **Free REST API**: OpenAPI 3.1 spec, interactive Swagger UI, single/bulk lookup, unauthenticated teaser endpoint and a bidirectional `POST /api/v1/report` endpoint.
- **Official Client Libraries**: Thin reference clients for Python, Go, Node.js and PowerShell, downloadable directly from the site as self-contained `.zip` archives.
- **Integration Guides**: Step-by-step recipes for SIEMs (Wazuh, Graylog, Sentinel, Splunk), firewalls/WAFs (pfSense, OPNsense, Suricata, nginx, Cloudflare WAF), automation (n8n, Cloudflare Workers, Home Assistant), collaborative defence (fail2ban, CrowdSec) and IR tooling (TheHive).
- **Threat Reports**: High-risk ISP and country-level threat analysis reports, plus a quarterly "State of Agentic Attack Traffic" report.
- **Pricing & Tiers**: Optional Pro and MSSP tiers alongside the free Community tier (which remains the anchor).
- **Attack Surface Monitoring (ASM)**: Continuous monitoring of IPs, CIDR ranges, and domains with automated vulnerability detection (optional module).

## Pages

- [Home / Dashboard](https://ipinsights.io/): Lookup-first front door with global IP threat analytics and the visitor's IP pre-filled.
- [IP Lookup](https://ipinsights.io/search.php): Search any IP address for instant enrichment and threat assessment.
- [Per-IP Page](https://ipinsights.io/ip/8.8.8.8): Canonical, indexable landing page for any individual IP address.
- [Per-ASN Page](https://ipinsights.io/asn/15169): Canonical, indexable landing page for any Autonomous System.
- [Reports](https://ipinsights.io/reports.php): IP threat intelligence reports with temporal analysis (requires login).
- [Campaign Tracker](https://ipinsights.io/campaign-tracker.php): View coordinated attack campaigns detected from blacklist data (requires login).
- [Network Map](https://ipinsights.io/network-map.php): Interactive graph visualisation of threats grouped by Autonomous System.
- [Blog](https://ipinsights.io/blog.php): Threat intelligence articles and weekly threat landscape reports.
- [API Documentation](https://ipinsights.io/docs.php): REST API docs for integrating IP threat intelligence into applications.
- [Interactive Swagger UI](https://ipinsights.io/api/docs): Try API requests in the browser against the OpenAPI 3.1 spec.
- [Official Client Libraries](https://ipinsights.io/clients.php): Download Python, Go, Node.js and PowerShell clients as self-contained `.zip` archives.
- [Integration Guide](https://ipinsights.io/integrations.php): Step-by-step guides for integrating with security tools and SIEM platforms.
- [Blocklist Downloads](https://ipinsights.io/blocklist.php): Download IP blocklists in multiple formats.
- [Prompt-Injection Corpus](https://ipinsights.io/prompt-injection-corpus.php): Browsable catalogue of anonymised injection payloads.
- [State of Agentic Attack Traffic](https://ipinsights.io/state-of-agentic-traffic.php): Quarterly report on agentic LLM attack traffic.
- [Pricing & Tiers](https://ipinsights.io/pricing.php): Community / Pro / MSSP tier comparison.
- [Delisting Workflow](https://ipinsights.io/delisting.php): Public process for requesting an IP delisting.
- [About](https://ipinsights.io/about.php): About the project and its creator.
- [Methodology](https://ipinsights.io/methodology.php): How threat scores, risk assessments and AI agent detection are calculated.
- [Changelog](https://ipinsights.io/changelog.php): Platform version history and release notes.
- [Status](https://ipinsights.io/status.php): System status and uptime information.
- [Support](https://ipinsights.io/support.php): Contact support for questions or issues.
- [Security Review](https://ipinsights.io/security-review.php): Security audit findings and recommendations.
- [Register](https://ipinsights.io/register.php): Create a free account to get an API key.
- [Login](https://ipinsights.io/login.php): Log in to access your account and API key.

## API

The REST API is described by an OpenAPI 3.1 specification at `https://ipinsights.io/api/v1/openapi.json` and browsable interactively at `https://ipinsights.io/api/docs`. Authenticated endpoints require an API key via the `X-API-Key` header. Free tier allows 100 API requests per hour per key, 30 web lookups per hour per IP, and 10 teaser requests per hour per IP (no key required). Registered users can request higher API limits, which are reviewed and approved on a case-by-case basis. Register for a free account to obtain a key.

### Endpoints

- **Single Lookup**: `GET /api/v1/lookup?ip={address}` — Enrich a single IP address.
- **Bulk Lookup**: `POST /api/v1/bulk-lookup` — Enrich up to 100 IP addresses in one request. Send a JSON body with `{"ips":["1.2.3.4","5.6.7.8"]}`.
- **Teaser**: `GET /api/v1/teaser?ip={address}` — Unauthenticated zero-friction evaluation lookup with a tight per-IP rate limit.
- **Report**: `POST /api/v1/report` — Submit observed attackers back to the platform with category tags. Weighted by submitter reputation; shares the per-user lookup quota.
- **Recent Malicious IPs**: `GET /api/v1/recent-malicious-ips.php` — Short-poll JSON feed of the most recently observed malicious IPs (IP, country flag, category, threat score, first/last seen). Powers the live feed promoted onto the homepage; unauthenticated, rate-limited per source IP, cached 60s.
- **OpenAPI Spec**: `GET /api/v1/openapi.json` — OpenAPI 3.1 description of the API.
- **TAXII 2.1**: `GET /taxii2/` — TAXII 2.1 polling server exposing the STIX 2.1 content.
- **MISP Feed**: `GET /downloads/misp/manifest.json` — MISP-compatible feed manifest.

### Official Client Libraries

Thin reference clients for the REST API are downloadable as self-contained `.zip` archives directly from `https://ipinsights.io/clients.php`:

- Python (PyPI: `ipinsights`) — `https://ipinsights.io/clients-download.php?lang=python`
- Go (module: `ipinsights`) — `https://ipinsights.io/clients-download.php?lang=go`
- Node.js (npm: `@ipinsights/client`) — `https://ipinsights.io/clients-download.php?lang=nodejs`
- PowerShell (Gallery: `IPInsights`) — `https://ipinsights.io/clients-download.php?lang=powershell`

### Example Request

```
curl -H "X-API-Key: your_api_key" "https://ipinsights.io/api/v1/lookup?ip=8.8.8.8"
```

### Response Fields

The API returns: ip, ip_version, country_code, country_name, region_name, city, latitude, longitude, timezone, isp, org, as_number, as_name, is_tor, is_proxy, is_datacenter, blacklists (array), threat_assessment (score 0-100, level, reasons), and ai_agent_assessment (score 0-100, confidence band, per-signal evidence, methodology version).