IP Threat Intelligence Lookup

How the IP Threat Lookup Works

Flowtriq's IP Threat Intelligence Lookup queries our global sensor network to determine whether an IP address has been involved in DDoS attacks. Our sensors monitor traffic across hundreds of networks, building a real-time picture of attack activity across the internet.

For each IP address, we provide:

• Risk score: A 0-100 score based on attack frequency, severity, and recency of observed malicious activity.
• Attack history: Anonymized records of DDoS incidents where this IP was identified as a source, including attack type, severity, and duration.
• Threat intel matches: Cross-references against known botnets, DDoS tools, and malware command-and-control infrastructure.
• IOC signatures: Indicator of Compromise pattern matches including known attack tool fingerprints (Mirai, LOIC, etc.).
• Related IPs: Other IP addresses frequently observed participating in the same attack campaigns.
• Traffic trends: Monthly attack activity trends to help you understand if an IP is currently active or historically flagged.

Common Use Cases

Security teams use IP threat lookups to investigate suspicious traffic, validate firewall rules, research attack sources during incident response, and build blocklists. ISPs use them to identify compromised hosts on their networks. Researchers use them to track botnet infrastructure and DDoS-for-hire services.

All data returned is anonymized. We never reveal which organizations were targeted or any customer-specific information. Only aggregated, cross-tenant intelligence is shown.