Free Tool
IP Threat Intelligence Lookup
Enter any IP address to check if it has been observed in DDoS attacks across Flowtriq's global sensor network. All data is anonymized and aggregated.
5 free lookups per day — sign up for unlimited access
Querying threat intelligence database...
Daily Lookup Limit Reached
You've used all 5 free lookups for today. Create a free account to get unlimited IP threat lookups plus full access to our detection platform.
Start Free TrialNo Threats Found
This IP address has not been observed in any DDoS attacks in our database. This is a good sign, but does not guarantee the IP is safe.
IP Details
Attack Types
Severity Distribution
Protocol Breakdown
Monthly Attack Trend
How the IP Threat Lookup Works
Flowtriq's IP Threat Intelligence Lookup queries our global sensor network to determine whether an IP address has been involved in DDoS attacks. Our sensors monitor traffic across hundreds of networks, building a real-time picture of attack activity across the internet.
For each IP address, we provide:
- Risk score: A 0-100 score based on attack frequency, severity, and recency of observed malicious activity.
- Attack history: Anonymized records of DDoS incidents where this IP was identified as a source, including attack type, severity, and duration.
- Threat intel matches: Cross-references against known botnets, DDoS tools, and malware command-and-control infrastructure.
- IOC signatures: Indicator of Compromise pattern matches including known attack tool fingerprints (Mirai, LOIC, etc.).
- Related IPs: Other IP addresses frequently observed participating in the same attack campaigns.
- Traffic trends: Monthly attack activity trends to help you understand if an IP is currently active or historically flagged.
Common Use Cases
Security teams use IP threat lookups to investigate suspicious traffic, validate firewall rules, research attack sources during incident response, and build blocklists. ISPs use them to identify compromised hosts on their networks. Researchers use them to track botnet infrastructure and DDoS-for-hire services.
All data returned is anonymized. We never reveal which organizations were targeted or any customer-specific information. Only aggregated, cross-tenant intelligence is shown.
Threat Intelligence Deep Dive
Go beyond the basic lookup with advanced threat context.
An IP's ASN (Autonomous System Number) tells you about its neighborhood. ASNs with high abuse rates are more likely to host malicious traffic. Check if the IP's ASN appears in Spamhaus DROP/EDROP lists or has a history of hosting botnets.
If one IP from a /24 subnet is attacking you, there is a 40% chance another IP from the same subnet will too. Enumerate the full /24 and cross-reference with your firewall logs. This is especially relevant for botnet traffic where compromised hosts cluster by ISP.
IPs that have participated in DDoS attacks have a 70% probability of being used again within 30 days. If this IP shows abuse history, consider preemptive blocking or rate limiting for the entire /24.
High threat: Block the /24 at your edge firewall or via BGP FlowSpec
Medium threat: Rate limit traffic from this IP/subnet to 100 PPS
Low threat: Monitor in your IDS/IPS, no immediate action needed
FAQ