IP-DBthreat intelligence

EST. 2026 · ISTANBUL

WE ARE IP-DB

We watch the addresses that attack the internet, and we give what we learn away. No seats, no sales call, no card.

0addresses tracked
0independent sources
0countries

01 — THE CORPUS

0

attacking addresses, in one place

Forty-four independent feeds, our own sensors and every report our members file, merged into one record per address — scored, dated and explained. 203 countries are represented. The whole set is queryable, free, and downloadable as a blocklist.

  • 44 sources reconciled, never a single vendor's word
  • 9,651 addresses in the free blocklist right now
  • hourly refresh, with every source's own licence respected

02 — THE DECOYS

0

attacks on our own traps, last seven days

Anyone can run an IP-DB sensor. It opens services an attacker expects to find — Exchange, FortiGate, Citrix, databases — and reports who knocks. 9,729 distinct addresses tried in the last week, and every confirmed one enters the shared blocklist that protects everybody else.

  • open source — it never runs as root and never stores a password tried against it
  • consensus — an address is published once separate operators see it
  • free — running one lifts your own API quota, nothing else changes hands

03 — THE TRACKER

0

vulnerability records, watched by version

CVE.org, NVD, CISA KEV, EPSS and vendor notices, reconciled hourly. Tell it the versions you run and it writes to you only when you are genuinely affected — 1,768 of these records are under active exploitation right now.

  • version-aware — "7.4.3 is affected, 7.4.5 is not", not "FortiOS has a CVE"
  • plain language — every alert says what an attacker can actually do
  • your channel — email, Telegram, or both

04 — IN THE FIELD

What the network looks like
from your side.

Five ways in. One of them is a command, one of them is a plugin, and the rest arrive while you are doing something else.

Inbox — you
IP IP-DB Alertsalerts@ip-db.com · just now High

🔴 CVE-2026-119977 · CVSS 8.1 · WordPress

You are running an affected version. Your watch list matched this record the hour it was published.

watchingWordPress7.1.0 – ≤ 7.1.3

Race condition — the gap between check and use can be exploited

Over the network, without logging in · CISA deadline 6 Nov

Open the record →

01

The mail that arrives before the exploit does.

Tell us the products and the versions you run. We read CVE.org, NVD, CISA KEV, EPSS and the vendor notices every hour, and write to you only when a record actually touches your estate — with one sentence saying what an attacker can do with it.

  • Version-aware: 7.4.3 affected, 7.4.5 not — never "your vendor had a CVE"
  • Severity floor, KEV-only mode and a quiet-hours window, all yours to set
IPIP-DB CVE Alertsbot · online
🔴 CVE-2026-119977
CVSS 8.1 · CISA KEV
WordPress
🛠 Patch now
/kev
Exploited in the wild, last 7 days:
6 records · tap for the list

02

On your phone, the minute it turns urgent.

Link the bot once from your panel and the same alerts arrive on Telegram — and you can ask it things: the latest records, what is under active exploitation, a single CVE, the products you follow. Email and Telegram are separate switches; keep one, keep both.

  • It reads nothing. It only sees the commands you send it
  • /stop ends it instantly, from the chat, with no login
root@edge-01 — sensor

curl -fsSL https://ip-db.com/sensor.sh | sh

✓ registered · 64 decoy profiles armed

→ 45.9.148.xx  exploit:cve-2024-4577

→ 194.26.29.xx login:fortigate

→ 103.145.13.xx probe:payload

↑ 3 addresses reported · confirmed by 2 other operators

03

Your spare ports, turned into a sensor.

One command puts convincing decoys on ports you do not use — Exchange, FortiGate, GlobalProtect, Citrix, databases. An attacker sees a real login page; you see who knocked, from where, and which exploit they tried.

  • Never runs as root, never executes anything, never stores a password tried against it
  • An address is published only once separate operators see it
https://yoursite.com
185.220.101.xxrefused 45.141.215.xxrefused your readerserved
0 addresses your gate is refusing right now

04

They never reach your application.

IP-DB Shield is a drop-in gate for your own site. Every request is checked against the corpus before your code runs: known attackers are turned away, everyone else never knows it is there. Fails open by design — if we are unreachable, your site still serves.

  • Cached locally, so the check costs you no round trip
  • Running one lifts your own quota — the network pays its contributors back
yoursite.com

IP-DB Shield

Protection
Blocked this week0

Comment spam, login brute force and scanners — refused before WordPress loads.

05

Two clicks inside WordPress.

The plugin brings the same gate to the most attacked software on the internet. Install, paste a key, done — and the dashboard shows exactly what was refused and why, in your own language.

  • Works with any cache or firewall you already run
  • Blocked attempts feed back into the corpus — your site defends everyone else's

Every sensor makes every other member safer. That is the whole design: the people being attacked are the ones holding the data, so the network belongs to them. Join it with one command, one plugin or one API key — and from that moment you are reading the same intelligence we are.

  • 0addresses in the shared corpus
  • 0attacks absorbed by the decoys this week
  • 0countries represented

05 — TOOLING

Built for the person on call

REST API

One address, one JSON answer: score, categories, geography, abuse contact. Free tier, no card.

Open →

Blocklist feed

Snapshot-backed, four formats, ETag-aware. Point your firewall at it and forget it.

Open →

Honeypot sensor

A decoy network you can join in one command, and read the results of in your panel.

Open →

IP-DB Shield

A drop-in gate for your own site: known attackers never reach your application.

Open →

CVE tracker

Version-aware alerts by email and Telegram, plus a public weekly bulletin.

Open →

WHOIS & maps

Domain WHOIS, RDAP, live threat maps — the context around an address.

Open →

06 — THE POINT

Threat data gets sold back to the people who generated it. We think an address that attacked you is yours to know about. So everything here is free — the lookups, the feed, the sensors, the alerts — and the sources are named, because intelligence you cannot audit is just a rumour.
IP-DBip-db.com

Start in two minutes.

Look up an address without an account. Create one when you want the API, the sensors or the alerts. It stays free either way.

Look up an address Create a free account Follow @iddbcom

Figures on this page are read from the live database and refresh every ten minutes. Last read: 01 Jan 1970 02:00 (Istanbul).