IP Intelligence Search | Global IP Lookup

image.png

The platform available at https://dash.niamonx.io/global_iplookup — known as IP Intelligence Search (Global IP Lookup) — is a global IP intelligence and infrastructure analysis tool within the NiamonX platform. It allows users to search detailed information about IPv4 and IPv6 addresses using the NiamonX Crawler database catalog and receive structured data about geolocation, ASN, organization, ISP, open ports, services, hostnames, domains, vulnerabilities, fingerprints, and raw service metadata.

Overview of the Service

IP Intelligence Search (Global IP Lookup) is designed for analysts, SOC teams, cybersecurity researchers, incident responders, infrastructure owners, and OSINT specialists who need to understand what is publicly observable about a specific IP address.

The tool provides a consolidated view of an IP address from a global crawler database. It can show the IP’s network ownership, ASN, organization, ISP, country, region, city, coordinates, related hostnames, associated domains, exposed ports, detected products, service banners, HTTP metadata, SSL-related data when available, vulnerability aggregation, CVSS scoring, tags, labels, and raw JSON for deeper inspection.

The module accepts only IP addresses. Domains, URLs, paths, and search operators are not valid inputs.

🔍 How the Search Works

When a user enters an IPv4 or IPv6 address, the tool queries the global crawler database catalog and returns the available record for that IP.

The returned information may include:

The tool displays general information first, then provides a detailed services and ports table. Large service responses are rendered lazily, meaning details are shown only when the user expands a specific service row. This reduces browser and DOM load, especially for IPs with many open services.

Global IP Lookup supports:

Valid examples:

1.1.1.1

8.8.8.8

2001:4860:4860::8888

Unsupported inputs:

example.com

https://example.com

example.com/login

1.1.1.1:443

The tool expects only a clean IPv4 or IPv6 value.

⚙️ Search Interface

The interface contains the main input and optional historical data setting.

IP Address

The main field where the user enters an IPv4 or IPv6 address.

Example:

1.1.1.1

The interface clearly states:

Only IPv4 or IPv6. No domains or URLs.

Historical Data

The Historical Data option allows the server to return archival information when supported.

Historical layers may include older observations, previous ports, older banners, previous technologies, or past service states.

Important: historical data is returned only when available and supported by the backend.

📊 General Information

After a successful lookup, the tool displays a general information panel for the IP address.

Possible fields include:

Field Description
IP Queried IPv4 or IPv6 address
ASN Autonomous System Number
Organization Network owner or responsible organization
ISP Internet Service Provider
Country Country and country code
Region / City Geographic region and city
Coordinates Latitude and longitude
Ports Number of observed ports
Services Number of service records
Hosts Number of hostnames
Domains Number of related domains
Tags Number of tags or labels

Example structure:

IP: 1.1.1.1
ASN: AS13335
Organization: Example Network Project
ISP: Example ISP
Country: Australia (AU)
Region / City: QLD / Brisbane
Coordinates: -27.48159, 153.0175
Ports: 11
Services: 12
Vulns: 0

This section gives users a quick operational overview of the IP address before reviewing individual services.

🗺️ Geolocation and Map

The tool includes a geolocation map powered by Leaflet and OpenStreetMap.

The map displays the approximate location of the IP address based on geolocation data returned by the crawler database.

Possible location fields:

Important interpretation notes:

Geolocation should be used as context, not as precise physical attribution.

🏷️ Tags and Labels

The tool can display tags and labels returned by the crawler database.

Examples of possible tags:

If no tags are returned, the interface may display:

No

Tags help analysts quickly classify the IP, but they should be treated as metadata rather than final conclusions.

🌐 Hostnames and Domains

The tool displays hostnames and domains associated with the IP address when available.

Hostnames

Hostnames may include DNS names, reverse DNS names, or observed service names.

Example:

one.one.one.one

Domains

Domains may include root domains or associated domains found in the crawler data.

Example:

one.one

Important notes:

🔌 Services and Ports

The Services / Ports section displays observed open ports and detected services.

The table may include:

Column Description
Port Port number
Protocol TCP or UDP
Product / Version Detected product and version
CVEs Number of linked CVEs
Max CVSS Maximum vulnerability severity score
Scan Scan date

Example service rows:

53    TCP    —           0    —    2026-06-17
443   TCP    CloudFlare  0    —    2026-06-17
8880  TCP    CloudFlare  0    —    2026-06-17

The table can be filtered by port or product name, allowing analysts to quickly find relevant services.

🔎 Service Filtering and Sorting

The services table supports quick filtering.

Users can search by:

Example:

Filter: 443

Filter: CloudFlare

Sorting by columns helps analysts prioritize:

🧾 Service Details

Clicking the disclosure button on a service row opens detailed service information.

The details view may include:

Main

HTTP

Location

Vulnerabilities

Raw JSON

This drill-down structure allows the interface to remain fast while still providing deep technical visibility when needed.

🌐 HTTP Metadata

For HTTP or HTTPS services, the tool may show HTTP-level metadata.

Possible fields include:

Field Description
Status HTTP status code
Server Server response header
Title HTML page title
Location Redirect target
WAF Web application firewall or CDN indicator
Components Detected technologies
HTML hash Hash of returned HTML
Headers hash Hash of headers
DOM hash DOM fingerprint
Security.txt Security policy file data, if found
Robots.txt Robots file data, if found
Sitemap Sitemap data, if found

Example:

Status: 301
Server: cloudflare
Title: 301 Moved Permanently
Location: /

HTTP metadata is useful for web service fingerprinting, CDN detection, redirect analysis, and change tracking.

🧬 Hashes and Fingerprints

The tool may display multiple hashes and fingerprints.

Examples:

These hashes are useful for:

A hash does not identify a service by itself. It is a technical fingerprint that should be interpreted with context.

🛡️ Vulnerability Aggregation

The tool aggregates vulnerability data for services when CVEs are available.

The service table may show:

CVSS Color Labels

The interface may use color labels based on CVSS score.

General interpretation:

CVSS Range Severity
≤ 4 Low
4–7 Medium
≥ 7 High

The Max CVSS field shows the maximum vulnerability score associated with the service.

Important: a CVE association does not always prove exploitability. Product detection, version accuracy, configuration, and exposure context must be validated manually.

📦 Raw JSON Viewer

Each service can include a raw JSON view.

Raw JSON may contain:

Raw JSON is useful for:

Raw data should be handled carefully because it may include detailed infrastructure fingerprints.

🕓 Historical Data

When the Historical Data option is enabled, the backend may return archival information if supported.

Historical data can help analysts understand:

Important interpretation:

When History is enabled, the server may return historical layers if supported.

Historical data may not be available for every IP address and should be clearly separated from current observations.

📤 Export and Copy Options

The tool supports analyst-friendly export and copy workflows.

Possible output options include:

CSV export is useful for:

Exports should be stored securely, especially when they include infrastructure fingerprints or vulnerability data.

🕘 Request History

The tool may store entered IPs in local browser history through LocalStorage.

History can help users quickly repeat previous lookups.

Local history may include:

Because this history is browser-local, it may be cleared when users delete browser data or switch devices.

On shared devices, local history should be cleared after sensitive investigations.

🧠 Key Features

Global IP Lookup

Search detailed information about IPv4 and IPv6 addresses.

NiamonX Crawler Database

Results come from the global crawler database catalog.

General IP Intelligence

Shows ASN, organization, ISP, country, region, city, coordinates, ports, services, hostnames, domains, and tags.

Geolocation Map

Displays approximate location on a Leaflet / OpenStreetMap map.

Service and Port Inventory

Lists observed open ports, protocols, products, versions, scan dates, CVE counts, and Max CVSS.

Vulnerability Aggregation

Aggregates CVE and CVSS data per service when available.

Raw JSON

Allows detailed inspection of service-level raw records.

Lazy Rendering

Large service details are rendered only when opened, reducing browser load.

Historical Data

Can request archival information when supported.

Filtering and Sorting

Users can search services by port or product name and sort columns.

Export

Supports summary / JSON copy and CSV export.

Local History

Stores previously entered IPs locally in the browser.

A practical IP investigation workflow should follow these steps.

1. Enter a Clean IP Address

Use only IPv4 or IPv6. Do not include domains, URLs, ports, or paths.

2. Review General Information

Check ASN, organization, ISP, country, region, city, coordinates, ports, services, hostnames, and domains.

3. Check Geolocation

Use the map for approximate context, but do not treat it as exact physical attribution.

4. Review Open Ports

Sort and filter services by port, product, scan date, or CVSS score.

5. Expand Important Services

Open details for exposed web services, remote access services, databases, or unusual ports.

6. Review Vulnerability Data

Check CVE count and Max CVSS, but validate product and version accuracy before making conclusions.

7. Inspect Raw JSON When Needed

Use raw data for deeper technical analysis or integration workflows.

8. Compare Current and Historical Data

Enable historical data when investigating exposure changes over time.

9. Export Evidence

Use CSV or JSON export for internal reporting.

10. Validate Before Action

Confirm important findings with additional tools, asset owners, or direct authorized scans.

🛡️ Security, Privacy & Responsible Use

IP Intelligence Search is intended for lawful cybersecurity, OSINT, asset analysis, incident response, and exposure management.

Acceptable use cases include:

Users must follow responsible use rules:

⚙️ Technical Highlights

📌 Usage Hints

📬 Contact Information

support@niamonx.io — Technical Support
other@niamonx.io — General Inquiries
takedown@niamonx.io — Privacy or Data Removal Requests
legal@niamonx.io — Legal and Compliance Matters

Alternative contact channel:

🔗 Helpdesk: https://support.niamonx.io/

Summary

NiamonX IP Intelligence Search (Global IP Lookup) is a global IP intelligence tool for analyzing IPv4 and IPv6 addresses through the NiamonX Crawler database catalog.

It provides ASN, organization, ISP, geolocation, hostnames, domains, open ports, services, products, HTTP metadata, fingerprints, CVEs, CVSS scores, historical layers, raw JSON, filtering, sorting, CSV export, and local lookup history.

The tool is designed for lawful OSINT, SOC triage, threat intelligence, vulnerability review, asset monitoring, compliance, and incident response. Results should be treated as intelligence signals and validated before operational or security decisions.

Revision #1
Created 17 June 2026 19:51:25 by NiamonX Team
Updated 17 June 2026 19:52:43 by NiamonX Team