I ran this on my own IP (Time Warner cable dynamic IP) and was surprised to see I was in a Spamhaus list. I dug a little deeper and I found that the IP was in a PBL (Policy Block List).<p>Spamhaus says the following in its FAQ about the PBL (<a href="https://www.spamhaus.org/faq/section/Spamhaus%20PBL#183" rel="nofollow">https://www.spamhaus.org/faq/section/Spamhaus%20PBL#183</a>):<p>"The first thing to know is: THE PBL IS NOT A BLACKLIST. You are not listed for spamming or for anything you have done. The PBL is simply a list of all of the world's dynamic IP space, i.e: IP ranges normally assigned to ISP broadband customers (DSL, DHCP, PPP, cable, dialup). It is perfectly normal for dynamic IP addresses to be listed on the PBL. In fact all dynamic IP addresses in the world should be on the PBL. Even static IPs which do not send mail should be listed in the PBL."<p>So, in this tool, presumably any dynamic IP will turn up as "Listed in spamhaus PBL", which might cause some undue alarm to the uninformed. Maybe you should just show a yellow warning saying "you're a dynamic IP address" or something of that sort.<p>Congrats on the tool, it is really neat!
Very nice UI! If you're looking for something similar via an API you can try my service <a href="http://ipinfo.io" rel="nofollow">http://ipinfo.io</a>:<p><pre><code> $ curl ipinfo.io/8.8.8.8
{
"ip": "8.8.8.8",
"hostname": "google-public-dns-a.google.com",
"city": "Mountain View",
"region": "California",
"country": "US",
"loc": "37.3845,-122.0881",
"org": "AS15169 Google Inc.",
"postal": "94040"
}
$ curl ipinfo.io/8.8.8.8/org
AS15169 Google Inc.
</code></pre>
It also supports lookup of IPv6 addresses (but not IPv6 connections, due to AWS). See <a href="http://ipinfo.io/about" rel="nofollow">http://ipinfo.io/about</a> for more details
Looks useful!<p>There are some issues with the port detection on my IP address though: HTTP was 'disabled' (whatever that means, but it's open and apache is listening) and SMTP was incorrectly labeled 'closed'. Https detection was correct, and ssh was 'closed', which could be correct if it means 'RST returned' rather than 'firewalled'.<p>Also I'd prefer seeing an OpenStreetMap tile rather than having Google log my visit, but that is probably just me. On the positive side, Piwik instead of GA :)<p>Another small point: I'm not sure which address you're looking for, but the whois info of my IP definitely contains an abuse address (80.100.131.150).
I have a similar service that I'm working on in my free time. There are many alternatives to AWS that offer full IPv6. Until you need the features AWS affords I'd definitely recommend trying some of the smaller alternatives (cheaper, too). Happy to share some options with you in private.
If you are looking to do more persisted research around a domain or ip address, consider checking out PassiveTotal (<a href="https://www.passivetotal.org" rel="nofollow">https://www.passivetotal.org</a>) . We draw in a lot of the same free feeds, but also have the most comprehensive passive dns aggregation out there, and let users pivot on Whois and ssl certificate data from Internet scans. API is documented and available to use for all account types. We also host free Maltego transforms if you want more of a graph analysis solution.
Nice! Any chance of making this open-source? I'm trying to learn node-js and it looks like you've used a few node modules, so it would be handy to see how it's done.
If you're interested in more in-depth port/ SSL/ host information you can pull the data for free using the Shodan API (<a href="https://developer.shodan.io/api" rel="nofollow">https://developer.shodan.io/api</a>). For SSL we also explicitly test for Heartbleed, support for SSL versions, POODLE and a few other issues. Each IP also gets scanned for more than 200 ports so all popular services are covered fully.
Looks really cool, it's hard to get a complete view with most of the other tools out there. This is definitely a keeper.<p><a href="https://myip.ms/info/whois/212.51.131.143" rel="nofollow">https://myip.ms/info/whois/212.51.131.143</a>
<a href="https://www.domaintally.com/hosted-ip/212.51.131.143/" rel="nofollow">https://www.domaintally.com/hosted-ip/212.51.131.143/</a>
by testing couple of IPs i get city unknown but google map is pointing to more or less correct location.<p>why don't you use some service to get city by long/lat? i think google should have something for this
it uses websockets to get the information to the browser. a little weird, but whatever, my question is why does the socket remain open after the information is downloaded?