IPMetaData

IP Metadata

The IP Metadata module provides comprehensive intelligence gathering for IPv4 and IPv6 addresses. It aggregates data from multiple sources to extract routing information, reverse DNS records, network descriptions, abuse contacts, and threat intelligence tags.

Important

Data Attribution: All reverse DNS records, network descriptions, abuse contacts, and threat intelligence tags, etc., extracted by this module are provided by the global DNS infrastructure, Team Cymru, the RIPEstat API, the Tor Project, DAN.me.uk, Spamhaus, Barracuda Central, and SpamCop.

Note

This module utilizes global DNS resolvers (for PTR, DNSBL, and Team Cymru queries) and the RIPEstat API (for WHOIS and abuse contacts). It does not require any API credentials. Its behavior, including retry logic and timeout boundaries for both DNS and API requests, is governed by the global network and resolver settings. For comprehensive instructions on adjusting network-level settings, refer to the Network Configuration page.

Warning

Because this module relies on unauthenticated queries to external third-party services, processing a massive volume of IP addresses—or scanning from a poor-reputation IP—may result in your scanner's IP address being rate-limited or permanently blocked by the providers. You may encounter intermittent network or connection errors as a result. To mitigate access restrictions, it is highly recommended to use IP rotation (e.g., VPNs or proxies) and carefully tune the retry delays outlined in the Network Configuration page.

Capabilities

The module accepts IPv4 and IPv6 addresses as input and offers multiple specialized functions to gather different types of intelligence.

Extracted Information

Based on the function executed, the module extracts and returns the following specific properties:

1. PTR Records

Data Source: Global DNS Infrastructure

Performs a reverse DNS (PTR) lookup to find hostnames associated with the IP address.

• Domain: If the PTR record resolves to a valid domain name, it is extracted as a new node (automatically tagged with Reverse IP).
• PTR: If the record does not conform to standard domain validation, it is returned as a raw PTR property.

2. ASN & BGP Prefix

Data Source: Team Cymru

Performs DNS TXT queries against the Team Cymru service (origin.asn.cymru.com / origin6.asn.cymru.com) to determine the BGP routing information.

• CIDR: The specific BGP IP prefix announcing the target IP (Context: BGP Prefix).
• ASN: The Autonomous System Number associated with the IP. The context field is automatically enriched with the registration country and company name (e.g., ASN Origin (US, GOOGLE)).

3. Tor Exit Node Check

Data Sources: Tor Project | DAN.me.uk

Checks if the IP address is currently operating as a Tor exit node by querying multiple DNSBL zones (dnsel.torproject.org, torexit.dan.me.uk).

• Tag: If listed, automatically assigns the Tor Exit tag to the IP address. The context indicates the specific DNSBL zone that triggered the match.

4. RBL / Spam Blacklists

Data Sources: Spamhaus | BarracudaCentral | Spamcop

Checks the IP address against major Real-time Blackhole Lists (RBLs) to identify spam or botnet activity. Queries zen.spamhaus.org, b.barracudacentral.org, and bl.spamcop.net.

• Tag: If listed, automatically assigns the Spam/Botnet tag to the IP address. The context indicates the specific DNSBL zone that triggered the match.

5. IP Information

Data Source: RIPEstat API

Queries the RIPEstat whois endpoint to retrieve network registration information.

• Network Name: The registered netname for the IP allocation (automatically marked as Out Of Scope (see Scope Boundaries)).
• Description: The combined descr fields detailing the network's purpose or owner (automatically marked as Out of Scope).

6. Abuse Contacts

Data Source: RIPEstat API

Queries the RIPEstat abuse-contact-finder endpoint to retrieve dedicated abuse reporting contacts for the IP address.

• Email: Extracts abuse contact email addresses (automatically marked as Out of Scope since they are associated with the infrastructure provider, not the direct target).