IP Address Intelligence
VerAI provides network intelligence for IPv4 addresses using DNS blocklists, reverse DNS, geolocation, and GreyNoise. These checks help users investigate network addresses and understand available reputation signals.
Running an IP Analysis
- Open VerAI.
- Enter an IPv4 address.
- Submit the analysis.
- Review the returned network intelligence.
Example:
8.8.8.8Supported Addresses
The supplied implementation validates input using Python's socket.inet_aton().
The intended input is an IPv4 address.
IPv6 support is not implemented in the submitted IP-analysis branch.
For predictable behavior, provide a standard dotted-decimal IPv4 address.
Available Checks
| Check | Description |
|---|---|
| DNS Blocklists | Query supported DNS-based reputation lists |
| Reverse DNS | Attempt to resolve a PTR hostname |
| Server Location | Estimate the associated country |
| GreyNoise | Retrieve available community intelligence |
DNS Blocklist Checks
DNS-based blocklists, sometimes called DNSBLs, maintain information about IP addresses associated with particular activity or reputation categories.
VerAI queries several configured blocklist providers.
Configured Providers
| Provider | Lookup Zone |
|---|---|
| Barracuda | b.barracudacentral.org |
| SORBS | dnsbl.sorbs.net |
| SpamCop | bl.spamcop.net |
| PSBL | psbl.surriel.com |
| AbuseAt | cbl.abuseat.org |
| SpamRATS | all.spamrats.com |
Actual provider availability and DNSBL policies may change independently of VerAI.
How DNSBL Queries Work
For an IPv4 address, VerAI reverses the octets and appends the provider's lookup domain.
For example:
192.0.2.15becomes:
15.2.0.192.example-blocklist.orgThe DNS response is then checked against a configured set of listing codes.
Possible Results
Listed on [Provider]Not listed on [Provider][Provider] check timed outNo response from [Provider]Important Interpretation
A listed result indicates that a particular DNSBL returned a response recognized by VerAI's implementation.
It does not independently prove that the address is malicious.
Similarly, an unlisted result does not establish that the IP is safe.
The implementation recognizes only a selected set of response codes, so other provider-specific results may not be classified as listings.
Reverse DNS
Reverse DNS attempts to retrieve the PTR record associated with an IP address.
Example
mail.example.comPossible Results
- A resolved hostname
- No reverse DNS available
- Lookup timeout
- Invalid address
- Other DNS error
PTR records are configured by the responsible network operator and should not be regarded as proof of identity.
IP Geolocation
VerAI uses an external geolocation service to estimate the country associated with an IP address.
Example
Country: GermanyThe location is an estimate based on provider data.
It may not represent the physical location of the user, system administrator, or person responsible for particular activity.
GreyNoise Intelligence
VerAI calls the GreyNoise Community API to obtain available IP classification information.
GreyNoise can provide context about internet-wide scanning and other observable network activity.
Returned Classifications
The supplied implementation distinguishes:
| Classification | Description |
|---|---|
| RIOT | Address identified as belonging to a known common benign service or organization |
| NOISE | Address associated with observed internet scanning or similar activity |
| Not Classified | No matching classification returned |
| Not Found | Provider returned an absent-record response |
| Error | Provider request could not be completed |
Additional Information
Where available, the response may include:
- Classification
- Associated name
- Last-seen information
Understanding NOISE
A NOISE classification indicates activity recorded by GreyNoise.
It does not automatically mean that the address is conducting a targeted attack against your organization.
Understanding RIOT
A RIOT classification identifies certain known services or organizations.
It is useful context, but should not be interpreted as an unconditional guarantee of safety.
Rate Limits and Provider Errors
GreyNoise requests can fail due to:
- Invalid API credentials
- Rate limits
- Network failures
- Service availability
- Missing records
A provider error should be distinguished from a threat finding.
Interpreting Multiple Signals
Consider the following hypothetical report:
| Check | Result |
|---|---|
| Reverse DNS | host.example.net |
| Location | United States |
| DNSBL | Listed on one provider |
| GreyNoise | NOISE |
This collection of observations suggests that the address may warrant investigation.
However, it does not alone establish malicious intent or responsibility.
Recommended Investigation Process
- Confirm that the submitted IP address is correct.
- Review DNSBL results individually.
- Check reverse DNS.
- Consider the approximate geolocation.
- Review GreyNoise context.
- Correlate the findings with relevant logs and timestamps.
- Investigate further before making enforcement decisions.
Important Limitations
- IPv6 is not supported by the supplied IP-analysis workflow.
- DNSBL results depend on external provider availability.
- The tool does not enumerate every reputation source.
- The tool does not perform packet capture or traffic inspection.
- The tool does not establish IP ownership beyond retrieved metadata.
- Results can change over time.
Important: IP reputation should be interpreted with supporting evidence rather than treated as a final verdict.
Updated 8 days ago