A Multi-Functional Web Tool for Comprehensive Threat Detection Through IP Address Analysis

TL;DR

This paper presents a comprehensive, open-source web tool for detailed IP address analysis, integrating multiple detection features and a confidence scoring system to enhance cyber threat intelligence capabilities.

Contribution

It introduces a novel multi-functional IP analysis web tool that combines various detection methods, a confidence scoring system, and local caching for improved performance.

Findings

Provides geolocation, VPN, proxy, bot, Tor detection, and port scan features.

Includes domain statistics with name server and registrar info.

Employs a confidence score based on multiple online sources.

Abstract

In recent years, the advances in digitalisation have also adversely contributed to the significant rise in cybercrimes. Hence, building the threat intelligence to shield against rising cybercrimes has become a fundamental requisite. Internet Protocol (IP) addresses play a crucial role in the threat intelligence and prevention of cyber crimes. However, we have noticed the lack of one-stop, free, and open-source tools that can analyse IP addresses. Hence, this work introduces a comprehensive web tool for advanced IP address characterisation. Our tool offers a wide range of features, including geolocation, blocklist check, VPN detection, proxy detection, bot detection, Tor detection, port scan, and accurate domain statistics that include the details about the name servers and registrar information. In addition, our tool calculates a confidence score based on a weighted sum of publicly accessible online results from different reliable sources to give users a dependable measure of accuracy. Further, to improve performance, our tool also incorporates a local database for caching the results, to enable fast content retrieval with minimal external Web API calls. Our tool supports domain names and IPv4 addresses, making it a multi-functional and powerful IP analyser tool for threat intelligence. Our tool is available at www.ipanalyzer.in