Checks whether an origin AS is authorized to announce a prefix, validated live against Routinator via RIPEstat. Use this to spot route hijacks or missing/misconfigured ROAs.

Enter an ASN to see every prefix it announces worldwide plus its upstream/peer ASNs, or an IP/prefix to see every origin AS announcing it globally and the upstream of the top origin AS — live from RIPE NCC RIS route collectors positioned around the world.

Live, peer-level detail from RIPE NCC's route collectors: which peers are announcing this IP/prefix, which AS originated it, and how many RRCs (collector nodes) worldwide see it — formatted as "Peers announcing (prefix) originated by AS(x) and seen by (n) RRCs."

Real-time query across Google, Cloudflare, and Quad9 public DNS-over-HTTPS resolvers via your device's own internet connection — see exactly what each one currently returns.

Real DNS-based lookup against 5 widely-used public blacklists (Spamhaus ZEN, SpamCop, Barracuda, SORBS, CBL) — useful before troubleshooting "emails not delivering" or "why is our IP blocked" tickets. Enter multiple IPs, one per line (up to 25).

🧹 Blacklist Remover: when an IP is listed, a direct removal/delisting link appears next to each blacklist below — opens that RBL's official self-service delist page.

Checks every host address in a /24 (or smaller) block against the same 5 blacklists. Capped at 254 hosts and run in small batches to stay responsive — a full /24 scan can take a couple of minutes.

Ready — enter a /24 or smaller CIDR block

Powered by AbuseIPDB — check IP/prefix/ASN abuse confidence, submit abuse reports, and keep a local add/remove/edit report log with import & export. Requires a free AbuseIPDB API key.

Enter a single IPv4/IPv6 address, a CIDR prefix (e.g. 103.10.124.0/24), or an ASN (e.g. AS132203 or 132203).

At least one category is required. Do not include personally identifiable information (PII) in the comment — reports are visible to the AbuseIPDB community.

Paste up to 50 IPs, one per line. Each is checked individually against AbuseIPDB (rate-limited to stay within your plan's daily quota).

Ready — paste IPs above and click Check All

One report per line — ip,categories,comment (categories = comma/semicolon-separated category IDs, e.g. 14;18 or 14,18 — wrap the whole line's categories in quotes if needed). Comment optional.

Ready — paste report lines above and click Submit All Reports

Every Check & Report action above is logged here automatically. You can also add, edit, or remove entries manually, then import/export the whole log.

Paste up to 50 IPs and/or ASNs (one per line). IPs get a real RIPEstat lookup for their announcing ASN(s) and covering prefix; ASNs (e.g. AS13335) expand into every prefix that ASN announces worldwide. Handy for triaging abuse logs or traffic lists.

Ready — paste IPs above and click Lookup All

Checks whether a domain or server IP is reachable from your device's real internet connection — compares public DNS resolution against an actual live connection attempt. If DNS resolves fine but the real connection consistently fails while other sites work, that's a real sign of a network-level block (ISP/firewall/DPI) rather than the site being down.

Honest limitation upfront: browsers cannot open arbitrary raw TCP sockets, so this can't do a true SYN port scan like nmap. What it can do — for real, over your device's own connection — is attempt a real network round trip to each target:port and time it. A fast reply (even an error/certificate mismatch) means something answered at the network layer; a full timeout usually means filtered/firewalled/unreachable. Certain ports (25, 23, 53, 179, 587, etc.) are blocked outright by the browser itself for security and can't be tested at all — marked "Browser-blocked".

Scans are capped at 5 target IPs × 40 ports per run (larger ranges are sampled/truncated) to stay responsive in a browser — this is a safety limit, not a bug.

No entries yet — start your shift and add events