Context behind
every signal.

Priority review: a CVE candidate reported for the IP appears in a freshly retrieved CISA KEV catalog. Elevated review: no KEV match, complete enrichment and at least one CVSS base score of 7.0 or higher, or an EPSS probability of 10% or higher from the last 72 hours. Review: other candidates with complete enrichment. Unassessed: missing, incomplete, stale or absent evidence. These are transparent Data-Shield triage rules, not a calibrated risk score or FIRST-defined bands. No level proves an IP is malicious. The maximum displayed CVSS describes a reported vulnerability, not the address.

A dated, attributable observation that directly links the IP, the specific CVE and an exploitation attempt, with a documented detection method and confidence. This release has no such telemetry feed. InternetDB exposure, a high CVSS score, a KEV entry or blocklist membership cannot substitute for that evidence. Successful compromise would require additional evidence.

A CVE is a potential relationship until the service version, configuration and patch state are checked. Shared hosting, backported fixes and reassigned addresses can make correlations misleading. API errors and absent scores are displayed as unavailable. A missing Shodan record is not an all-clear. Up to 20 candidate CVEs per IP are enriched, with KEV candidates first; a larger set is explicitly marked partial. Results never modify either blocklist or whitelist.

The site's existing hourly build retrieves CISA and FIRST context. Open pages check same-origin snapshots every minute and when the tab becomes visible; this never triggers an external IP lookup. CVE records may be cached for up to 24 hours. Their modification and retrieval dates remain visible. CISA retrieval older than 48 hours and EPSS scores older than 72 hours are flagged; the IP lookup also exposes the blocklist generation time. InternetDB updates weekly and supplies no per-IP observation time, so a retrieval timestamp never becomes a claimed observation timestamp.

Blocklist checks run locally against files hosted by this site. Optional enrichment sends the entered public IP only to Shodan, and candidate CVE identifiers to FIRST and the official CVE mirror hosted by GitHub. Those providers receive normal connection metadata, including your connection IP. No cookies, credentials or referrer are sent by the lookup. Queries remain in page memory and are not written to browser storage or the URL. Exported evidence is saved only when you request it. Data-Shield code remains GPL-3.0; external data is governed by its source terms. EPSS is credited to FIRST under its published terms. Source links and retrieval metadata are retained.