OSINTRecon for people who chase abuse
Today's IPv4 sweep--.-%
Muswa merges dozens of intelligence sources with our own scanner, which sweeps the entire IPv4 internet every day. You get one ranked report, the right abuse contact, and the real server hiding behind a CDN.
From $25/month · no free tier, no data resale
01The core modules
These are fragments of actual reports. The most important finding is always at the top, background detail further down.
IP recon
AshburnAS644961.2 msNew YorkAS644976.9 ms
LondonAS6449874.8 ms
AmsterdamAS6450081.3 msDomain recon
AS recon
AML
Pivot and export
Report-198.51.100.23.pdf
14 pages · ready for the abuse desk
New this release
The same engine, pointed at more of the problem: malware, hidden origins and whole cases.
02Origin discovery
Phishing kits love reverse proxies: the domain resolves to a CDN edge and the real host stays anonymous. But the origin still answers when it's contacted directly — and closing that gap is exactly what we do.
24 h
Full IPv4 cycle
100%
Confidence when matched
5
Parallel tracks on Pro
A secure-paypa1-login.com
→ 104.18.32.7 · 172.64.155.9 (shared by 1000s of sites)
confirmed serving secure-paypa1-login.com
03Two in one
Most tools resell the same public feeds. We pay for and aggregate dozens of them, then add what nobody else has: a first-hand view of every IPv4 address, refreshed daily. One subscription replaces a drawer full of tabs.
Aggregated intelligence
Dozens of paid and public sources
Our own scanner
The whole IPv4 space, daily
What you get
One ranked report
04How it works
Same engine for the dashboard, the REST API and the MCP server. One lookup, one quota.
Type an IP, a domain, an AS number or a wallet. Or send it from your script, your SOAR or your AI agent.
0.0B
IPv4 addresses
probed by our scanner every 24 hours
0+
Signals per domain
DNS, TLS, mail, headers, leaks, feeds
0
IP blocklists
checked live on every IP lookup
0
Recon modules
IP, domain, AS, wallet, hash and origin
05REST API + MCP
On Professional, every module is available over a REST API and as an MCP server. Plug Muswa into Claude Code or any MCP-capable assistant, and it can investigate a target, read the ranked report and draft the abuse email for you.
claude mcp add --transport http muswa https://muswa.com/mcp \
--header "Authorization: Bearer $MUSWA_API_KEY"06Pricing
6 months: -10% · 12 months: 2 months free · paid in crypto
$25/ month
$50/ month
No free tier. Public agencies can ask for vetted free access.
Compare every line07Questions
From our own internet-wide scanning combined with many public and commercial intelligence sources, merged into a single view. We do not disclose individual sources, but every block on a result page is computed fresh or from a recent cache, and timestamped.
Both see the same modules and the same data. Basic ($25/month) gives 100 lookups a day and one concurrent origin track. Professional ($50/month) gives 250 lookups a day, five concurrent origin tracks, the shared Investigation workspace, the REST API, the MCP server for AI assistants, early access to beta modules and priority support.
No. Lookups are confidential. Most checks are passive; the few that touch a target (for example a TLS handshake or an HTTP request) look like ordinary traffic and carry nothing that identifies you.
No. To see exactly what you get before paying, open the demo report: it is a complete, real-format result page.
Target:
Open an account in two minutes, pick a plan, and run your first report today.