Origin discovery
A reverse proxy masks a site's real IP, so phishing and malware shelter behind a hostname the CDN can only suspend, not remove. Origin discovery resolves a proxied domain to the server that actually hosts it, so your abuse report reaches the party that can pull it, and the takedown sticks.
What the internet sees
Proxiedtarget
secure-paypa1-login.com
104.18.32.7
A shared edge address used by thousands of sites.
What Muswa resolves
Origin exposedtarget
secure-paypa1-login.com
198.51.100.23
The machine actually serving the phishing kit.
Amsterdam, NLDrag the line, or focus it and use the arrow keys.Sample data · documentation IP ranges
Every other tool starts at an IP and lists the names on it. Seek starts at the domain and finds the IP behind it — and you decide how wide the search runs.
Direction
You run it yourself. Point seek at a proxied domain and it hands back the server that actually hosts it — verified, with a confidence score and the right abuse contact. We are the first to put this direction in your hands.
Scopeyou choose how wide to look
One domain you already suspect.
A block you want to narrow to.
A whole network and its prefixes.
Every routable address in a territory.
All of IPv4, nothing left out.
Each cell stands for a slice of the address space. The beam is our scanner sweeping across it; lit cells are responsive hosts, and cyan cells are where we mapped a proxied domain to its real host. Hollow cells are reserved space nobody can route.
Counters follow today's cycle (restarts 00:00 UTC) at our average daily rates.
A track is a background job that hunts the origin of one domain, ranks the candidates by confidence, and verifies each one live before it is marked confirmed.
| Candidate | Network | Confidence | Status |
|---|---|---|---|
| 198.51.100.23 | AS64500 | 100% | Verified live |
| 198.51.100.24 | AS64500 | 72% | Likely, same operator |
| 203.0.113.9 |  AS64511 | 18% | Rejected, look-alike |
Abuse contact
Hosting network
AS64500 · Hostnet Example
Next step
Report to the host, not the CDN
Take the kit offline at the host, which can pull the server, instead of waiting for the proxy to suspend a hostname that comes back tomorrow under a new name.
Without
With Muswa
Your abuse email reaches the network that actually runs the box, with a timestamped PDF of proof and the right mailbox to send it to.
Without
With Muswa
One origin often hosts a whole campaign. Pivot from the IP to every other name it answers for, its ASN and its neighbours.
Without
With Muswa
Origin discovery is only useful if it stays clean. These are the lines we hold.
What we do
What we never do
Honest limits
Origin discovery is powerful, but it does not succeed every time. When a track comes back empty, we tell you plainly rather than guess.
Start a track
Origin tracks are included in both plans, next to the full IP, domain, AS and wallet recon. Run one at a time on Basic, five in parallel on Professional.