Abuse contact
98confidence 96%
01The service
Every signal on a target.
One ranked page.
Type an IP, a domain, an AS or a wallet. Muswa runs every check it has in parallel, across paid intelligence sources and its own internet-wide scanner, and hands back one page ordered by what you should act on first.
Spec sheet
- targets
- signals
- own scan
- seek
- delivery
- order
02Module explorer
Every module, opened up.
Pick a module to see how its result page builds itself, highest-value block first, and a sample of what it checks.
Module IP · input: Any IPv4 or IPv6 address
IP recon
Who runs this address, what it exposes, and who to report it to.
One address in, one ranked page out: owner, location, privacy class, reputation, exposed services, the domains it really serves and the exact abuse mailbox to write to.
18+signals in this module
Result preview · ranked by value
Representative checks18+
Identity
- Geolocation and network owner
- ASN, prefixes and upstreams
- Reverse DNS
Risk
- Privacy class: VPN, proxy, Tor, hosting
- Reputation across threat feeds
- Blocklist coverage
- Major-blocklist status
Action
- Abuse contact with confidence
- Domains the address really serves
- Site category when it hosts a page
- On-demand port and service scan
- Geo-traceroute from the vantage you choose
A selection of what this module checks — 18+ signals in all, with more added as sources grow.
Module DOM · input: A domain or URL
Domain recon
Dozens of checks, from DNS to leaked secrets, on one ranked page.
The deepest module. It maps DNS, mail security, TLS posture, web surface, history and exposure, and surfaces the real server behind a CDN.
51+signals in this module
Result preview · ranked by value
Representative checks51+
- DNS & mail
- Full DNS map and propagation
- Email security with spoofability verdict
- Mailbox verification: real, catch-all, disposable or role
- Transport
- TLS posture and grade
- HTTP versions, redirects and timing
- Web surface
- Security-header grade
- WAF/CDN and technology fingerprint
- Site category: safe, adult, malware or phishing
- Exposed-surface checks
- Exposure
- The real host behind the CDN
- Subdomains and takeover candidates
- Leaked-secret and exposed-file checks
- Reputation & history
- Phishing, malware and blocklist feeds
- Major-blocklist status
- Registration, age and archive history
A selection of what this module checks — 51+ signals in all, with more added as sources grow.
Module AS · input: An AS number, an IP or a network name
AS recon
The network behind the network: who it is, who it talks to, how clean it is.
Profile an autonomous system in seconds: identity, fraud and bulletproof signals across its neighbours, routing, peering and whether it lets spoofed traffic out.
12+signals in this module
Result preview · ranked by value
Representative checks12+
Identity
- Name, number, type and country
- Registry and abuse contact
Risk
- Fraud and bulletproof-hosting signals
- Spoofing capability and RPKI validity
Topology
- Upstreams, peers and downstreams
- Announced prefixes and hosted domains
A selection of what this module checks — 12+ signals in all, with more added as sources grow.
Module AML · input: A wallet address on a supported chain
AML screening
Is this wallet sanctioned, flagged or one hop from trouble?
Screen a crypto address against sanctions lists and community risk flags across the major chains, with a single risk score you can put in a report.
12+signals in this module
Result preview · ranked by value
Representative checks12+
Screening
- International sanctions lists
- A single overall risk score
Risk flags
- Scam, mixer and theft exposure
- Darkweb and malicious-contract flags
Coverage
- Major EVM chains and their L2s
- Bitcoin and Tron
A selection of what this module checks — 12+ signals in all, with more added as sources grow.
Module IOC · input: A file hash (MD5, SHA-1 or SHA-256)
IoC Finder
One hash, every sandbox and malware feed, merged.
Paste a malware hash and get one merged report: how much of the industry flags it, the family and names it goes by, what it does when detonated, the servers and addresses it reaches, and the file's own identity — plus the sample itself where it can be shared.
15+signals in this module
Result preview · ranked by value
Representative checks15+
- Verdict
- Merged detection ratio across feeds
- Threat classification and severity
- First and last seen in the wild
- Identity
- File type, size and signatures
- Known family, names and tags
- Related hashes and variants
- Behaviour
- Sandbox detonation summary
- Dropped files and spawned processes
- Persistence and evasion notes
- Network IoCs
- Contacted IPs and domains
- URLs and command-and-control indicators
- Pivot each indicator into IP or domain recon
- Sample
- Download the sample where available
A selection of what this module checks — 15+ signals in all, with more added as sources grow.
Module WAF · input: A CDN- or WAF-protected domain
WAF Resolver
The real origin behind a CDN or WAF, returned instantly.
Point it at a domain hidden behind a CDN or WAF and get the real origin IP back in seconds — scored by confidence, with the country and network that actually hosts it. No job to launch, no waiting: just the answer.
8+signals in this module
Result preview · ranked by value
Representative checks8+
Result
- The real origin IP
- Confidence score
- Instant — nothing to run or wait for
Attribution
- Hosting country
- Network owner and ASN
Follow-up
- Side-by-side with the CDN edge
- Pivot the origin straight into IP recon
A selection of what this module checks — 8+ signals in all, with more added as sources grow.
Module ORG · input: A CDN-protected domain
Seek — origin discovery
The real server behind a CDN, found with a user-driven domain→IP scan.
Seek is origin discovery you drive yourself. Point it at a proxied domain and choose how wide to look — from a single host to the whole internet. Most tools only go IP→domain; we are the first to put the reverse in your hands.
10+signals in this module
Result preview · ranked by value
Representative checks10+
Direction
- Domain → IP, the reverse of every other tool
Scope
- A single host
- An IP range
- An autonomous system
- A country
- The whole internet
Workflow
- Runs in the background
- Up to 5 tracks in parallel
- Pivot each result into IP recon
A selection of what this module checks — 10+ signals in all, with more added as sources grow.
Module PDF · input: Any finished lookup
PDF export
A report you can attach to a ticket, a takedown or a case file.
Every module exports a styled, multi-page PDF: cover with the verdict, then every block in the same order you saw it, timestamped.
7+signals in this module
Result preview · ranked by value
Representative checks7+
Contents
- Cover page with verdict and key facts
- Every block, ranked by value
- Timestamped results
Use
- Takedown requests and abuse reports
- Case files and audits
A selection of what this module checks — 7+ signals in all, with more added as sources grow.
Module API · input: An API key (Professional)
API & MCP
Same engine for your scripts and your AI agents.
A REST API returns every block as JSON. The MCP server lets assistants such as Claude Code run lookups by themselves, with your key and your quota.
7+signals in this module
Result preview · ranked by value
Representative checks7+
REST
- JSON for every check
- Parallel block fetch
- Revocable personal keys
MCP
- Lookups from any MCP-capable assistant
- Answers link to the full report
A selection of what this module checks — 7+ signals in all, with more added as sources grow.
Module HIS · input: Automatic
History
Every lookup kept, re-openable without spending quota.
Your past lookups stay in your account with the exact results you saw at the time. Re-open any of them for free, or run it again for fresh data.
6+signals in this module
Result preview · ranked by value
Representative checks6+
Archive
- Every lookup saved with its results
- Free to re-open
- Search and filter by module or target
Follow-up
- Re-run for fresh data
- Export any saved report to PDF
A selection of what this module checks — 6+ signals in all, with more added as sources grow.
03Why it holds up
Breadth is easy to claim.
Here is how we earn it.
A selection of what we check, scrolling past. Most tools give you a handful of these. We run the full set, cross-checked, plus the one dataset you cannot buy anywhere: ours.
- 01
Our own scanner
All of IPv4, every day — plus seek, the user-driven domain→IP scan that surfaces the real host behind a CDN. Nobody else's data does that on its own.
- 02
Everyone else's data
Registries, routing, reputation feeds, certificate logs, archives, sanctions lists. Paid for, normalised, cross-checked.
- 03
Ranked, not dumped
Each block carries a weight. What you should act on sits at the top. The long tail is still there when you scroll.
- 04
Parallel and streamed
Checks run at the same time and land as they finish. You read the verdict while the slow ones are still working.
- 05
Pivot anywhere
Every IP, AS and domain in a result opens its own lookup in a new tab. Follow the trail without retyping.
04Investigation workspace
One target is a lookup.
A whole case is an investigation.
Collect the IPs, domains and wallets that belong together, check them in bulk, watch how they change, and hand the whole case over as one file. Shared with your team on Professional, Team and Government plans.
Case
Wallet-drainer cluster
Bulk-check all Export PDF · ZIP
- 01
Collect indicators
Add IPs, domains and crypto wallets to a case as you find them, from any result page.
- 02
Check in bulk
Run every indicator through its module at once, instead of one target at a time.
- 03
Track over time
Re-check on a schedule and see what moved: a new origin, a fresh blocklisting, a changed verdict.
- 04
Work together
Invite colleagues into a case. Everyone sees the same evidence, as it lands.
- 05
Export the whole case
One PDF for the file, or a per-target ZIP when you need every report separately.
- 06
Search any result
Jump straight to a block, or find exactly where a value shows up across a report.
05Deliverables
Three ways to take the evidence with you.
Exhibit A
PDF report
A styled dump of the whole result page, cover verdict first. Attach it to a takedown, a ticket or a case file. Hover the stack.
Exhibit B
JSON over REST
Start a lookup, then pull each block in parallel. Every field the dashboard draws is in the payload, typed and timestamped.
Exhibit C
MCP for agents
Your assistant gets Muswa as a tool. Ask in plain words, it runs the lookups and cites the report.
- Who hosts login-secure-wallet.example, and where do I report it?
- calling muswa.domain_lookup
- It sits behind a CDN. The real server is 198.51.100.7, hosted in the Netherlands. Send the report to [email protected]. Full report linked.
06Service levels
What each plan can expect from us.
Same engine, same data, same people. Plans differ on volume, automation and how fast we answer.
- Professional12h · Priority email
- Basic48h · Email
Targets for a first reply from a person, not an auto-responder. Both plans reach the same team.
LevelBasicPro
- Lookups per day
- Basic: 100
- Professional: 250
- Parallel origin tracks
- Basic: 1
- Professional: 5
- Modules and data
- Basic: All
- Professional: All
- PDF export, history, result search
- Basic: Yes
- Professional: Yes
- Investigation workspace
- Basic: —
- Professional: Yes
- REST API and MCP
- Basic: —
- Professional: Yes
- Beta modules
- Basic: —
- Professional: Early access