Pivot map
Pivot from here
Outputs from IP lists can become inputs for the next tool. These are the most relevant follow-on pivots in the library.
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
AccountKiller provides direct deletion links and step-by-step instructions for removing accounts on hundreds of websites and social platforms.
Investigator Use
FireHOL IP Lists is a curated aggregator of threat intelligence IP blocklists from numerous public and community sources, all normalized into a consistent format for use in network security tools, firewalls, and SIEM systems. Maintained at iplists.firehol.org, it consolidates dozens of threat feeds covering malware C2 servers, TOR exit nodes, spam sources, anonymous proxies, botnets, and attacking IP ranges.
For OSINT investigators and threat intelligence analysts, FireHOL IP Lists serves as a quick validation tool for checking whether a specific IP address appears in known threat intelligence feeds. When an IP address surfaces during an investigation — from network logs, malware analysis, or infrastructure enumeration — cross-referencing it against FireHOL's aggregated lists establishes whether it is already known to the security community.
The platform's search interface allows lookups of specific IPs across all aggregated lists simultaneously, returning which specific threat categories the IP appears in and which upstream feeds reported it. This multi-feed comparison is valuable because different feeds specialize in different threat categories — an IP might not appear in a spam list but could be in a malware C2 list.
For network defenders, FireHOL IP Lists provides the raw list data for direct integration into iptables, firewall rules, Snort/Suricata signatures, or SIEM correlation rules. The lists are updated regularly and include metadata about update frequency and list confidence levels.
Investigative workflows: Run suspect IP addresses from incident logs against FireHOL to determine known threat associations, use the list data to contextualize IP addresses found during infrastructure reconnaissance, and incorporate relevant lists into network monitoring rules when setting up detection for specific threat categories.
Limitations: Threat intelligence IP lists have false positive rates and lag behind emerging threats. An IP not appearing in FireHOL lists does not confirm it is benign — it only means it has not been reported to any of the aggregated sources. Always combine FireHOL lookups with active analysis tools like Shodan, GreyNoise, and reverse DNS lookups for comprehensive IP assessment.
Before You Pivot
Capture the target, search terms, and why this source is relevant before you leave the page.
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Treat one tool as a lead source. Confirm important findings with independent sources.
Related tools
CVE provides standardized vulnerability identifiers and references used in security research, triage, and threat intelligence workflows.
CVE Details aggregates vulnerability records, CVSS scores, and affected software lists for security analysis and patch prioritization.
Find default passwords and credentials for routers, printers, servers, and network devices for authorized security auditing.
The Exploit Database archives public exploits and proof-of-concept code for known vulnerabilities, used in penetration testing and research.
HoneyDB aggregates honeypot sensor data to identify malicious IP addresses, attacker tactics, and emerging threat patterns.
Hybrid Analysis provides free malware sandboxing with Falcon Sandbox technology to analyze suspicious files and URLs for threat intelligence.