Public OSINT help

Try it

Open Public OSINT. Guest lookup works without an account.

What you can look up

Private and internal addresses are refused.

Sources (these only)

This beta uses only:

1. MITRE ATT&CK — technique context from ATT&CK. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See the ATT&CK license on the page.
2. MITRE CVE List — title, description, and references for a CVE ID from cached CVE List records. © The MITRE Corporation. CVE® and the CVE logo are registered trademarks of The MITRE Corporation. Required notice: This product uses the CVE List under the CVE Program Terms of Use. This use is not an endorsement by The MITRE Corporation or the CVE Program. See the CVE List license on the page.
3. FIRST EPSS — exploit prediction score and percentile for a CVE ID from a cached daily EPSS feed. See EPSS at https://www.first.org/epss. Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, Idris Adjerid, (2021), Exploit Prediction Scoring System, Digital Threats Research and Practice, 2(3). Required notice: This product shows FIRST EPSS scores. This use is not an endorsement by FIRST or the EPSS SIG.
4. CISA Known Exploited Vulnerabilities (KEV) — whether a CVE appears in CISA’s KEV catalog. Data is under CC0. ATA does not display the CISA logo or the DHS seal, and this use is not an endorsement by CISA or DHS.
5. NVD — vulnerability data from the NVD API. Required notice: This product uses data from the NVD API but is not endorsed or certified by the NVD.
6. Spamhaus DROP — whether an IP is listed in Spamhaus DROP. Credit the Spamhaus Project; feed date and copyright text appear with each DROP result.
7. RDAP — registry lookup when the registry answers.
8. MISP — taxonomy and galaxy labels from a pinned offline subset of MISP taxonomies and galaxies. MISP taxonomies and galaxies are published by the MISP project and its taxonomy authors (including Alexandre Dulaunoy, CIRCL, Andras Iklody, Raphael Vinot, and Deborah Servili) under CC0 1.0. Required notice: ATA reproduces a pinned subset and does not claim endorsement by the MISP project or CIRCL.
9. abuse.ch SSLBL — whether a certificate SHA-1 appears in the abuse.ch SSL Blacklist (SSLBL), from a short-lived server-side cache of the free SSLBL feed. Credit: abuse.ch SSL Blacklist (SSLBL). Required notice: This product shows abuse.ch SSL Blacklist (SSLBL) certificate data. SSLBL is free to use under CC0. abuse.ch serves SSLBL as-is on a best-effort basis. A listing is a lead from that feed. Absence from the feed leaves the indicator unresolved. This use is not an endorsement by abuse.ch.

OTX, AbuseIPDB, and GreyNoise are not part of this public beta. Community intelligence is not enabled.

How to read results (and limits)

• Treat results as reference enrichment, not a verdict. ATA does not decide whether an alert is malicious or benign for you.
• A miss does not mean “safe.” Sources are incomplete by design, update on their own schedules, and may be briefly unavailable.
• RDAP may return nothing if the registry does not answer or rate limits apply.
• DROP membership is credited to Spamhaus with the feed date shown on the result — use that date when you cite it.
• CVE List results come from a short-lived server cache of individual records and may lag the live CVE Program feed; a miss or unavailable result does not mean the CVE is invalid.
• EPSS scores come from a cached daily feed and may lag FIRST’s current file; a miss or unavailable result is not a verdict about exploitability.
• MISP labels are classification context from a pinned offline bundle, not a reputation score; the bundle may lag the upstream MISP taxonomies/galaxy refresh.
• SSLBL listings come from a short-lived server-side cache and may lag the live abuse.ch feed; a listing is a lead, not a verdict, and absence leaves the indicator unresolved.
• ATT&CK does not enumerate every possible adversary technique; see MITRE’s disclaimer on the page.
• This page does not run ATA’s AI investigation. Investigation OSINT for signed-in cases is a separate feature and is not enabled for the public.

Free usage

• Free while this beta is live. No account and no API key are required for guest lookup.
• Usage is rate-limited. If you hit a limit, wait and try again (you may see an error such as HTTP 429).

Privacy and data handling

• Guest lookup accepts no API key.
• Private and internal addresses are refused.
• Do not paste secrets, credentials, customer identifiers, or non-public alert content into the public form. Use only public indicators you are allowed to research.
• This page makes no broader privacy or storage guarantee beyond the points above.

Phishing

Not available yet. A phishing investigation workbench is planned for a later milestone. This help page will cover it after it is deployed and verified — not before.