Know your adversaries before they strike
Real-time IP threat intelligence from a global honeypot network. Direct observation, not aggregated feeds. First-party telemetry you can trust.
Live IP Lookup
Try our API — real results from the honeypot network
API Endpoints
Eight endpoints. Complete threat picture.
From single IP lookups to full IOC feeds — everything you need to defend your network, all from first-party honeypot telemetry.
Single IP Lookup
Real-time verdict on any IP based on direct honeypot interaction. Confidence score, threat category, and recommended action.
GET /v1/ip/{ip}Batch IP Lookup
Look up 100 IPs in a single request. Perfect for SIEM enrichment and bulk triage workflows.
POST /v1/ip/batchIOC Feed
Continuous feed of indicators observed by our sensor network. Cursor-based pagination for efficient polling.
GET /v1/feeds/iocIP History
Track how an IP’s threat profile has changed over the past year. Daily snapshots for incident response timelines.
GET /v1/ip/{ip}/historyNetwork Intelligence
Reputation breakdown for CIDR subnets and ASNs. Identify hostile networks and top offenders.
GET /v1/network/{cidr|asn}Reputation Export
Bulk export IP reputation lists in JSON, CSV, or plaintext. Ready-to-use blocklists for your firewall.
GET /v1/reputation/exportDeveloper Experience
One call. Instant intelligence.
Get a full threat assessment in milliseconds. Here's what a single IP lookup returns.
curl -s https://api.sentrion.eu/v1/ip/185.220.101.34 \
-H "Authorization: Bearer YOUR_API_KEY" | jq{
"ip": "185.220.101.34",
"verdict": "malicious",
"confidence": 0.97,
"risk_score": 92,
"classification": {
"threat_type": "brute_force_scanner",
"sophistication": "moderate",
"intent": "credential_harvesting"
},
"activity": {
"first_seen": "2025-11-02T14:23:00Z",
"last_seen": "2026-02-17T08:41:00Z",
"sessions": 847,
"nodes_seen": 18
},
"evidence": {
"post_auth": true,
"commands_executed": true,
"artifacts_dropped": true,
"tcp_forwarding": false
},
"recommendation": {
"action": "block",
"reason": "Persistent brute-force scanner observed across 18 sensors."
}
}Global Coverage
22 sensors. 6 continents. Always watching.
Our global honeypot network attracts and analyzes attacks from every corner of the internet. Each sensor is a real target that attackers interact with directly.
Use Cases
Built for security teams
Whether you're triaging alerts, hardening infrastructure, or investigating incidents — Sentrion fits your workflow.
SOC Analyst
Enrich alerts automatically
Feed every alert IP through Sentrion before it hits your queue. Filter noise from real threats with first-party verdicts — not recycled blacklists.
DevOps Engineer
Block attackers at the edge
Export reputation lists in plaintext or CSV and load them directly into your firewall, WAF, or CDN rules. Automate with a single cron job.
Incident Responder
Build attacker timelines
Use IP history and campaign context to understand when an attacker was first observed, what they did, and which campaigns they belong to.
Pricing
Simple, transparent pricing
Start free. Scale when you need to. No hidden fees, no contracts (except Enterprise).
Free
Get started with basic IP lookups. Perfect for individual researchers and side projects.
- Single IP lookup (basic verdict)
- 10 requests/minute
- 100 requests/day
- Verdict + confidence + category
Pro
Advanced feeds and batch operations for security teams and SIEMs.
- Everything in Starter
- 1,200 requests/minute
- 200,000 requests/day
- 100,000 monthly quota
- Batch IP lookup (100 IPs)
Enterprise
Unlimited access, custom SLAs, and dedicated support for large organizations.
- Everything in Active Defense
- 10,000 requests/minute
- Unlimited daily requests
- Unlimited monthly quota
- Custom SLA
Start monitoring threats in minutes
Create a free account, grab your API key, and start querying. No credit card required. Upgrade when you're ready.