ip_reputation_aggregate

net.fmelo/cognita · Verify this server

Fold every keyless IP-reputation source into one verdict — clean / suspicious / malicious / unknown: ip_blocklist_check (Spamhaus DROP + FireHOL), ip_reputation (GreyNoise), feodo_c2_check (botnet C2), tor_exit_check and dshield_ip_check (attack telemetry). Returns the verdict, which signals fired, and which sources answered or failed. A confirmed-bad listing forces 'malicious'; scanner/attack/Tor signals raise 'suspicious', except a research scanner GreyNoise identifies as benign (Shodan, Censys, Modat…), which is flagged but not treated as hostile; 'unknown' when too few sources answered to vouch for the IP. GreyNoise is often unavailable (a keyless quota of 25 lookups/week shared by the whole server); the verdict then rests on the other five sources and lists GreyNoise under sources failed. For a host name the first resolved IP is used. Keyless, read-only — queries the sources about the IP, never the IP itself.