What Our Threat Intelligence Covers
WAYSCloud aggregates threat data from multiple independent sources to provide comprehensive IP risk assessment:
- Community reporters — Real-time reports from fail2ban integrations and security administrators worldwide
- Curated blocklists — Expert-maintained lists of known malicious networks with extremely low false positive rates
- Malware intelligence — URLs and domains hosting malware, resolved to their hosting IP addresses
- Crowdsourced abuse data — Community-submitted abuse reports from verified threat intelligence platforms
Our unified scoring engine weighs each data source by trust level, applies time decay (recent reports matter more), and rewards multi-source corroboration — an IP flagged by multiple independent sources receives a higher threat score than one flagged by a single reporter.
How to Interpret Results
0 - 19
Clean — No threat activity observed. Safe to allow.
20 - 39
Low Risk — Minor or outdated threat signals. Monitor if targeting sensitive systems.
40 - 59
Medium Risk — Active threat reports from one or more sources. Consider blocking for sensitive services.
60 - 79
High Risk — Multiple corroborated threat reports. Block recommended for most use cases.
80 - 100
Critical — Confirmed malicious. Block immediately. Known attack infrastructure.
Automate with the API
Need to check IPs programmatically? The WAYSCloud API lets you integrate threat intelligence into your security infrastructure:
# Check any IP address
curl -s https://ip.wayscloud.services/api/v1/ip/185.220.101.1
# Get threat score and risk level
curl -s https://ip.wayscloud.services/api/v1/ip/185.220.101.1 | jq '.intelligence_data.threat_score'
# Batch check with your security scripts
for ip in $(cat suspicious_ips.txt); do
score=$(curl -s "https://ip.wayscloud.services/api/v1/ip/$ip" | jq -r '.intelligence_data.threat_score // 0')
echo "$ip: $score"
done