# GriffinGuard

> GriffinGuard provides actionable edge-device intelligence: observed threat activity from abusive IPs, botnets, scanners and exploitation attempts, collected by a network of honeypots and sensors. Security analysts and enterprises use it to triage alerts, enrich incident response and feed IP verdicts into SIEM, SOAR and firewall tooling.

Key facts:

- Verdicts: observed IP records are classified as malicious, unknown or institutional. These labels are investigative signals, not guarantees.
- Enrichment: ASN, organization, country and city, tags (for example Mirai, brute-force, CVE identifiers), targeted ports and 7-day activity.
- Integrations: Microsoft Sentinel, Splunk, Elastic, MISP, OpenCTI, TheHive, fail2ban, pfSense / OPNsense.
- API: REST API with API keys, available with paid plans. Documentation: https://griffinguard.io/docs/index.html
- MCP: remote endpoint at https://mcp.griffinguard.io; see https://griffinguard.io/mcp for current access guidance.
- Contact: info@griffinguard.io

## Pages

- [Actionable edge-device intelligence](https://griffinguard.io/): Investigate observed activity from abusive IPs, botnets, scanners and exploitation attempts. Look up IPs and use verdicts with Sentinel, Splunk, Elastic, MISP and more.
- [IP lookup – IP threat verdicts](https://griffinguard.io/lookup): Look up any IPv4 address for its available classification, tags, targeted ports, ASN, GeoIP and activity from the GriffinGuard sensor network.
- [Compare IP reports](https://griffinguard.io/compare): Compare available verdict, network, tag, port and fingerprint data for up to four IPv4 addresses.
- [Bulk IP enrichment](https://griffinguard.io/enrich): Enrich up to 100 IPv4 addresses with authenticated GriffinGuard network and GeoIP data.
- [Scan feed documentation](https://griffinguard.io/feeds): Use GriffinGuard’s authenticated, paginated JSON scan feed and understand its supported filters.
- [Security integrations](https://griffinguard.io/integrations): Connect GriffinGuard threat intelligence to SIEM, threat intelligence, incident response and blocking tools.
- [Threat intelligence dashboard](https://griffinguard.io/dashboard): Overview of malicious, unknown and institutional IPs observed by GriffinGuard: top countries, top ASNs, targeted ports and tags, filterable by country, ASN, port, tag and classification.
- [Threat intelligence directory](https://griffinguard.io/intelligence): Explore popular ports, CVE tags, fingerprints, ASNs and countries observed by the GriffinGuard sensor network.
- [Popular port intelligence](https://griffinguard.io/intelligence/ports): Explore the most frequently targeted TCP ports observed by the GriffinGuard sensor network.
- [Popular CVE intelligence](https://griffinguard.io/intelligence/cves): Explore the CVE-tagged vulnerabilities most frequently observed by the GriffinGuard sensor network.
- [Popular fingerprint intelligence](https://griffinguard.io/intelligence/fingerprints): Explore popular JA4, JA3 and SSH fingerprints observed by the GriffinGuard sensor network.
- [Popular ASN intelligence](https://griffinguard.io/intelligence/asns): Explore autonomous systems with IPs observed by the GriffinGuard sensor network.
- [Popular country intelligence](https://griffinguard.io/intelligence/countries): Explore countries where IPs are observed by the GriffinGuard sensor network.
- [Use cases – SOC triage, incident response, automation](https://griffinguard.io/use-cases): How security teams use GriffinGuard: triage SOC alerts faster, enrich incident response with ASN, GeoIP and tags, and automate enrichment and blocking through the API.
- [Data methodology and verdicts](https://griffinguard.io/methodology): How GriffinGuard collects and enriches sensor observations, assigns IP classifications, and what the data can and cannot tell you.
- [Model Context Protocol (MCP)](https://griffinguard.io/mcp): Connect an MCP-compatible client to the GriffinGuard threat intelligence service. Authentication is required; contact GriffinGuard for setup guidance.
- [Contact GriffinGuard](https://griffinguard.io/contact): Contact GriffinGuard about product, API, integrations, or security questions.
- [API quick start](https://griffinguard.io/api-guide): Make an authenticated GriffinGuard API request with curl and the X-API-Key header. Includes links to Swagger documentation and API plans.
- [Pricing](https://griffinguard.io/pricing): Compare GriffinGuard plans. The Free tier includes web-based IP lookup; API access is not included and is available with paid plans.
- [Blog – Threat research and SOC practice](https://griffinguard.io/blog): Research and practice from the GriffinGuard team on threat intelligence, honeypot data, malware campaigns and security operations.
- [Privacy policy](https://griffinguard.io/privacy): How GriffinGuard collects, uses and protects personal data when you use griffinguard.io and the GriffinGuard API.
- [Cookie policy](https://griffinguard.io/cookies): Which cookies griffinguard.io uses, why, and how to control them.

## Blog

- [Citrix NetScaler scanning in September 2026](https://griffinguard.io/blog/netscaler-scanning): Port 443, proxies and request headers. We observed generic NetScaler fingerprinting alongside targeted validation through residential proxies after the September disclosure.
- [Understanding Honeypot Data: What Edge Devices Reveal About Global Threats](https://griffinguard.io/blog/understanding-honeypot-data): Honeypots have long been a staple in the defender's toolkit. But when deployed at scale across edge infrastructure, they paint a far richer picture of attacker behavior than traditional approaches.
- [Cluster-scale malware delivery](https://griffinguard.io/blog/cluster-crypto-exploit): Large machine learning clusters equipped with powerful GPUs are an attractive target for crypto-mining malware. We investigate active exploitation of exposed Ray orchestration endpoints that compromise entire clusters in one fell swoop.
- [Reducing SOC Alert Fatigue with IP Reputation Enrichment](https://griffinguard.io/blog/reducing-soc-alert-fatigue): IP reputation enrichment can add context to SOC alerts. Learn how to evaluate it safely in your own workflow.

## Optional

- [Full text of site content](https://griffinguard.io/llms-full.txt): all pages and blog posts as Markdown in one file
- [API documentation](https://griffinguard.io/docs/index.html)