Skip to content
muswa.com

01Our approach

We sweep all of IPv4.
Every single day.

Muswa runs its own scanner across every routable address on the internet and records what each server makes publicly available. Then it joins that with every public and paid source worth having, so the answer to your question sits in one place.

0.00B
addresses in IPv4
0
/16 blocks swept
0h
per full cycle
0
place to read it
sweep65,536 /16255.255.0.0
  • hosts answering
  • origin mapped
  • reserved, never scanned

One pixel = one /16 (65,536 addresses), laid out on a Hilbert curve. Densities are illustrative. Hover to inspect.

02The pipeline

Collect. Correlate. Enrich.
Score. Deliver.

Five stages between the raw internet and the page you read. Scroll through them: the instrument on the left follows along.

  1. 01Collect

    Two kinds of eyes on the internet.

    Public sources tell us who registered, who routes and who has already complained. Our own methods see what nobody publishes: a daily sweep of every routable IPv4 address, and live probes at query time.

    • Daily sweep of the routable IPv4 space
    • Registries, routing tables and public records
    • Paid reputation, phishing and sanctions data
    • Live DNS, TLS and HTTP probes when you ask

  2. 02Correlate

    Facts only matter once they are joined.

    A fact seen on one entity links it to another, and a prefix links an IP to an AS and its neighbours. We join every fact on the entities it mentions, so one lookup pulls in everything connected to it.

    • Domain ↔ the server that really hosts it
    • IP ↔ prefix ↔ AS ↔ neighbours
    • Wallet ↔ flagged activity

  3. 03Enrich

    Every entity gets the full file.

    Each joined entity is enriched with whatever applies to it: location, ownership, abuse mailbox, exposure, blocklist status, TLS grade, age. Sources that disagree are kept side by side rather than silently overwritten.

    • Normalised fields, one schema per module
    • Conflicts shown, not hidden
    • Each value timestamped

  4. 04Score

    The important thing goes first.

    Every block carries a weight from how severe the finding is, how sure we are, and whether you can act on it. The result page is sorted by that weight, so the abuse contact and the blocklist hit beat the carbon footprint.

    • Impact × confidence × actionability
    • Verdict tones: ok, warn, risk
    • Long tail kept, just lower

  5. 05Deliver

    Where you work, in the shape you need.

    The same ranked result reaches the dashboard as streaming blocks, your files as a PDF report, your scripts as JSON and your AI assistant through MCP. Every past lookup stays in your history.

    • Dashboard blocks stream in as checks finish
    • PDF, JSON and MCP from the same result
    • History you can re-open without spending quota

03Freshness

How old can a fact be?

Typical maximum age of each kind of data when you open a fresh lookup, on a log scale. Whatever the class, every block on your page shows its own timestamp.

Data class

  • Ports, TLS, headers, HTTP

    Probed live when you run the lookup

    seconds

  • DNS records

    Resolved live, several public resolvers

    seconds

  • Certificate logs

    Streamed in as certificates are issued

    minutes

  • Phishing and malware feeds

    Re-pulled continuously, short cache

    ≤ 1 hour

  • Routing and neighbours

    Refreshed through the day

    hours

  • Our IPv4 sweep

    Every routable address, every day

    ≤ 24 hours

  • Registration and network blocks

    Cached a day, re-fetched on demand

    ≤ 24 hours

  • Reputation, sanctions, stealer logs

    Updated as each list publishes

    ≤ 48 hours

04Ranking

Blocks are sorted by what they are worth to you.

Checks finish in whatever order the network allows. We don't show them that way. Each block gets three scores, and their combined weight decides where it lands.

Impact
How bad is it if this finding is true? A blocklist hit beats a missing meta tag.
Confidence
How sure are we? Verified evidence outranks a single weak signal.
Actionability
Can you do something with it today? An abuse mailbox is gold.

Arrival order (as checks finish)

BlockImp.Conf.Act.Weight
  1. ··Carbon footprint570512
  2. ··Abuse contact909610095
  3. ··Social and meta tags10951021
  4. ··Blocklists92908589
  5. ··Server location40804050
  6. ··Origin behind CDN95889593
  7. ··Header grade45985060
  8. ··Exposed files88929090
Doc SN-ROEScope scanner + live probesStatus in force

05Methodology and ethics

Rules of engagement.

Seeing the whole internet comes with obligations. These six rules bind the scanner, the live probes and the people who build them.

Network owners with a question about our traffic can write to [email protected].

  1. § 01

    Passive by default

    Most blocks read what is already public or already in our index: registries, routing, certificate logs, DNS, reputation data. Opening a lookup sends nothing unusual to the target.

  2. § 02

    Active only on demand

    Port scans, TLS confirmation, HTTP version checks and geo-traceroutes run only when you start them, against the one target you named.

  3. § 03

    Look, never touch

    No exploitation, no login attempts, no payloads, no fuzzing. Exposed-file checks request a single well-known path and record the status code.

  4. § 04

    Light on every network

    The daily sweep spreads its packets across the whole space, so any single address sees a handful of probes a day. Live probes are rate-limited per target.

  5. § 05

    Secrets are masked

    When public code leaks a key or token, we report its type and location and mask the value. We never store the secret itself and never try it.

  6. § 06

    Infrastructure, not people

    We map servers, networks, domains and wallets. We do not sell people search, tracking or personal profiles, and we refuse requests that look like it.

Next sweep cycle in --:--:-- UTC

All of it.
In one place.

Get access
How we unmask CDNs Every module