0 questions.
No marketing answers.

Anyone with a legitimate investigative or defensive need: abuse desks, security researchers, SOC and IT teams, investigators and public agencies.

When you register you tell us whether you are an individual, a company or a public body. Company accounts need a work email on the company domain, and government accounts need an official government address.

No. Accounts are personal and the daily quota is tied to one person. Sessions can be reviewed and revoked from your settings.

For a group, set up a Team or Government organisation instead: an owner holds a prepaid balance and gives colleagues their own seats, each with its own quota, under one shared activity log.

Yes. A Team (for companies) or Government organisation is provisioned by us: the owner tops up a prepaid balance and adds colleagues as seats on the standard plans, debited from that balance, with per-member usage and quota controls and an activity log. Organisations also get the shared Investigation workspace and a per-organisation discount.

Companies can start on the enterprise page; public agencies should write to [email protected] from an official address.

From Settings in the dashboard. Every sensitive change is protected by a captcha and confirmed by a link sent to your email, so a stolen session alone cannot take over the account.

Both see the same modules and the same data. Basic ($25/month) gives 100 lookups a day and one concurrent origin track. Professional ($50/month) gives 250 lookups a day, five concurrent origin tracks, the shared Investigation workspace, the REST API, the MCP server for AI assistants, early access to beta modules and priority support.

Yes. Paying for 6 months takes 10% off. Paying for a year gives you two months free: you pay for ten.

Through a hosted crypto checkout: you pick the coin and the network, and your plan activates as soon as the payment confirms. Unpaid invoices expire after 24 hours. More payment methods are planned.

Access starts the moment your payment confirms, so payments are generally non-refundable. If a fault on our side stops you from using the service, contact us within 14 days and we will extend your plan or refund you.

No. To see exactly what you get before paying, open the demo report: it is a complete, real-format result page.

From our own internet-wide scanning combined with many public and commercial intelligence sources, merged into a single view. We do not disclose individual sources, but every block on a result page is computed fresh or from a recent cache, and timestamped.

For as long as your account exists, so you can reopen past reports without spending a lookup. When you delete your account, your history goes with it. Technical logs are purged on a rolling schedule, and billing records are kept only as long as the law requires.

Never. We do not sell personal data, we do not run advertising trackers, and we do not share what you investigate with anyone, except when a valid legal order compels us. Processors we rely on (hosting, email delivery, payment checkout, captcha) only receive what they need to do their job.

No. Lookups are confidential. Most checks are passive; the few that touch a target (for example a TLS handshake or an HTTP request) look like ordinary traffic and carry nothing that identifies you.

Professional. The REST API runs the same engine as the dashboard and draws on the same daily quota. You can hold up to ten active API keys and revoke them at any time.

MCP (Model Context Protocol) lets AI assistants call external tools. Connect your coding agent or chat assistant to the Muswa.com MCP server with your API key, and it can run IP, domain, AS, wallet and malware-hash recon, and unmask CDN origins, by itself inside your conversation.

Yes, to keep the platform fast for everyone. Limits are reported in standard RateLimit headers on every response, and errors use a consistent JSON problem format. Enterprise agreements can raise them.

IP addresses, domains, autonomous systems and crypto wallets, each in its own module. You can also paste a malware hash into the IoC Finder for a merged report from many malware-intelligence sources, and resolve the real origin IP behind a CDN or WAF.

Domain recon now also verifies whether a mailbox actually receives mail (deliverable, catch-all, disposable or role) and checks major blocklists and a site's category — useful for abuse and fraud triage.

Paste a Bitcoin, Ethereum or Tron address and it screens the wallet for risk: matches against sanctions and OFAC lists, known scam, drainer, ransomware and abuse tags, and exposure to high-risk services, ending in a clear verdict you can attach to a case.

It is built for compliance and fraud triage — a fast yes/no on whether an address is dangerous to transact with — not for tracing fund flows transaction by transaction.

The origin module is built to discover the hosting origin behind a CDN or WAF. It cross-checks our scan data, certificate history and passive records for the server that actually answers for a domain, so you can see where a site is really hosted instead of the proxy in front of it.

For harder cases, an origin track can run a deeper search in the background across our scan data. Each track counts against your concurrent-track allowance.

Give it a file hash (MD5, SHA-1 or SHA-256) and it returns one merged report: the detection ratio across the industry, the family and tags the file is known by, how it behaves when detonated, the IPs, domains and URLs it reaches, and the file's own identity. Where the sample can be shared, you can download it.

A shared case where you collect the indicators that belong together (IPs, domains and wallets), check them all in one go, watch how they change over time, collaborate with colleagues and export the whole case as a PDF or a per-target ZIP. It is included with Professional and with every Team and Government organisation.

You can also search within any single result to jump to a block or find exactly where a value appears.

Anything unlawful, and in particular: stalking, harassing or doxxing people, attacking or disrupting the hosts you investigate, reselling our results, or scraping the platform. Accounts used this way are closed without refund.

By email to [email protected], from an official address, with the legal basis and the precise data requested. The full process and per-country notes are on the Legal requests page.

Yes. Vetted agencies get a discounted rate, negotiated per agency and agreed upfront, and can use tools that are not yet public. Access is reduced for legitimate public-interest work, but it is paid, never free. Write to [email protected] from an official address to start the vetting.

Passwords must be at least 16 characters and are stored with a modern memory-hard hash. Sessions use secure, HttpOnly cookies. Logins and sensitive changes are protected by a captcha and email confirmation, and you can revoke any active session.

Yes. High and critical findings are rewarded in cash at our discretion; lower severities earn free plan time. Scope, rules and the safe-harbour statement are on the Bug bounty page. Reports go to [email protected].