NetIntel - Unified IP & Domain Intelligence MCP server

NetIntel - IP + Domain Intelligence

Unified IP and domain intelligence - WHOIS, DNS, GeoIP, ASN, reputation, port scanning in one structured response with confidence scoring.

Available as an Apify Actor. Pay-per-event. Cheaper than IPinfo Standard ($249/month) or DomainTools ($1000+/year) for low-volume use.

What does it do?

Takes an IP or domain and returns unified network intelligence: WHOIS registration, full DNS record set (A/AAAA/MX/NS/TXT/CAA/SOA), GeoIP location, ASN and BGP routing, reputation against threat feeds, and optional top-100 port scan. Confidence-scored fields so analysts know which data points are authoritative vs derived.

How is it different from running WHOIS / dig / GeoIP / AbuseIPDB / Nmap separately?

Returns confidence-scored unified output: WHOIS (high confidence), DNS (high), GeoIP (medium, depends on source), ASN (high), reputation (varies by feed).

When should I use it?

• SOC alert enrichment - one call returns everything an analyst needs
• Threat intelligence - profile a suspicious IP or domain
• Due diligence on a domain pre-acquisition
• Abuse response - quickly identify the owner and hoster of a malicious IP
• OSINT investigation - unified domain intelligence in one record

What does it cost?

Pay-per-event:

Typical scan costs

• Single IP or domain: $0.05
• Bulk 100 targets: $5.00

Which inputs does it take?

What does the output look like?

Each dataset record:

{
  "target": "1.1.1.1",
  "whois": {
    "organization": "Cloudflare, Inc.",
    "country": "US"
  },
  "dns": {
    "reverse": "one.one.one.one"
  },
  "geoip": {
    "city": "Los Angeles",
    "country": "US",
    "confidence": "medium"
  },
  "asn": {
    "number": 13335,
    "name": "CLOUDFLARENET"
  },
  "reputation": {
    "malicious": false,
    "feeds_checked": 5
  },
  "ports": [
    {
      "port": 53,
      "service": "dns"
    },
    {
      "port": 443,
      "service": "https"
    }
  ]
}

Common questions

Q: Need full Nmap port scanning? Use sibling nmap-scanner for full Nmap with NSE scripts. NetIntel's port scan is top-100 lightweight only.

Q: Need passive DNS history? Different use case - chain to a passive DNS specialist. Or DM LinkedIn to request a passive DNS feature.

Q: Reputation feed missing? DM LinkedIn - custom feed integrations ship within 1-2 hours.

About the maintainer (priority response within 1-2 hours)

Built and maintained by Anshuman Atrey (@AnshumanAtrey).

• Purple-team security researcher, 5x hackathon winner
• Co-founder of Project AISHA (AI cybersec SaaS) and The Drone Syndicate (autonomous defence drones)
• Author of the canonical OSINT actor portfolio on Apify Store: 12+ shipped actors covering email, phone, username, IP/domain, network, secret, social, LinkedIn, and Indian fintech OSINT

Custom feature requests shipped within 1-2 hours (priority)

Shortened. The full README is on GitHub.