Move from a suspicious IP, hostname, or CIDR block to public-record facts without switching between multiple tabs.
Use ComUtil for first-pass investigation only: ASN ownership, registrar metadata, nameservers, certificate details, and deterministic subnet math. These pages do not score maliciousness or make final security verdicts.
Start from a public IP when you need ASN, registry, and network-range context before escalating.
Use a practical order for suspicious domains, source IPs, and provider ranges.
Confirm registrar, expiration date, nameservers, and certificate timing in one lookup.
Measure whether an address belongs to a single host, a small subnet, or a large provider block.
Use the IP guide when the question is who owns this address, which registry allocated it, and whether the range matches the provider you expected.
Use the API guide when you want the live /api/ip request shape, response fields, and guardrails before you automate a single-IP lookup.
Use the domain guide to review registrar data, nameservers, and SSL timing before you pivot into infrastructure ownership.
Use the workflow page when the investigation spans domain facts, IP ownership, and CIDR scope.
Use the CIDR guide when you need host counts, subnet boundaries, or a safer way to reason about provider-sized ranges.
Confirm registrar, expiration, nameservers, and certificate details when the investigation starts from a hostname.
Inspect ASN, registry, and network-range data to see whether the source belongs to the provider or geography you expected.
Measure how large the relevant subnet is before you widen an allowlist or blocklist to a whole provider range.
Carry verified public-record facts into your security review instead of relying on vague reputation assumptions.
Everything on these pages comes from public records you could query yourself: registry allocations, registrar entries, DNS answers, and the certificate a host presents.
ComUtil reports these facts and does not score reputation. Weigh them against your own logs and threat intelligence before you allow or block anything.
See the live /api/ip request pattern, example snippets, and response fields before you script a single-IP lookup.
Compare where WHOIS still fits for domains and where RDAP gives you more structured ownership context.
Check the exact timing behind domain expiration dates or token windows when a security review depends on chronology.
Format exported API payloads or incident notes before you share them with a teammate.
Compare old and new allowlists, deny lists, or infrastructure notes once the investigation facts are clear.