diff --git a/README.md b/README.md
index bc1dd43..c18bbb7 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,8 @@ Your ultimate IP dex!
**ipdex** is a simple CLI tool to gather insight about a list of IPs or an IP using the [CrowdSec CTI](https://www.crowdsec.net/cyber-threat-intelligence) (Cyber Threat Intelligence) API.
+
+
---
## Table of Contents
@@ -149,13 +151,17 @@ Enter your API key and set your preferences.
ipdex 1.2.3.4
```
+
+
### 5. Scan a file
```bash
-ipdex file ips.txt
-ipdex file /var/log/nginx.log
+ipdex ips.txt
+ipdex /var/log/nginx.log
```
+
+
---
## Configuration
@@ -258,6 +264,7 @@ By default, the `since` parameter is set to `30d`.
⚠️ Each queried page counts as 1 quota.
+
#### Search IPs reported for a specific CVE
diff --git a/img/ipdex_file.svg b/img/ipdex_file.svg
new file mode 100644
index 0000000..b5c7ad7
--- /dev/null
+++ b/img/ipdex_file.svg
@@ -0,0 +1,215 @@
+
+
+
+
+
+ipdex ips.txt -y -d
+
+
+
+
+
+
+
+
+Enriching with CrowdSec CTI: 47.128.18.160 [ 15 / 15 ] ███████████████████ 100% | 0s
+
+General
+
+Report ID 12
+
+Report Name Photon-Pulse-Report
+
+Creation Date 2025-12-18 15:22:08
+
+File path /Users/crowdsec/github/ipdex/ips.txt
+
+SHA256 7ef60e5a47311f55b89167bb3cf6bb556141d400d207289fb52cd81da4c23e1b
+
+Number of IPs 15
+
+Number of known IPs 15 (100%)
+
+Number of IPs in Blocklist 15 (100%)
+
+Stats
+
+🌟 Top Reputation
+
+Malicious 15 (100%)
+
+Unknown 0 (0%)
+
+🗂️ Top Classifications
+
+Bytedance AI crawler 15 (100%)
+
+CrowdSec Community Blocklist 15 (100%)
+
+🤖 Top Behaviors
+
+HTTP Scan 15 (100%)
+
+HTTP DoS 3 (20%)
+
+HTTP Exploit 2 (13%)
+
+HTTP Bruteforce 1 (7%)
+
+HTTP Crawl 1 (7%)
+
+⛔ Top Blocklists
+
+CrowdSec Intelligence Blocklist 15 (100%)
+
+Targeted Country: Germany 4 (27%)
+
+🌐 Top IP Ranges
+
+47.128.0.0/14 15 (100%)
+
+unknown 0 (0%)
+
+🛰️ Top Autonomous Systems
+
+AMAZON-02 15 (100%)
+
+unknown 0 (0%)
+
+🌎 Top Countries
+
+SG 🇸🇬 15 (100%)
+
+unknown 🏳️ 0 (0%)
+
+IP | Country | AS Name | Reputation | Confidence | Reverse DNS | Profile | Behaviors | Range
+
+47.128.18.145 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan... | 47.128.0.0/14
+
+47.128.18.146 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan | 47.128.0.0/14
+
+47.128.18.147 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan | 47.128.0.0/14
+
+47.128.18.148 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan | 47.128.0.0/14
+
+47.128.18.149 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan, HTTP Exploit | 47.128.0.0/14
+
+47.128.18.15 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan, HTTP Exploit | 47.128.0.0/14
+
+47.128.18.150 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan, HTTP DoS | 47.128.0.0/14
+
+47.128.18.151 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan | 47.128.0.0/14
+
+47.128.18.153 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan, HTTP Crawl | 47.128.0.0/14
+
+47.128.18.154 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan | 47.128.0.0/14
+
+47.128.18.156 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan, HTTP DoS | 47.128.0.0/14
+
+47.128.18.157 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan, HTTP DoS | 47.128.0.0/14
+
+47.128.18.159 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan | 47.128.0.0/14
+
+47.128.18.16 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan | 47.128.0.0/14
+
+47.128.18.160 | 🇸🇬 SG | AMAZON-02 | malicious | high | ...t-1.compute.amazonaws.com | CrowdSec Community Blocklist | HTTP Scan | 47.128.0.0/14
+
+Created report with ID '12'.
+
+View report ipdex report show 12
+
+View all IPs in report ipdex report show 12 -d
+
+
+
+
+
+
\ No newline at end of file
diff --git a/img/ipdex_search.svg b/img/ipdex_search.svg
new file mode 100644
index 0000000..9c94fcb
--- /dev/null
+++ b/img/ipdex_search.svg
@@ -0,0 +1,243 @@
+
+
+
+
+ipdex search 'cves:CVE-2025-55182' --since 30m
+
+
+
+
+
+
+
+
+
+
+SUCCESS Fetching complete!
+
+General
+
+Report ID 10
+
+Report Name Echo-Shadow-Report
+
+Creation Date 2025-12-18 15:20:00
+
+Query cves:CVE-2025-55182
+
+Since Duration 30m
+
+Since Time 2025-12-18 14:50:00
+
+Number of IPs 110
+
+Number of known IPs 110 (100%)
+
+Number of IPs in Blocklist 7 (6%)
+
+Stats
+
+🌟 Top Reputation
+
+Suspicious 55 (50%)
+
+Known 32 (29%)
+
+Malicious 22 (20%)
+
+Benign 1 (1%)
+
+Unknown 0 (0%)
+
+🗂️ Top Classifications
+
+Data Center IP 101 (92%)
+
+CrowdSec Community Blocklist 5 (5%)
+
+Many Services Exposed 2 (2%)
+
+Attacker Group: Exciting Dodgerblue Quetzal 2 (2%)
+
+Residential IP 2 (2%)
+
+🤖 Top Behaviors
+
+HTTP Exploit 110 (100%)
+
+HTTP Scan 24 (22%)
+
+HTTP Bruteforce 12 (11%)
+
+HTTP DoS 4 (4%)
+
+SSH Bruteforce 3 (3%)
+
+⛔ Top Blocklists
+
+CVE-2025-55182 - React2Shell Attackers 5 (5%)
+
+CrowdSec Intelligence Blocklist 3 (3%)
+
+High Background Noise 2 (2%)
+
+Targeted Country: Germany 1 (1%)
+
+Education Attackers 1 (1%)
+
+💥 Top CVEs
+
+CVE-2025-55182 110 (100%)
+
+CVE-2017-9841 1 (1%)
+
+CVE-2021-26086 1 (1%)
+
+CVE-2022-35914 1 (1%)
+
+CVE-2024-21887 1 (1%)
+
+🌐 Top IP Ranges
+
+35.176.0.0/13 7 (6%)
+
+3.96.0.0/11 7 (6%)
+
+44.224.0.0/11 6 (5%)
+
+108.128.0.0/13 5 (5%)
+
+3.128.0.0/10 4 (4%)
+
+🛰️ Top Autonomous Systems
+
+AMAZON-02 86 (78%)
+
+AMAZON-AES 9 (8%)
+
+DIGITALOCEAN-ASN 3 (3%)
+
+OVH SAS 3 (3%)
+
+Yandex.Cloud LLC 2 (2%)
+
+🌎 Top Countries
+
+US 🇺🇸 36 (33%)
+
+CA 🇨🇦 14 (13%)
+
+IE 🇮🇪 14 (13%)
+
+JP 🇯🇵 14 (13%)
+
+DE 🇩🇪 10 (9%)
+
+Created report with ID '10'.
+
+View report ipdex report show 10
+
+View all IPs in report ipdex report show 10 -d
+
+
+
+
+
+
\ No newline at end of file
diff --git a/img/ipdex_single_ip.svg b/img/ipdex_single_ip.svg
new file mode 100644
index 0000000..2a8fa59
--- /dev/null
+++ b/img/ipdex_single_ip.svg
@@ -0,0 +1,143 @@
+
+
+
+
+ipdex 137.184.231.98
+
+
+
+
+
+
+
+
+IP Information
+
+IP 137.184.231.98
+
+Reputation malicious
+
+Confidence high
+
+Country US 🇺🇸
+
+Autonomous System DIGITALOCEAN-ASN
+
+Reverse DNS zgxnutraceuticals.com
+
+Range 137.184.224.0/20
+
+First Seen 2022-04-22T18:00:00
+
+Last Seen 2025-12-02T19:45:00
+
+Console URL https://app.crowdsec.net/cti/137.184.231.98
+
+Last Local Refresh 2025-12-18 14:00:49
+
+Threat Information
+
+Behaviors
+
+HTTP Scan
+
+HTTP Exploit
+
+HTTP Bruteforce
+
+... and 1 more
+
+Classifications
+
+Data Center IP
+
+Attacker Group: Nervous Teal Creeper
+
+CrowdSec Community Blocklist
+
+Blocklists
+
+HTTP Exploit Attackers
+
+CrowdSec CVE-2024-4577
+
+Exploiting CVEs
+
+CVE-2025-8943
+
+CVE-2025-8868
+
+CVE-2025-64446
+
+... and 237 more
+
+Target countries
+
+🇺🇸 US 28%
+
+🇩🇪 DE 17%
+
+🇫🇷 FR 17%
+
+... and 2 more
+
+
+
+
+
+
\ No newline at end of file
