Our Global Network
Tuxxin's products, honeypots and scanners run on points of presence in 13 countries on five continents.
Tuxxin builds and operates this network: points of presence connected at internet exchanges and a continuously replicated backbone. Every Tuxxin product runs on it, from IP intelligence and internet measurement to multi-egress threat scanning.
Tuxxin collects threat data first-hand on honeypots and scanners it operates, and our whack.sh scanner reports confirmed threats to URLhaus, MalwareBazaar and AlienVault OTX. The same data informs the exposure monitoring and threat hunting in our cybersecurity services.
Where We Run
Live and announced sites, placed by state or province in the United States and Canada and by country elsewhere. A number on a marker counts several sites in one area.
Countries by Region
Regional hubs connect at internet exchanges and replicate the backbone between continents, which keeps paths short and measurement vantage points diverse. We publish the footprint by country, and by state or province in the United States and Canada, to keep our operational fingerprint small.
Geolocation by Triangulation
Tuxxin is building its own IP geolocation database, and it treats location as a measurement problem. Every internet exchange where the network connects adds a vantage point for that measurement.
Registration records show where an address block was registered. Proxies, VPNs, carrier-grade NAT and blocks re-homed across regions answer from somewhere else.
With points of presence around the world, Tuxxin observes each address from many directions at once and triangulates where it answers from, the same principle as GPS applied to network latency and topology. More vantage points give tighter fixes, so the footprint keeps growing.
Measured Location
Each location comes from latency and topology measurements of the address itself.
Proxy and VPN Aware
Detection flags proxies and VPNs, the addresses registration records place in the wrong location.
More Angles, Tighter Fixes
Every new exchange sharpens the triangulation, the way extra satellites sharpen a GPS fix.
Keeps Up With Change
Continuous measurement tracks addresses as they move between networks and regions.
In development: the geolocation engine for worldip.io.
A Network Built to Measure and Defend
Replicated Backbone
A continuously replicated ClickHouse backbone spans multiple continents. Each region reads and writes close to home, and the full dataset stays queryable in real time.
Internet Exchange Connections
Connections at internet exchanges put sites close to the many networks that meet there and give the geolocation engine its measurement vantage points.
Multi-Region Points of Presence
Live points of presence in North America, Europe, Asia-Pacific and South America give low-latency reach into each region and observation angles on its networks.
Continuous Internet Measurement
A scanner fleet runs continuous reverse-DNS (PTR) measurement of the allocated IPv4 space for worldip.io. It sends standard PTR lookups only, answered by the DNS servers for each address block.
Honeypot Sensor Network
Honeypots across the network record live attacker and scanner behavior. That first-hand data feeds whack.sh and the threat hunting in Tuxxin's cybersecurity services.
Built for Resilience
Read replicas and regional failover let the backbone serve from another site when one goes down.
The Fleet That Runs on It
IP intelligence & continuous internet measurement
Multi-egress URL threat scanner
Anonymous external security scans
Anonymous HTTP inspection
Screenshot-as-a-service API
SSL & domain-issuance tracking
...and the wider Tuxxin Stack.
Frequently Asked Questions
See What Your Business Exposes
Fixed-price IT cost and security assessment from $2,500. Check your own domain with qsa.sh or worldip.io.
Request a Security Assessment