Investigate a connection

Decide with the facts in front of you, not a vague warning.

Where in FireAI: Threats › Investigate, or World map › a line › Investigate…

Investigate dossier for cloudflared connecting to DNS lookups via 1.0.0.3 in Paris: “Slightly unusual · 45”, 0 of 6 threat lists name it, four reasons listed, an AI summary card, and What FireAI saw.

What it does for you

Open Investigate from a row in Threats, or from a line on the World map. The dossier explains a connection step by step, so you can judge it yourself. Turn on threat lists first — see turning on threat lists and investigating.

What you’ll see

Section	What it tells you
The label and score	Looks normal (under 30), Slightly unusual (30 to 59), Suspicious combination (60 to 84) or Very likely harmful (85 and up), with the score out of 100 as a bar.
Threat lists	How many of the threat lists you turned on name this destination, for example “0 of 6”.
Why	Each sign that raised the score: no developer signature, contacted by raw IP with no name, first time this app contacts it, cloud provider network, night-time activity, and so on.
AI summary	Optional: the on-device AI explains the evidence in three plain sentences, with links to its sources.
What FireAI saw	First and last time seen, which apps used this destination, and the company behind it.
What do you want to do?	Block for every app, Block only for this app, or It’s fine.

Good to know

Try it on your own Mac

Try every feature free for 17 days, no card needed.

Download for Mac See pricing

30-day money-back guarantee.