Canaries perform a reverse host (DNS PTR) lookup against the source IP of an incident by default to provide you with additional information about the incident (seen in the 'Reverse IP Lookup' field in the screenshot below).
If you would prefer that some or all of your Canaries don't perform these reverse lookups, you can reach out to support@canary.tools and we will happily disable it for you. Your alerts will then look like the example below without the 'Reverse IP Lookup' field.