playbooks / ip-investigation

IP address → owner, services, reputation

Work out who an IP belongs to, what runs on it, what domains point to it, and whether it's known to be malicious.

start: ⌖ ip / asnyields: company, location, domain, file / doclevel: beginner

1. 01

   Ownership and routing

   Find the ASN, the announcing organisation, and whether the address is hosting, residential, mobile or VPN. Hosting means you can look for co-located domains; residential may mean a person or a proxy.

   • IPinfofreemiumacct optionalapiclidetails
   • Hurricane Electric BGP Toolkitfreedetails
   • RIPEstatfreeapidetails
   • bgp.toolsfreedetails

   → can yield: ▤Company ⊕Location

2. 02

   Reputation and noise

   GreyNoise tells you whether the IP is a mass internet scanner (benign or not). AbuseIPDB and OTX collect community reports. VirusTotal links the IP to malware samples and URLs.

   • GreyNoisefreemiumacct optionalapidetails
   • AbuseIPDBfreemiumacct optionalapidetails
   • VirusTotalfreemiumacct optionalapidetails
   • AlienVault OTXfreeacct optionalapidetails
   • Pulsedivefreemiumacct optionalapidetails

   → can yield: ◎Domain ▧File / Doc

3. 03

   Exposed services

   Internet scan engines have already scanned the IP, so you don't need to. Look at open ports, banners, TLS certificate names (often the real hostname) and HTTP titles.

   • Shodanfreemiumacct optionalapiclidetails
   • Censysfreemiumacct optionalapidetails
   • Netlasfreemiumacct optionalapidetails
   • ZoomEyefreemiumacct optionalapidetails

   → can yield: ◎Domain

4. 04

   Domains pointing here, now and before

   Passive DNS and reverse IP lookups list the hostnames that have resolved to this IP over time.

   • SecurityTrailsfreemiumacct reqapidetails
   • ViewDNS.infofreemiumapidetails
   • Robtexfreemiumapidetails
   • urlscan.iofreemiumacct optionalapidetails

   → can yield: ◎Domain