Data Points

🧱 IP Range / CIDR

A block of IP addresses expressed in CIDR notation — the unit of network ownership and allocation.

Network

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

open →

native tool

🔧 Native workbench

Open IP Range / CIDR workbench →Advanced search →Link analysis →

🔎 Live indicators (IoC view)

CIDR indicators →IoC dashboard →Search cidr →

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔍 Lookup

📜 Playbook — IP Range / CIDR exploitation

Direction — frame the requirement for IP Range / CIDR: what decision does this support, by when?
Collection — pull the 0 mapped sources (0 free) and the native workbench (open); capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 IP Range / CIDR

A CIDR block is an IP range expressed as a prefix and mask (e.g. 192.0.2.0/24) representing a contiguous allocation of addresses. In investigations it defines the ownership and scope of infrastructure, enables range-based blocking and hunting, and links individual hosts to their allocating organization and routing ASN.

Format: network/prefix-length: IPv4 /0-/32, IPv6 /0-/128; network address must align to the mask boundary (host bits zero for canonical form).

📡 How it is collected

RIR allocation / assignment records
BGP announced prefixes
Whois netrange objects
IP-to-ASN mapping expansion
Reverse DNS delegation zones
Scanning coverage inventories

📚 Enrichment & validation sources

RIPEstat →ARIN/RIPE/APNIC whois →Team Cymru →bgp.he.net →Shodan →Censys →Spamhaus DROP/EDROP →ipinfo →

🔗 Pivot to

ASN →IP Address →allocating org / registrant →abuse contact →reverse DNS zone →parent/child prefixes →

🧩 Analysis & hunting techniques

Range expansion and live-host sweeping
Netblock ownership / abuse-contact lookup
Reputation aggregation across the range
More-specific / less-specific prefix analysis
Reverse-DNS zone mapping
Allocation-history tracking
Range-wide service fingerprinting
Bulk blocklist generation

🔧 Tools

nmap
masscan
Shodan
prips
ipcalc
whois
Censys
zmap

⚡ Workbench actions

Expand range to host list
Sweep for live hosts & services
Look up netblock owner / abuse contact
Aggregate reputation across range
Map reverse-DNS zone
Screen against DROP lists
Cluster to parent ASN
Export firewall block rules

📊 Dashboard KPIs

Total addresses in blockLive-host density (%)Malicious-IP ratioDistinct services observedAllocation age

📂 Open

Data point profile →ASN profile →Netflow explorer →Sanctions screening →Correlate →Country dashboard →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook