🌐 IP Address
Internet Protocol address identifying a device or server on a network.
Network
🔧 Native workbench
🔎 Live indicators (IoC view)
🔗 Analyst pivots
🔌 Sources that yield IP Address (6)
| Source | Category | Auth | Format | |
|---|---|---|---|---|
| abuse.ch ThreatFox Family-labelled IoC exchange. | Threat Analysis | NONE | json | home↗ api↗ |
| CISA Automated Indicator Sharing US-CERT indicator sharing / advisories. | Threat Analysis | NONE | xml | home↗ |
| FireHOL IP Blocklists Aggregated abusive-IP blocklists. | Operational Security | NONE | text | home↗ api↗ |
| Tor Bulk Exit List Authoritative Tor exit-node list. | Dark Web | NONE | text | home↗ api↗ |
| AlienVault OTX Pulses Community threat-intel pulses (free key). | Threat Analysis | KEY | json | home↗ api↗ |
| Shodan ICS/SCADA Exposed ICS/SCADA device discovery. | Critical Infrastructure | KEY | json | home↗ api↗ |
🧭 Disciplines
🎯 Mission Domains
🔍 Lookup
🔄 Live Datasets & APIs (3 key-free · ingestible)
📜 Playbook — IP Address exploitation
- Direction — frame the requirement for IP Address: what decision does this support, by when?
- Collection — pull the 6 mapped sources (4 free) and the native workbench (open); capture provenance and observe OPSEC.
- Processing — normalize, de-duplicate and enrich the collected data.
- Analysis — correlate against local holdings; apply ACH; assign confidence.
- Dissemination — open a case, draft a report, share via STIX/MISP.
- Feedback — set an alert rule / watchlist to monitor for change.
⚡ AI Skills & Automation
Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).
🧩 Advanced Capabilities
✨ Enrichment pathways
🎫 IP Address
An IP address is a numeric identifier (IPv4 or IPv6) assigned to a host or interface on a network, marking where traffic originates or terminates. In investigations it geolocates and attributes infrastructure, links hosts across campaigns via shared hosting, and drives blocking, netflow correlation, and scanning telemetry.
Format: IPv4 dotted quad (0-255)x4; IPv6 eight hextets with :: compression. Validate RFC 1918/RFC 4193 private, CGNAT 100.64/10, bogon and reserved ranges.
📡 How it is collected
- DNS A/AAAA resolution of domains
- Firewall / proxy / netflow logs
- Passive DNS reverse records
- Honeypot and scanner telemetry
- Malware C2 beacon captures
- Email Received headers
📚 Enrichment & validation sources
🔗 Pivot to
🧩 Analysis & hunting techniques
- ASN / netblock ownership mapping
- Reverse (PTR) and passive DNS pivoting
- Port/banner fingerprinting
- Scanner vs. targeted-traffic classification (GreyNoise)
- Geolocation and hosting-type analysis
- Co-hosting / virtual-host clustering
- Netflow peer correlation
- Reputation and blocklist aggregation
🔧 Tools
- Shodan
- Censys
- nmap
- masscan
- MaxMind
- whois/cymru
- Zeek
- MISP
⚡ Workbench actions
- Resolve reverse DNS (PTR)
- Query passive DNS
- Look up ASN / CIDR owner
- Scan open ports & banners
- Check GreyNoise / AbuseIPDB reputation
- Screen against sanctions & blocklists
- Cluster by ASN
- Pivot to netflow peers
📊 Dashboard KPIs
Abuse confidence score (AbuseIPDB)Open port countGreyNoise classification (benign/malicious/unknown)Distinct domains resolving hereFirst/last-seen span
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron