IP address investigation playbook

Verified publisher

Who holds an IP, what it exposes and what runs next to it, without scanning it

intermediateabout ip address5 toolslicence CC-BY-4.0

Contents 1/5

Tools (5)

Tools used in this guide

ipwhois Looks up who holds an IP address through RDAP: network, ASN, organisation and contactsot install osintverse-community/ipwhois
cdncheck Tells whether an IP or host is behind a CDN, cloud provider or WAF, and which oneot install osintverse-community/cdncheck
naabu Lists an IP's open ports passively from Shodan InternetDB, without scanning itot install osintverse-community/naabu
shodan-host Shows what Shodan has seen on an IP: open ports, services, banners, vulnerabilities, locationot install osintverse-community/shodan-host
mapcidr Expands, counts, splits and aggregates IP ranges in CIDR notationot install osintverse-community/mapcidr

Install them all:

ot guide tools osintverse-community/ip-investigation

IP investigation playbook

An IP address from a log, an email header or a DNS record tells you who operates the network, what the machine exposes, and what else runs next to it. This playbook stays passive: nothing here scans the address.

Steps

Tools used (ot guide tools osintverse-community/ip-investigation):

Tool	Used for
osintverse-community/ipwhois	RDAP: network, ASN, organisation, abuse contact
osintverse-community/cdncheck	Is it a CDN, cloud provider or WAF?
osintverse-community/naabu	Known open ports, from Shodan InternetDB (passive)
osintverse-community/shodan-host	Services, banners and history (needs a Shodan key)
osintverse-community/mapcidr	Expanding and counting ranges

Published 20 Oct 2026. Read it in a terminal: ot guide read osintverse-community/ip-investigation; offline: ot guide get osintverse-community/ip-investigation · Source · Markdown