ipwhois Looks up who holds an IP address through RDAP: network, ASN, organisation and contactsot install osintverse-community/ipwhois
cdncheck Tells whether an IP or host is behind a CDN, cloud provider or WAF, and which oneot install osintverse-community/cdncheck
naabu Lists an IP's open ports passively from Shodan InternetDB, without scanning itot install osintverse-community/naabu
shodan-host Shows what Shodan has seen on an IP: open ports, services, banners, vulnerabilities, locationot install osintverse-community/shodan-host
mapcidr Expands, counts, splits and aggregates IP ranges in CIDR notationot install osintverse-community/mapcidr
Install them all:
ot guide tools osintverse-community/ip-investigation
Scope and legal
Passive only. Every tool in this playbook reads data that registries, CDNs and internet-wide scanners already
publish. Scanning an address yourself (port scans, vulnerability checks) needs the owner's written permission.
An IP is not a person. Home connections change address, many users share one address behind carrier NAT, and
VPNs, Tor and cloud hosts sit in front of almost everything. Use an IP to find the operator of a network, not to name
an individual.
Abuse contacts are for abuse. RDAP gives you the network's abuse address. Use it to report real abuse, not to
ask for subscriber details; those only come through legal process.
Published 20 Oct 2026. Read it in a terminal: ot guide read osintverse-community/ip-investigation; offline: ot guide get osintverse-community/ip-investigation · Source · Markdown