OTInstaller
Sign in

IP address investigation playbook

Verified publisher

Who holds an IP, what it exposes and what runs next to it, without scanning it

intermediateabout ip address5 toolslicence CC-BY-4.0
Contents 4/5
  1. 1 IP investigation playbook
  2. 2 Scope and legal
  3. 3 Who holds the address
  4. 4 What it exposes
  5. 5 Ranges and neighbours
Tools (5)

Tools used in this guide

  • ipwhois Looks up who holds an IP address through RDAP: network, ASN, organisation and contactsot install osintverse-community/ipwhois
  • cdncheck Tells whether an IP or host is behind a CDN, cloud provider or WAF, and which oneot install osintverse-community/cdncheck
  • naabu Lists an IP's open ports passively from Shodan InternetDB, without scanning itot install osintverse-community/naabu
  • shodan-host Shows what Shodan has seen on an IP: open ports, services, banners, vulnerabilities, locationot install osintverse-community/shodan-host
  • mapcidr Expands, counts, splits and aggregates IP ranges in CIDR notationot install osintverse-community/mapcidr

Install them all:

ot guide tools osintverse-community/ip-investigation

What it exposes

Internet-wide scanners already probe every IPv4 address. Reading their data is passive.

Free: Shodan InternetDB

ot run osintverse-community/naabu --ip 1.1.1.1

This runs naabu in passive mode: it reads the open ports Shodan's InternetDB lists for the address, without sending anything to it.

With a Shodan key: services and banners

ot keys set SHODAN_API_KEY
ot run osintverse-community/shodan-host --ip 1.1.1.1

You get each open port with the service banner, software versions, TLS certificate details, host names Shodan has seen, and known vulnerabilities for the versions it detected. The key is stored in your OS keychain and passed to the tool only for that run.

Reading it

  • Remote access (SSH, RDP, VNC) and admin panels say what the machine is for.
  • Certificates and host names in banners are the best pivot: they name the domains served from the machine.
  • Default pages of web servers or appliances often show the product and version.

Note

Scanner data is days or weeks old. Check the timestamps before drawing conclusions about the machine today.

Next: ranges and neighbours.

Published 20 Oct 2026. Read it in a terminal: ot guide read osintverse-community/ip-investigation; offline: ot guide get osintverse-community/ip-investigation · Source · Markdown

Esc

Try

↑ ↓ to move↵ to open