When to use it
You have IP address and want to check it through safe, legal, source-based research.
Back to workflows
IP / ASN workflow
Check IP and ASN reputation carefully.
A workflow for reading IP, ASN, hosting, and reputation signals without assigning blame.
Passive and safe research workflow
What you get
IP/ASN context note, reputation signals, uncertainty, and safe recommendation.
Safety boundary
This workflow is not for exploitation, probing, or unauthorized scanning. It reads public records, records dates and uncertainty, and avoids turning signals into final claims.
Simple order
Work through the steps in order.
Identify the network context
Check ASN, organization field, hosting provider, and country.
Check: Provider and owner are not confused.
Read reputation sources
Compare abuse, scanning, threat, and passive visibility sources.
Check: The date of each signal is recorded.
Look for shared infrastructure
Consider CDN, VPN, cloud, hosting, and shared IP context.
Check: A shared IP is not tied to one actor.
Write with caution
Use visible network trace language.
Check: The note avoids personal or organizational accusation.
Real tools to open
Report language
The IP/ASN has visible reputation and hosting context; this does not identify an actor by itself.
Move to evidence notesSources
Start with these sources.
AlienVault OTX
Threat intelligence
Use for IOC context, reputation checks, and defensive security notes.
Open sourceGreyNoise Visualizer
IP and ASN intelligence
Use for infrastructure context, hosting traces, and network ownership checks.
Open sourceHurricane Electric BGP Toolkit
IP and ASN intelligence
Use for infrastructure context, hosting traces, and network ownership checks.
Open sourceIPinfo
IP and ASN intelligence
Use for infrastructure context, hosting traces, and network ownership checks.
Open sourceMISP Project
Threat intelligence
Use for IOC context, reputation checks, and defensive security notes.
Open sourceMITRE ATT&CK
Threat intelligence
Use for IOC context, reputation checks, and defensive security notes.
Open source