Investigate an IP address
Work out who an IP belongs to, what runs on it, and whether it is known for abuse.
- Starts with
- IP address
- Useful for
- Suspicious log entries, attack sources, a server behind a scam site.
- Time
- 15–30 minutes
- Progress
- 0 of 5 steps ·
Type a value into any step and every step of the same type fills in, with direct search links. Values stay in this tab and are not saved; only which steps you ticked is remembered, in your browser.
1. Who owns it
Why: The network owner tells you whether it is a home connection, a cloud server, a VPN or a company.
Do: Look up the network (ASN), organisation and country. Check the regional registry for the abuse contact.
Look for:- A hosting or cloud provider, which means a rented server rather than a person
- The abuse contact for reporting
2. Is it a VPN, proxy or Tor exit
Why: Anonymising services mean the IP does not lead to the real person, which saves you chasing it.
Do: Check anonymiser detection and whether it was a Tor relay on the date you care about.
Look for:- VPN or proxy flags
- Tor relay status on the date of the activity
3. Check its reputation
Why: Mass scanners and botnets are reported constantly. Targeted attackers usually are not.
Do: Search the IP in abuse databases and honeypot networks.
Look for:- Many reports for scanning (background noise) versus few or none (possibly targeted)
- The categories and dates of reports
4. See what runs on it
Why: Open services and certificates reveal what the server is for and who operates it.
Do: Look at open ports, service banners and TLS certificates recorded by internet scanners.
Look for:- Certificates naming domains you can pivot to
- Admin panels, remote desktop or known command-and-control software
5. Find domains hosted on it
Why: Other domains on the same IP may belong to the same operator.
Do: Run a reverse IP lookup and a passive DNS search.
Look for:- Domains with similar names or registration dates