IP Address OSINT: Hosting, ASN, Reputation and History

Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.

TL;DR

• IP address OSINT answers network questions well: who holds the block, which network routes it, what kind of network it is, what runs on it and how it has behaved. It answers "which person" badly.
• Work in layers: registration (whois and RDAP), routing (ASN and prefix), naming (reverse and passive DNS), network type, reputation, internet-facing services, then geolocation last.
• IP geolocation is approximate. City level is the best case, and with mobile networks, VPNs and cloud hosting it is often wrong.
• BGPView closed in November 2025. Use bgp.he.net, bgp.tools, RIPEstat or Team Cymru instead.
• UserSearch brings IP Intelligence, Cyber Intelligence (Shodan Modules) and Threat Intelligence into one account, with results saved to a Case.

One IP Address, Six Different Questions

IP address OSINT is the practice of describing an internet address from public registration, routing, DNS, reputation and scan data, so you can say whose network it is, what runs on it and how it has behaved. An address turns up in a firewall log, an email header, a sign-up record or a phishing report. Someone asks "what is this?" and the temptation is to paste it into the first geolocation site that loads and report a city. That is the least reliable thing you can say about an IP address.

A better approach treats the address as a pointer into several independent datasets. Who was the block assigned to? Which network announces it on the internet today? Is it a data centre, a home broadband line or a mobile carrier? What domain names point at it now, and which pointed at it last year? Does it have a reputation? What services does it offer to the internet? Each answer comes from a different source, and each has its own freshness problem.

This guide walks through that sequence the way a SOC analyst or threat researcher would work it, with the commands for each step and the traps we see most often.

What Does IP Address OSINT Actually Answer?

IP address OSINT is the use of public registration, routing, DNS, scanning and reputation data to describe an internet address and the infrastructure around it. The key terms:

• Regional Internet Registry (RIR). Five organisations (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) assign address blocks to networks and publish who holds them.
• Autonomous System (AS) and ASN. A network under one routing policy, identified by a number. Your ISP, a cloud provider and a large enterprise each run one or more.
• Prefix. The block of addresses an AS announces, written in CIDR form such as 198.51.100.0/24.
• PTR record. The reverse DNS name for an address, set by whoever controls that block.

Every example in this article uses the documentation ranges 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24, reserved for exactly this purpose by RFC 5737, and the documentation ASN range starting at AS64496. Do the same in your own training material and reports. Real addresses in a slide deck have a way of ending up in someone's blocklist.

Why Does Hosting Attribution Matter? Sanctions and Joint Guidance

Network attribution is no longer only a SOC concern. On 1 July 2025 the US Treasury designated Aeza Group, a Russia-based hosting provider, together with subsidiaries and a UK company named in coordination with the National Crime Agency. Treasury said Aeza's servers hosted infrastructure for several cyber threat groups. For a compliance team, the question "whose network is this address on?" now has a sanctions dimension.

In November 2025, CISA, the NSA, the FBI and partner agencies, including the UK's, published Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers. It asks network defenders and ISPs to build high-confidence lists of malicious internet resources and to act on them. Those lists are built from exactly the steps below: address to prefix, prefix to AS, AS to organisation, plus reputation and history.

This is research security, fraud and compliance teams do every day. If you are building that capability, our cyber security page sets out how UserSearch supports SOC and threat research work.

The Manual Method, Layer by Layer

You need whois, dig (from the dnsutils or bind-utils package), curl and jq. A couple of steps need free API keys, which we flag as we go.

Registration Data: Whois and RDAP

Start with who holds the block.

whois 198.51.100.7
curl -sL https://rdap.org/ip/198.51.100.7 | jq '{handle, name, startAddress, endAddress, country, events}'

• whois queries the registry's text service. Output formats differ between RIRs, and the client may follow referrals from one registry to another.
• rdap.org is a bootstrap redirector that sends your query to the right RIR's RDAP server. RDAP returns structured JSON, which is far easier to parse than whois text. ARIN's RDAP documentation explains the response structure and query types.
• jq pulls out the block name, its range, the country on the registration and the registration events.

Read the result carefully. The registered holder is often a large provider, and the actual customer sits in a smaller reassignment beneath it, or is not listed at all. The country field is the registrant's country, not where the server sits. And registration data can be years old.

Routing: ASN and Prefix

Registration tells you who was assigned the block. Routing tells you who announces it today, which is not always the same organisation.

whois -h whois.cymru.com " -v 198.51.100.7"
dig +short 7.100.51.198.origin.asn.cymru.com TXT
curl -s "https://stat.ripe.net/data/network-info/data.json?resource=198.51.100.7" | jq '.data'

• The Team Cymru IP to ASN service returns the origin AS, the announced prefix, the registry and the AS name. The leading space inside the quotes stops your local whois client treating -v as its own flag. For a list of addresses, wrap them in begin and end lines and send the file with netcat whois.cymru.com 43; Team Cymru asks that bulk runs stay at a few thousand addresses, and recommends the DNS interface for recurring jobs.
• The dig query does the same over DNS. Note the reversed octets.
• RIPEstat's network-info call returns the ASN and prefix as JSON, with no key needed.

For browsing, Hurricane Electric's BGP Toolkit and bgp.tools show an AS's prefixes, peers and history. One piece of housekeeping: BGPView, which many older guides and scripts still reference, was permanently shut down on 26 November 2025, as noted in this MISP project issue. If a script of yours calls api.bgpview.io, it has been failing quietly for months.

Reverse DNS and What PTR Records Tell You

dig -x 198.51.100.7 +short

-x builds the in-addr.arpa query for you and +short prints only the answer. The PTR name is set by whoever controls the block, so it describes the network's naming habits, not the current user. Still, it is often the quickest network-type clue you have. Names containing the address itself plus words like dyn, dsl, cable or pool usually mean consumer broadband. Names like vps-1234.example.net or a cloud region code mean hosting. A custom name such as mail.example.com suggests a dedicated server. No PTR at all is common on cheap hosting.

Always check forward confirmation: resolve the PTR name and see whether it points back to the same address. If it does not, the PTR tells you little.

Passive DNS: The History of What Resolved Where

Live DNS tells you what points at an address today. Passive DNS tells you what pointed at it before. Sensors at resolvers record the answers they see, and providers build a searchable history: domain X resolved to address Y between two dates.

That history is how you connect infrastructure. One address that hosted forty lookalike domains over six months is a cluster, even if every domain now resolves elsewhere. Most passive DNS services require an account. CIRCL's Passive DNS is available to trusted partners in the security community on request, and several commercial threat intelligence platforms include it in paid plans. Two cautions: coverage depends on where the sensors sit, so absence of a record is not evidence of absence, and a shared hosting address can carry thousands of unrelated domains.

Hosting, Residential or Mobile?

Network type changes how you read everything else.

• Hosting and cloud. Addresses in data-centre ASNs are rented by the hour. Activity from them usually means a server, a VPN endpoint or automation. The provider is identifiable and has an abuse contact. The customer is not public.
• Residential broadband. One household or small office, often on an address that changes every few days or weeks. Be careful here: residential proxy networks sell traffic through home connections, and home routers taken over by botnets relay traffic too. A residential address does not mean a residential user.
• Mobile. Carriers put thousands of subscribers behind a handful of public addresses using carrier-grade NAT, with 100.64.0.0/10 set aside for the internal side by RFC 6598. Blocking a mobile address can cut off a whole town's customers.

The ASN name and PTR pattern usually settle this. Reputation services also label it, as below.

Reputation and Blocklist Data

Reputation data tells you how an address has behaved in other people's logs. Two sources we use constantly:

• Spamhaus runs DNS blocklists used by mail servers worldwide. Its web checker covers IPv4, IPv6 and domains, and its IP reputation pages explain what each list means. A listing on a policy list for dynamic address space means something very different from a listing for sending spam.
• AbuseIPDB aggregates reports from its users. The API needs a free key, and the API documentation sets the free tier at 1,000 checks a day.

curl -sG https://api.abuseipdb.com/api/v2/check \
  --data-urlencode "ipAddress=198.51.100.7" -d maxAgeInDays=90 \
  -H "Key: $ABUSEIPDB_KEY" -H "Accept: application/json" \
  | jq '.data | {abuseConfidenceScore, usageType, isp, totalReports, lastReportedAt, isTor}'

-G sends the parameters as a query string, maxAgeInDays limits the window, and the jq filter keeps the score, the usage type (which gives you the hosting, residential or mobile label), the ISP and the report count. Treat the score as a summary of other people's reports, some automated, some wrong. A cloud address with a high score may simply have belonged to a different customer last week.

Internet-Facing Services with Shodan and Censys

Search engines that scan the internet show what an address offers: open ports, service banners, TLS certificates, HTTP titles. For research on third-party infrastructure, use these indexes rather than scanning the address yourself.

pip install shodan
shodan init YOUR_API_KEY
shodan host 198.51.100.7
shodan search --fields ip_str,port,org,hostnames 'net:198.51.100.0/24'

The Shodan Python library and CLI needs an API key. shodan host prints what Shodan has seen on one address, with dates. net: searches a whole prefix, and --fields trims the output. Search filters need at least a free account, some filters need a paid plan, and query credits run out quickly on broad searches. Watch the "last seen" dates: a scan result from four months ago describes a server that may no longer exist. Censys offers similar host and certificate data with its own query language, and the two often disagree on services, so check both when it matters.

IPv6 Changes the Arithmetic

IPv6 breaks several IPv4 habits. A single customer typically gets a /64 or larger, and devices using privacy extensions rotate their address within that range regularly. One user can appear as many addresses in a day. So aggregate before you judge: compare and act at the /64 level for a single network segment, and at /56 or /48 for a customer site. Reputation for individual IPv6 addresses is thin for the same reason. Use the documentation prefix 2001:db8::/32, reserved by RFC 3849, in examples:

dig -x 2001:db8:4f1a::25 +short
whois -h whois.cymru.com " -v 2001:db8:4f1a::25"

Why IP Geolocation Is Approximate

Geolocation databases infer a place from registration data, routing, latency measurements and user corrections. They are useful for country and sometimes region. City is the best case, not the norm. MaxMind's own accuracy comparison reports, country by country, the share of addresses placed within 50 km of the right spot, and the figures vary widely, with some large European countries well under half. Mobile addresses often resolve to the carrier's gateway city. VPN and cloud addresses resolve to the data centre. Plenty of databases place an address at the geographic centre of a country when they know nothing more. State it in your reports as "the address is registered to a network in country X; commercial geolocation places it in or near city Y" and never go further.

Running the Same Checks in UserSearch

By now an analyst has a dozen browser tabs, three API keys and notes spread across a terminal history. Multiply that by the forty addresses in an incident and the friction is obvious: inconsistent checks, stale results pasted into tickets, and no record of which source said what.

UserSearch 2.0 brings the main layers into one account (our beginner's guide to UserSearch covers a first search):

• IP Intelligence for network, registration and reputation context on an address.
• Cyber Intelligence (Shodan Modules) for internet-facing services, banners and certificates without a separate Shodan subscription.
• Threat Intelligence for indicator context from threat data sources.
• Domain Intelligence for the domains that resolve to the address, including ownership history.

OneScan runs one address across several selected sources and merges the results with source attribution, showing the Credit cost before you run it. Bulk search takes up to five inputs through one Module in a batch, which suits a handful of addresses from the same incident. In Forensic Mode, every search and bookmark is stored in a Case, so the incident record shows what you checked and when. As always, results are leads: coverage and freshness depend on the third-party source, so keep the "last seen" dates in view. For the domain side of the same work, see our guide to domain OSINT from WHOIS to infrastructure.

Advanced Patterns for SOC and Threat Research Teams

Scenario One: A Burst of Sign-Ups from One Prefix

Context. The fraud team at Example Payments Ltd sees 900 new account sign-ups in two hours from addresses in 203.0.113.0/24, all passing basic checks.

Actions. Team Cymru maps the whole range to AS64500, whose name matches a budget VPS provider. PTR records follow a vps-NNNN pattern. AbuseIPDB labels the addresses as data centre and web hosting, with moderate scores from automated reports. Shodan shows the same proxy software banner on most of the addresses. Geolocation places them in three different countries, which the team notes and discounts.

Outcome. The team adds friction for sign-ups from that ASN, rather than blocking a country, and flags the 900 accounts for review. Real customers rarely sign up from a VPS range, so the false-positive cost is low. The Case records each lookup for the monthly fraud report.

Scenario Two: Mapping the Server Behind a Lure Domain

Context. A threat researcher is reviewing a copycat login page at account-check.example.com, which resolves to 198.51.100.23.

Actions. RDAP shows a small hosting company as the registered holder. Passive DNS lists 37 domains that resolved to the address in the last 90 days, most following the same naming pattern. Shodan shows a TLS certificate on port 443 whose subject lists eleven of those domains, and the same certificate fingerprint on two more addresses in 192.0.2.0/24. Spamhaus lists both addresses.

Outcome. One report to the hosting provider's abuse contact covers all three servers and the full domain list, with captures attached. The addresses and certificate fingerprint go into the team's blocklist with a review date, because hosting addresses get reassigned.

Reading the Neighbourhood of a /24

Once you have one bad address, look at its neighbours. Query the rest of the /24 in Shodan with net:, pull PTR records for the range, and check reputation in bulk. Hosting providers often give a customer consecutive addresses, so a run of similar banners or PTR names can reveal more of the same operator's servers. Clean neighbours matter too: they show you are looking at one bad tenant on a legitimate provider, not a provider that tolerates abuse.

Connecting Servers Through Certificates and Banners

Operators reuse things: TLS certificates, self-signed certificate subject fields, default page titles, SSH host keys and odd HTTP headers. Each of those is searchable in Shodan or Censys. A shared SSH host key across two addresses is strong evidence of one machine image; a shared page title is weak. Grade them accordingly.

Are IP Addresses Personal Data More Often Than You Think?

An IP address can identify a person when combined with other information, and the UK GDPR lists online identifiers in its definition, as the ICO explains in its guidance on what counts as personal data. Residential and mobile addresses in your logs are therefore likely to be personal data. Record a purpose and lawful basis for the research, keep only what you need, and set retention periods for blocklists and case notes. This is general information, not legal advice.

Keep your methods passive when researching infrastructure you do not own. Registration, routing, DNS, reputation and scan-index lookups are public data services used as intended. Port-scanning or probing a third party's servers yourself can fall foul of the Computer Misuse Act 1990 or the provider's terms, and it adds nothing the indexes do not already show. Respect each API's terms and rate limits, and share findings through abuse contacts and proper reporting channels.

Finally, be precise in what you conclude. "The address belongs to AS64500, a hosting provider, and has a history of abuse reports" is a finding. "The person is in Manchester" is not.

Frequently Asked Questions About IP Address OSINT

What is IP address OSINT?

IP address OSINT is the use of public registration, routing, DNS, scanning and reputation data to describe an internet address and the infrastructure around it. It answers network questions well: who holds the block, which autonomous system announces it, what kind of network it is, what services run on it and how the address has behaved in other people's logs.

Can IP address OSINT identify the person using an address?

IP address OSINT answers network questions, not which person was at the keyboard. Registration data names the block holder, often a large provider rather than the customer. Mobile carriers put thousands of subscribers behind a few public addresses, and residential proxies relay traffic through home connections. A sound finding names the network, its type and its history, not an individual.

How accurate is IP geolocation?

IP geolocation is approximate. Databases infer a place from registration data, routing, latency measurements and user corrections, so country is usually reliable and city is the best case, not the norm. Mobile addresses often resolve to the carrier's gateway city and VPN or cloud addresses resolve to the data centre, so reports should state geolocation with a clear caveat.

What tools are used for IP address OSINT?

Common tools for IP address OSINT are whois and RDAP for registration, Team Cymru, RIPEstat, bgp.he.net and bgp.tools for ASN and prefix data, dig for reverse DNS, passive DNS services for history, Spamhaus and AbuseIPDB for reputation, and Shodan or Censys for internet-facing services. BGPView closed in November 2025, so older scripts that call it now fail.

What is the difference between IP registration data and routing data?

IP registration data, from whois and RDAP, shows which organisation a regional internet registry assigned the address block to, and it can be years old. Routing data shows which autonomous system announces the prefix on the internet today. The two are not always the same organisation, which is why an IP address check should include both layers.

Is researching an IP address legal in the UK?

Researching an IP address with registration, routing, DNS, reputation and scan-index lookups uses public data services as intended. The UK GDPR lists online identifiers as personal data, so residential and mobile addresses need a recorded purpose, a lawful basis and set retention periods. Port-scanning a third party's servers yourself can fall foul of the Computer Misuse Act 1990.

From a Single Address to Defensible Infrastructure Findings

Good IP research is layered and humble. Registration and routing tell you whose network it is. PTR, passive DNS and scan data show what runs there and what else is connected. Reputation shows how it has behaved. Geolocation comes last and carries a caveat. Put together, those layers turn one address into a picture of infrastructure you can act on and explain.

Stop guessing. Start researching with UserSearch. Run IP Intelligence, Cyber Intelligence (Shodan Modules) and Threat Intelligence from one UserSearch account, reach 100+ third-party data sources without juggling separate keys, combine them with OneScan, and keep every lookup in a Case you can hand to the next analyst or turn into a report.