IP Address

Use this page for passive IP investigation: registration data, ASN ownership, BGP/routing context, geolocation, anonymization checks, and related infrastructure pivots. Active port scanning belongs in Red Offensive; reputation and blacklist checks belong in Threat Data.

Threat DataReconnaissance and Scanning

IP.html Tool

IP.html is a Michael Bazzell helper that opens multiple IP research sources from one input.

Some entries in older IP.html workflows may be stale or active recon oriented. Treat port scanning as active testing, and verify each external service before relying on it.

Current useful lookup categories include:

• Search engines - Bing and other indexed references.

• Registration data - IP WHOIS and RDAP.

• Network ownership - ASN, routing, reverse IP, and infrastructure pivots.

• Cyber search - Shodan, ZoomEye, and similar indexed scan data.

• Public records - Identity or breach pivots where legally appropriate.

Local helper copy: IP.html

WHOIS vs. RDAP

WHOIS is the older protocol for IP and domain registration lookups. It is useful, but response formatting varies between registries.

RDAP (Registration Data Access Protocol) is the modern structured replacement. The RFC 7480 series was published in 2015, and RDAP adoption has continued across registries since then.

• RDAP Lookup

• ICANN RDAP

ASN Lookup

Autonomous System Numbers (ASNs) help identify who controls routed IP space and how infrastructure relates to providers, peers, and prefixes.

• Hurricane Electric BGP Toolkit - ASN, prefix, peering, WHOIS, and DNS context.

• ASNLookup - Quick ASN and prefix lookup.

• RIPE Stat - IP, ASN, and routing statistics.

• MXToolbox ASN Lookup - ASN lookup with network details.

• ipinfo.io - ASN, geolocation, organization, and IP metadata.

• UltraTools ASN Info

BGP and Routing Information

• BGPView - ASN details, prefixes, peers, and routing data.

• RIPE RIS - Real-time BGP routing data.

• Route Views - BGP route archives.

• bgp.tools - Modern BGP and ASN analysis.

• PeeringDB - Peering and interconnection data.

IP Anonymization Detection

These tools help identify Tor exits, VPN/proxy services, and other anonymization infrastructure. Cross-reference results before making enforcement decisions.

• ExoneraTor - Check whether an IP was a Tor relay on a specific date.

• SEON IP Analysis - IP risk, Tor, VPN, proxy, and blacklist context.

• IPQualityScore VPN IP Check - VPN and proxy detection.

• I Know What You Download - Torrent activity associated with an IP address.

Tor and VPN OPSEC guidance lives in the privacy section.

Grey - Privacy/TOR/OPSEC

IP Geolocation

IP geolocation is approximate. Results can reflect ISP registration, VPN/proxy exit location, cloud region, or mobile carrier infrastructure rather than a user's physical location.

• IPLocation.net

• IP2Location

• ipapi

• ipstack

• MaxMind GeoIP Demo

Additional IP Intelligence Tools

• Focsec - IP reputation API for VPN, proxy, Tor, and bot detection.

Deprecated or Unreliable Tools

These are preserved for historical reference or because they may appear in older IP.html workflows.

• Google cached pages - Google removed the classic cached-page feature from search results.

• Legacy public port-scan widgets - Treat as active testing and use current authorized scanning workflows instead.

• Unmaintained IP reputation mirrors - Prefer current providers listed on Threat Data.