An IP address is a strong pivot point: it links infrastructure, reveals a hosting provider, and can connect seemingly unrelated domains and campaigns. This method reads an IP from ownership down to reputation without ever touching the host.
What you'll need
- The target IP address (IPv4 or IPv6)
- Domain and infrastructure tools from the Domain names & usernames category
- Reputation and threat sources from the Threat Intelligence category
Steps
- Find who owns the range. Look up the IP's WHOIS and its autonomous system (ASN). This tells you the network operator — a cloud provider, an ISP, or an organization's own range — which frames everything that follows.
- Locate it, cautiously. Geolocation databases place an IP by region, but they map the network, not the user; a VPN, proxy, or datacenter will mislead you. Treat city-level results as a hypothesis, not a fact.
- Run a reverse DNS lookup. The PTR record and hostname often reveal the provider, the service, or a naming scheme you can pivot on.
- Find the domains it hosts. Use passive DNS and reverse-IP services to list domains that resolve (or once resolved) to the address. Shared hosting will show many unrelated sites; a dedicated host tightens the link between them.
- Check its reputation. Query threat-intelligence and blocklist sources to see whether the IP is associated with malware, spam, scanning, or phishing, and note the dates — reputation is only meaningful in a time window.
- Pivot on what you found. Feed the owning organization, co-hosted domains, and certificates back into your investigation to expand the infrastructure map.
Common pitfalls
- Trusting geolocation as identity. An IP locates a network endpoint, not a person; datacenter and VPN addresses routinely point to the wrong place.
- Ignoring the clock. IP-to-domain and reputation data change constantly; a finding without a date is nearly worthless.
- Probing the host directly. Active scanning can be unlawful and tips off the target — stay with passive, open sources.
Verify your result
You have investigated the address when you can state its owning network and ASN, a time-bounded location hypothesis, the domains credibly linked to it, and its current reputation — each tied to a dated source. "No adverse reputation found" is itself a valid, documented result.