IP Address: Data Point Intelligence Guide

An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never as an identity.

Understanding the IP Address as an intelligence artifact

An IP address is a numeric identifier for an interface on an IP network: 32 bits in IPv4, written as four dotted octets, or 128 bits in IPv6, written as colon-separated hexadecimal groups. It is allocated hierarchically from IANA to the five Regional Internet Registries, then to Local Internet Registries and end users, and it is announced to the global routing table by an autonomous system. An IP therefore represents a routing destination and an administrative allocation, not a machine and certainly not a person.

The analytically important distinctions are between static and dynamically assigned addresses, between publicly routable space and RFC1918 or CGNAT ranges such as 100.64.0.0/10, and between an origin address and a shared egress. IPv6 adds privacy extensions and rotating temporary addresses, while anycast means the same address answers from many physical locations simultaneously.

Why it matters

An IP is the junction point between network telemetry and ownership records. It links firewall logs, DNS resolutions and malware callbacks to a routable prefix, an ASN and an abuse contact you can act on. Reverse DNS and passive DNS reveal every domain that has pointed at it, port and certificate scanning reveal what services it runs, and the surrounding CIDR block reveals whether the host is one machine in a legitimate estate or one address in a bulletproof range dedicated to abuse.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Announcing ASN and covering prefix from BGP data, identifying the network operator that must be contacted for takedown or abuse reporting.
RIR allocation records giving the assigned organisation, allocation date, country of registration and an abuse mailbox.
Open ports and service banners revealing operating system, remote access services, panel software and version strings.
TLS certificates presented on the host, whose subject names often expose domains never publicly linked to the address.
Reverse DNS naming conventions that leak hosting provider, rack or region and distinguish residential from datacentre space.
Passive DNS history listing every domain that resolved to the address and the time windows in which each did so.
Hosting type classification separating datacentre, residential proxy, mobile carrier, VPN exit and Tor exit addresses.
Reputation and sinkhole listings showing prior malware callbacks, scanning behaviour or spam emission from the same address.
Consistency of geolocation across providers, where wide disagreement indicates a proxy, anycast or a stale registry entry.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

RDAP and RIR WHOIS (RIPE, ARIN, APNIC, LACNIC, AFRINIC) — Authoritative allocation, holder organisation, country and abuse contact for the covering block.
RIPEstat — Routing history, announcing ASNs, prefix visibility, geolocation estimates and abuse contact finder in one API.
BGPView or bgp.tools — Current and historic prefix-to-ASN mapping, peer relationships and upstream transit providers.
Shodan — Port scan results, service banners, certificates, product and version fingerprints, and historic scan snapshots.
Censys — Full-internet scan data with certificate and service detail, useful for pivoting on shared certificates or banners.
VirusTotal — Vendor verdicts, resolving domains, downloaded files and samples observed communicating with the address.
AbuseIPDB and abuse.ch Feodo Tracker — Community abuse reports and known botnet C2 listings with observation dates and categories.
Tor Project exit list and public VPN or proxy lists — Identifies anonymising infrastructure so egress addresses are not mistaken for subject-controlled hosts.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Establish routing and ownership — Look up the covering prefix and origin ASN, then query the relevant RIR for the allocation holder, allocation date and abuse contact.
Classify the address type — Determine whether it is datacentre, residential, mobile, CGNAT, VPN, proxy or Tor exit space, because that governs every inference you can draw.
Enumerate exposed services — Review Shodan and Censys scan data for open ports, banners, panel software and certificates, and note the last scan timestamp rather than assuming it is current.
Reconstruct hosted names — Pull reverse DNS and passive DNS history to list domains that resolved to the address, with first and last seen dates for each.
Check reputation and history — Query abuse feeds, sinkhole data and malware repositories for prior callbacks, scanning or spam associated with the address and its neighbours.
Examine the neighbourhood — Scan the surrounding CIDR for identical certificates, banners or naming patterns to distinguish an isolated host from a dedicated malicious block.
Bound the time window — Tie every observation to a timestamp and, where attribution matters, seek subscriber records lawfully rather than inferring identity from the address alone.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

Cyber Intelligence — Adversary Activity in Networks and Systems
Threat Actor Intelligence — Tracking Adversary Groups Over Time
Vulnerability Intelligence — Weaknesses, Exploitation, and Prioritization
Technical Intelligence — Technology Capability, Design, and Exploitation
Malware Intelligence — Understanding Malicious Code
Signals Intelligence — Intelligence from Intercepted Communications and Emissions
Geospatial Intelligence — Intelligence Derived from Place
Open Source Intelligence — Publicly Available Information, Systematically Collected
Certificate Intelligence — TLS Certificates and Certificate Transparency
Criminal Intelligence — Intelligence Supporting Criminal Investigation

Investigated in these domains

Pivots to these data points

Domain Name — Human-readable address that maps to IP infrastructure via DNS.
URL — Uniform Resource Locator pointing to a web resource.
ASN — Autonomous System Number identifying a network operator on the internet.
Subdomain — A host under a parent domain — often reveals staging, admin, and forgotten infrastructure.
IP Range / CIDR — A block of IP addresses expressed in CIDR notation — the unit of network ownership and allocation.
MAC Address — Hardware address of a network interface; the OUI prefix identifies the manufacturer.

Inside the platform: where IP Address lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

ip-profile.php — IP Address profile
datapoint.php?dp=dp_ip — Data point hub
threat-dashboard.php?theme=nation_state — Nation State dashboard
actor-profile.php — APT / Espionage dashboard
ioc.php — Cyber Crime dashboard
ransomware.php — Ransomware dashboard
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
Resolve Everything
Threat Hunt
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Establish routing and ownership is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Enumerate exposed services turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Bound the time window feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses IP Address

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

For a defence analyst an address is a routing fact that supports cyber situational awareness, force protection and the network layer of intelligence preparation of the battlespace. It answers which network operator, which country of registration and which hosting class sits behind traffic seen by deployed or garrison systems, feeding J2 and J6 reporting and defensive tasking. It does not answer who. Constraints are strict: commercial geolocation is not a targeting grade location, an address behind carrier grade NAT or a residential proxy may implicate uninvolved civilians, and distinction obligations mean infrastructure indicators alone never support an effects recommendation without corroboration and legal review.

🕵 National intelligence

National intelligence treats an address as a collection cue and a fusion key rather than an answer. Open source registry, routing and scan data can be combined with classified reporting to build infrastructure pictures that remain releasable at low classification, which matters for partner sharing and industry engagement. Requirements discipline applies: addresses are enriched because they bear on a standing question about an actor or capability. Handling rules cover incidental collection on persons in the address space, particularly for residential and mobile ranges, and minimisation applies to any subscriber linked material. Provenance and query time must travel with the observation so consumers can judge currency and source sensitivity.

👮 Law enforcement

Law enforcement uses an address as the bridge from network telemetry to a subscriber, and that bridge is legal process, never inference. Registry, routing and scan data are collectable without process and should be preserved with timestamps and hashes. Subscriber identification requires a production order, warrant or equivalent to the provider, and cross border requests run through MLAT, the Budapest Convention or direct request frameworks. Timestamps and time zones are the usual point of failure, as is carrier grade NAT, where source port and precise time are essential for the provider to resolve the session. For charging, an address supports attribution only alongside subscriber records, device evidence and activity logs.

🔍 Private investigation and corporate security

Corporate security uses addresses for insider risk triage, fraud pattern detection, and evidencing unauthorised access to client systems from the client's own logs. Enrichment to ASN, hosting class and reputation is lawful from public sources and is often decisive in showing that a login came from a datacentre VPN rather than a claimed home location. What a private actor may not do is compel or obtain subscriber details from a provider, use pretext to extract them, purchase unlawfully sourced subscriber data, or scan third party hosts. The deliverable is a documented technical package that counsel can convert into a preservation letter or a court ordered disclosure application.

📰 Journalism and OSINT media

Journalists use address data to evidence infrastructure claims, such as showing that a disinformation network, a spyware command server or a sanctioned entity's service sits on a specific operator's network. Verification standards require at least two independent observations, dated, from different source types, and explicit acknowledgement of geolocation uncertainty. Never present an address as identifying a person, and never publish an address that resolves to a private home. Source protection requires querying from infrastructure not attributable to the newsroom, since scan and lookup services log requests. Give the network operator and any named organisation a genuine right of reply before publication.

🌍 NGO, humanitarian and human rights

Human rights organisations use address analysis to document surveillance infrastructure, attacks on civil society and platform blocking. Do no harm dominates: publishing an address used by a targeted community can expose them, and confirming an address to a source can put that source at risk if the disclosure is traceable. Documentation for accountability follows Berkeley Protocol capture and preservation practice so material withstands later legal scrutiny. Duty of care covers researchers, who should never interact directly with hostile infrastructure from personal devices or connections. Retain subscriber adjacent data only where necessary, store it encrypted, and delete on a fixed schedule.

🎓 University and research

Researchers use addresses for internet measurement, censorship studies and abuse ecosystem work. Method requires stating vantage points, resolvers, scan cadence and the version of any geolocation or classification dataset, because all of these materially change results. Reproducibility is served by publishing methodology and derived aggregates rather than raw address level records that may identify households. Ethics review is normally required for anything touching residential space, and active scanning needs institutional approval, opt out handling and clear scan origin documentation. Cite datasets by version, respect provider terms, and share at prefix or ASN aggregation rather than at individual address level wherever the research question allows.

Playbook: working IP Address end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Fix the observation in time

Record the address exactly as observed, with a timestamp including time zone and the source log or sensor that produced it. Where network address translation may be involved, capture the source port as well, because a provider cannot resolve a carrier grade NAT session without it. A good output is an observation record that a third party could take to a provider unchanged. Stop when the address, timestamp, time zone, port where available and source system are all documented and preserved.

Phase 2 — Establish routing and allocation

Resolve the covering prefix and origin ASN from routing data, then query the responsible registry for the allocation holder, allocation date, country of registration and abuse contact. Note whether the record is a direct allocation or a downstream assignment naming a customer. A good output states the network operator you would contact and the jurisdiction that governs them. Stop when routing and registry views agree, or when the disagreement between them is documented as a finding.

Phase 3 — Classify the address type

Determine whether the address is datacentre, residential broadband, mobile carrier, carrier grade NAT, VPN exit, commercial proxy, Tor exit or anycast. This classification governs every inference that follows and is the single most common source of analytical error. Use hosting classification datasets plus reverse DNS conventions and known exit lists. A good output is a stated class with the evidence for it. Stop when the class is established or explicitly recorded as unknown rather than assumed to be residential.

Phase 4 — Reconstruct hosted names

Pull reverse DNS and passive DNS to list every domain that resolved to the address, with first and last seen dates, then filter to the incident window. On shared hosting this list may be enormous, which is itself the finding. A good output is a dated name list annotated with how many other tenants shared the address at the time. Stop when you can say whether the address was dedicated or shared during the period of interest.

Phase 5 — Inventory exposed services

Review passive scan repositories for open ports, banners, product and version strings, panel software and presented certificates, recording the scan timestamp for each observation rather than treating it as current. Avoid scanning third party hosts yourself unless authorised. A good output is a service inventory with per observation dates and an explicit currency statement. Stop when the inventory covers the incident window or the gap in coverage is documented.

Phase 6 — Certificate and banner pivoting

Take certificates and unusual banners observed on the host and search for identical artifacts elsewhere. A self signed certificate with a distinctive common name, an unusual TLS server fingerprint or a niche admin panel version often identifies an operator's whole estate. A good output is a candidate host set with the shared artifact recorded for each. Stop when the shared artifact is shown to be either discriminating or commodity, and discard commodity matches.

Phase 7 — Reputation and prior activity

Query abuse reporting databases, botnet trackers, sinkhole data and malware repositories for previous callbacks, scanning, spam or command and control activity involving the address, always with observation dates. Reputation without dates is worthless because cloud addresses recycle in hours. A good output is a dated activity history that can be aligned to your incident. Stop when you can distinguish activity contemporaneous with your case from activity belonging to a previous tenant.

Phase 8 — Examine the neighbourhood

Look at the surrounding prefix for identical certificates, banners, reverse DNS conventions or malicious listings to judge whether the host is an isolated tenant or one address in a dedicated hostile range. Normalise counts by block size. A good output states abuse density in the covering prefix and whether the range appears operator tolerated. Stop when you can characterise the block, not merely the address.

Phase 9 — Assess proxy and attribution limits

Explicitly test whether the address is an anonymising egress: Tor exit lists, known VPN ranges, residential proxy indicators and hosting class all feed this. If it is, record that the true origin is not observable from this artifact and state what would be required to advance, such as provider logs under legal process. A good output is a written attribution ceiling. Stop before drawing any identity inference the artifact cannot support.

Phase 10 — Legal process where identity is required

If the case requires a subscriber, prepare the request package: exact address, precise timestamp with time zone, source port for carrier grade NAT, the offence or civil basis, and the retention window the provider operates. Route through the correct domestic or cross border mechanism. A good output is a request a provider can action without clarification. Stop when the request is served and a preservation notice is in place to protect records while it is processed.

Phase 11 — Report with stated confidence

Write findings that separate observation from inference: the address was announced by this AS, resolved these names in this window, presented this certificate, and is classified as this hosting type. Attach the attribution ceiling. A good output lets a reader reconstruct every claim from the preserved artifacts. Stop when no sentence in the report asserts an identity or a location that the evidence does not carry.

Phase 12 — Retention and review

Apply the retention period from your lawful basis assessment, since public addresses linked to activity records are personal data in many jurisdictions. Schedule deletion, restrict access to the case team, and record what would justify extension. A good output is a case record with a deletion date and an access log. Stop when retention is scheduled and the observation set is either archived under control or destroyed.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
RIPEstat	Open	Aggregated routing, registry, geolocation, abuse contact and visibility data for any address or prefix, with historic views.	Fastest route to origin ASN, allocation holder, announcement history and abuse contact for an address under investigation.
RIPE NCC database and RDAP	Open	Authoritative allocation records for the European and Middle East service region including inetnum, route and abuse contact objects.	Confirms the registered holder, allocation date and abuse mailbox for addresses in the RIPE region.
ARIN Whois and RDAP	Open	Authoritative registry records for North American address space, including reassignment and reallocation detail for downstream customers.	Identifies the responsible organisation and any customer sub assignment for addresses allocated in the ARIN region.
APNIC Whois and RDAP	Open	Authoritative registry data for the Asia Pacific region with allocation, assignment and abuse contact objects.	Establishes holder and jurisdiction for Asia Pacific space, where reseller layering is common and needs unpicking.
bgp.tools	Open	Live and historic prefix to ASN mapping, upstream and downstream relationships, and per prefix visibility across collectors.	Confirms which network actually announces the covering prefix and who its transit providers are for escalation.
Hurricane Electric BGP toolkit	Open	Free routing observatory exposing prefix to ASN mapping, peer relationships, DNS views and network detail for any address or prefix.	Programmatic and interactive enrichment of address observations to ASN and organisation during bulk log processing.
Shodan	Registration	Internet wide scan repository with service banners, certificates, product versions, screenshots and historic per host snapshots.	Establishes what services the address exposed, when, and whether the fingerprint matches other hosts in the estate.
Censys	Registration	Structured full internet scan dataset with certificate, service and software records supporting complex historical queries.	Certificate and software version pivoting from a single address to related hosts across unrelated networks.
VirusTotal	Registration	Vendor verdicts plus relations covering resolving domains, downloaded files, communicating samples and URLs tied to an address.	Links the address to malware samples and campaigns, giving family attribution and dated observations.
abuse.ch Feodo Tracker and ThreatFox	Open	Curated lists of botnet command and control servers and broader indicators with malware family labels and observation dates.	Confirms known command and control use with a citable date, distinguishing current from historic tenancy.
AbuseIPDB	Registration	Community submitted abuse reports categorised by type with reporter counts, timestamps and confidence scoring per address.	Rapid triage signal and a source of dated third party observations, treated as unverified community reporting.
Tor Project relay and exit data	Open	Authoritative published lists and metrics for Tor relays and exit nodes, including historic consensus documents.	Determines whether the address was a Tor exit at the exact time of the observation, which caps attribution.
IPinfo	Registration	Commercial enrichment covering geolocation, ASN, carrier and privacy detection for VPN, proxy, hosting and Tor classification.	Hosting class and anonymiser detection at bulk scale, used as an input rather than as a conclusion.
MaxMind GeoIP and anonymous IP datasets	Licensed	Geolocation, ASN and anonymiser classification datasets with published accuracy statements at country and city level.	Baseline geolocation with documented confidence, cited with dataset version so uncertainty can be stated honestly.
Team Cymru IP to ASN mapping service	Open	Bulk DNS and whois based mapping of addresses to origin ASN, prefix, country and registry allocation date.	High volume enrichment of log data to routing context without hitting per query rate limits on public interfaces.
IANA special purpose address registries	Open	Authoritative list of reserved, private, documentation, benchmarking and shared address space including the carrier grade NAT range.	Prevents wasted work and false findings by identifying non routable and shared address space before enrichment.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against IP Address. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

whois and RDAP clients — Query registry allocation records directly from the responsible registry. Limitation: sub assignment records are frequently stale or absent for smaller downstream customers.
mtr and traceroute — Reveal the network path and intermediate operators toward an address. Limitation: paths are asymmetric and many routers suppress responses, so the picture is partial.
Zeek — Produces structured connection, TLS and DNS logs that make address observations searchable and time bounded. Limitation: it only sees what its sensor is positioned to see.
Suricata — Signature and protocol aware detection that alerts on traffic to or from indicator addresses. Limitation: indicator based rules age badly as cloud addresses recycle.
Shodan and Censys command line clients — Query scan repositories at scale and export structured host records. Limitation: results are snapshots that may be weeks old and never include filtered services.
MISP — Stores address indicators with sightings, expiry and taxonomy so stale entries decay rather than persist. Limitation: expiry discipline depends on the analyst, not the tool.
SpiderFoot — Automates multi source enrichment of an address across registry, reputation, DNS and scan sources. Limitation: it aggregates uncritically, so provenance must be checked per finding.
ipcalc and sipcalc — Compute prefix boundaries, network and broadcast addresses and subnet arithmetic for IPv4 and IPv6. Limitation: purely arithmetic, with no registry or routing awareness.
Maltego — Graphs relationships from an address to prefixes, ASNs, certificates and resolving domains. Limitation: the most valuable transforms require commercial data subscriptions.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Resolve Everything — Batch-resolves ASN, country, org and netblock for every IP from local reference datasets — no API calls, so it runs at millions of rows and works offline.
Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Timestamp discipline decides whether an address ever becomes evidence. Record time zone and offset explicitly, prefer UTC in the case record, and note the clock source, because a one hour error against a provider log destroys the request.
For carrier grade NAT, source port is not optional metadata. Without the ephemeral port and a precise time a provider genuinely cannot identify the subscriber, and a request lacking it will be returned unanswered weeks later.
Check whether an address was an anonymising exit at the moment of the event, not today. Tor consensus documents and VPN range histories are point in time, and exit status changes frequently.
Geolocation disagreement between providers is a signal in itself. Wide divergence usually means anycast, a recently transferred block, or a registry entry that reflects the holder head office rather than the equipment location.
Distinguish the address that appeared in your logs from the address the actor controls. Reverse proxies, content delivery networks and load balancers mean the visible source is often infrastructure the actor merely rented access through.
When pivoting on scan data, prefer artifacts the operator chose over artifacts the platform provides. A self signed certificate common name or a custom panel path is discriminating; a default cloud banner is not.
Abuse contact quality varies enormously and is often the fastest way to judge a network. An operator with a monitored abuse mailbox and published policy behaves differently from one whose contact bounces, and that difference predicts takedown outcomes.
Treat an address as expiring evidence. Capture the raw responses at the time of observation, because passive DNS, scan snapshots and reputation entries are all rewritten or aged out and cannot be reconstructed later.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on IP Address is producing anything, and they are worth baselining before you change process or tooling.

Proportion of address observations in the case system that carry a time zone, source system and preserved raw enrichment response, sampled quarterly.
Median time from indicator ingestion to correct hosting classification, since misclassified residential or carrier grade NAT space drives the most damaging analytical errors.
Rate at which subscriber requests are returned by providers as incomplete, which measures request package quality rather than provider cooperation.
Share of address indicators auto expired within their intended lifetime, measuring whether stale cloud addresses are decaying out of detection rules.
False positive rate of address based blocking against legitimate traffic, tracked per block decision to keep controls proportionate.
Percentage of investigations in which the attribution ceiling was explicitly stated in the report, measuring analytical honesty rather than volume.
Number of cases where address enrichment produced a new infrastructure cluster rather than confirming an existing one, measuring investigative yield.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Carrier-grade NAT places thousands of subscribers behind one address, so an IP hit is not a single household, device or person.
Geolocation is inferred from registry and latency data, is frequently wrong at city level, and defaults to country or continent centroids.
Cloud and shared hosting addresses are recycled within hours, so historic malicious activity may belong to a previous tenant.
Anycast addresses answer from multiple continents at once, making location and single-host assumptions meaningless for CDN and DNS infrastructure.
Scan data in Shodan and Censys is a snapshot, sometimes weeks old, and may describe services that no longer exist.
Residential proxy networks route criminal traffic through unwitting home connections, placing innocent subscribers at the visible origin.

Legal and ethical considerations

In most jurisdictions a public IP address is personal data when it can be combined with subscriber records, and courts including the CJEU have treated dynamic addresses that way. Collect and retain with a defined lawful basis and retention period, and resist the temptation to resolve an address to a named individual without legal process. Active scanning of third-party hosts may breach computer misuse law or provider terms, so prefer passive scan repositories. Record source, query time and raw response to keep the observation evidentially sound.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for IP Address, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 intelligence disciplines, 7 mission domains, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Is an address personal data?

In the EU and UK the answer is generally yes when the holder has means reasonably likely to be used to link it to an individual, which is the position taken in the Breyer judgment for dynamic addresses held by a website operator. Practically, treat public addresses in security logs as personal data: define a lawful basis, usually legitimate interests for network and information security, set a retention period, restrict access and document the assessment. That does not stop you processing them, it means the processing must be justified, minimised and time bounded.

How accurate is address geolocation really?

Country level is usually reliable, around ninety five percent or better for major commercial datasets. City level is substantially worse and can be wrong by hundreds of kilometres, particularly for mobile carriers, satellite providers, VPN ranges and recently transferred blocks. Coordinates are frequently registry centroids, which is how unrelated households have ended up receiving visitors chasing default map points. Never present a city level result as a location for a person, always cite the dataset and version, and state uncertainty explicitly in any product a decision maker will read.

The address is a VPN exit. Is the trail dead?

Not necessarily, but open source work will not get you past it. Record the exit as your attribution ceiling and pursue other lines: account artifacts, payment data, device fingerprints, timing correlation with other sessions, and operational errors where the same actor connected once without the VPN. If the provider is in a cooperative jurisdiction and retains connection logs, legal process may reach behind the exit, though many providers genuinely retain nothing. Do not attempt to compromise or probe the exit node, and do not present the exit location as the actor's location.

Can I scan the host to see what is running?

Prefer not to. Active scanning of third party infrastructure may breach computer misuse legislation, provider terms or your own authorisation, and it announces your interest to the operator. Passive scan repositories answer most questions with dated snapshots and no interaction. Where current state genuinely matters and you hold written authorisation, scan from clearly attributable research infrastructure with published contact and opt out, and record the authority. Inside your own estate the calculus is different and active discovery is normal practice.

Why did reputation data say malicious when the host is clean?

Almost always tenancy churn. Cloud and hosting addresses are reassigned within hours, so a reputation listing may describe a tenant who left before your observation. Reputation entries without observation dates are unusable for this reason. Check the first and last seen dates on each listing and align them with your incident window. The same effect works in reverse: an address with no reputation history may have been malicious yesterday under a different tenant whose activity was never reported. Always reason with dates attached.

What do I actually send a provider to identify a subscriber?

The exact address, the precise time with time zone and preferably in UTC, the source port where carrier grade NAT is possible, the destination address and port, the protocol, the legal instrument authorising disclosure, and the offence or civil basis. Send a preservation request first, because retention periods for connection logs are often measured in weeks. Expect the provider to reject vague or single field requests. Cross border, route through MLAT, the Budapest Convention preservation mechanism, or a direct request framework if one applies between the jurisdictions.

How long should I keep address indicators in detection rules?

Far less time than most teams do. Cloud and hosting addresses should carry aggressive expiry, often seven to thirty days, because tenancy changes and stale entries generate false positives that erode trust in the detection stack. Dedicated bulletproof ranges and long lived command and control infrastructure justify longer retention. The right practice is to attach an explicit expiry and confidence to every indicator on ingestion, review on expiry rather than deleting silently, and measure false positives per indicator source so poor feeds can be retired.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

RFC 791 and RFC 8200, defining the IPv4 and IPv6 packet formats and addressing that underlie every observation of an address.
RFC 6598 and the IANA special purpose address registry, defining shared carrier grade NAT space and other ranges that must not be treated as subscriber identifiers.
Regional Internet Registry policy frameworks from RIPE NCC, ARIN, APNIC, LACNIC and AFRINIC, governing allocation, transfer, registration accuracy and abuse contact obligations.
GDPR Articles 5, 6 and 32 together with the CJEU judgment in Breyer, establishing that dynamic addresses can be personal data and setting lawful basis and minimisation duties.
Budapest Convention on Cybercrime Articles 16 to 18 and 29 to 30, providing expedited preservation and disclosure of traffic data across borders.
ISO/IEC 27037, giving guidance on identification, collection, acquisition and preservation of digital evidence including network records.
MITRE ATT&CK command and control tactic, providing shared technique identifiers for behaviour observed at an address.
Berkeley Protocol on Digital Open Source Investigations, setting preservation and provenance standards where address evidence feeds accountability proceedings.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

RIPEstat — RIPE NCC. Open data platform aggregating routing, registry, geolocation and abuse information for addresses and prefixes.
IPv4 and IPv6 Special Purpose Address Registries — IANA. Authoritative record of reserved, private and shared address ranges including carrier grade NAT space.
ARIN Whois and RDAP services — ARIN. Registry of record for North American address allocations, reassignments and organisational contacts.
bgp.tools — bgp.tools. Public routing observatory mapping prefixes to originating autonomous systems with historic visibility data.
Feodo Tracker — abuse.ch. Curated open list of botnet command and control servers with addresses, ports, malware family and dates.
Censys Search — Censys. Full internet scan dataset of hosts, services and certificates used for infrastructure pivoting.
Tor Project metrics and relay data — The Tor Project. Published relay and exit node data used to determine anonymising infrastructure status at a point in time.
GeoIP accuracy documentation — MaxMind. Published accuracy statements for country and city level geolocation used to state uncertainty honestly.
ISO/IEC 27037 digital evidence guidance — ISO. International standard for identification, collection and preservation of digital evidence.
Convention on Cybercrime — Council of Europe. Treaty establishing expedited preservation and cross border disclosure procedures for traffic data.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: resolves IPs to routing, ownership, hosting type and abuse contacts with full historic resolution and reputation context. Explore the platform, or browse the rest of the library by following any tag above.