IP Address OSINT: What You Can and Cannot Learn

In television shows, an IP address pinpoints a suspect to a specific chair in a specific room. In reality, IP address investigation is far more nuanced. While an IP won't give you a GPS coordinate, it provides crucial metadata about the network infrastructure and the device's general location.

Understanding Geolocation Limitations

IP geolocation relies on databases maintained by companies like MaxMind or IP2Location. These databases map IP blocks to geographic regions based on registration data and network routing.

IP geolocation is highly accurate at the country level, moderately accurate at the city level, and completely useless at the street level.

If an IP maps to a specific coordinate, it is usually the geographic center of the city or the location of the ISP's routing center, not the physical location of the user.

ASN and ISP Identification

Every IP belongs to an Autonomous System Number (ASN), which represents the organization controlling that block of IPs. Identifying the ASN tells you who owns the network.

• •Residential ISPs: (e.g., Comcast, AT&T) indicates a home user or small business.
• •Cloud Providers: (e.g., AWS, DigitalOcean) indicates a hosted server, VPN, or proxy.
• •Mobile Carriers: (e.g., T-Mobile) indicates a cellular data connection, which often uses CGNAT (Carrier-Grade NAT), meaning hundreds of users share the same IP.

VPNs, Proxies, and Tor

Threat actors rarely use their home IP. They route traffic through VPNs, commercial proxies, or the Tor network. Checking an IP against threat intelligence feeds (like AbuseIPDB or specialized proxy detection APIs) is essential. If an IP is flagged as a known Tor exit node or commercial VPN, the geolocation data points to the privacy service, not the actor.

Scanning for Open Ports with Shodan

If the IP belongs to a server (rather than a residential user), platforms like Shodan or Censys are invaluable. These services constantly scan the internet for open ports and exposed services.

Querying an IP in Shodan can reveal:

• •Web servers running on ports 80/443, along with their SSL certificates.
• •Exposed databases (MongoDB, Elasticsearch) left without authentication.
• •Remote access services like RDP or SSH.

Reverse IP Lookups

A reverse IP lookup checks which domains are hosted on a specific IP address. In a shared hosting environment, a single IP might host hundreds of unrelated sites. However, on a dedicated server, finding multiple domains on the same IP can link discrete projects operated by the same entity.