> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/passive-reconnaissance-techniques/network-and-ip-intelligence.md).

# Network & IP Intelligence

**Network & IP Intelligence** involves gathering publicly available data about IP addresses and networks to gain insights into hosting details, infrastructure, and historical records. This information helps identify organizations, service providers, and possible connections between different assets without directly interacting with the target system.

***

### **IP Address to Location (Geolocation)**

IP geolocation tools help identify the **physical location** of an IP address. This is useful for detecting hosting providers, data centers, or possible office locations.

#### **Tools:**

* **Command-line:**
  * `curl ipinfo.io/8.8.8.8`
* **Online Services:**
  * [IPInfo.io](https://ipinfo.io/)
  * [IPLocation.net](https://www.iplocation.net/)
  * [MaxMind GeoIP](https://www.maxmind.com/en/geoip-demo)
  * [IP2location](https://www.ip2location.com/)
  * [IPvoid](https://www.ipvoid.com/ip-geolocation/)
  * [IPregistry](https://ipregistry.co/)
  * [Check-host](https://check-host.net/)

***

### **IP Traceroute**

Traceroute tools track the path packets take across the internet, helping identify intermediate network devices and potential filtering mechanisms.

#### **Tools:**

* **Command-line:**
  * Linux/macOS: `traceroute example.com`
  * Windows: `tracert example.com`
* **Online Services:**
  * [Network-Tools](https://www.broadbandsearch.net/trace)
  * [IP2location](https://www.ip2location.com/free/traceroute)
  * [Central OPS](https://centralops.net/co/DomainDossier.aspx)
  * [DNS-Checker](https://dnschecker.org/online-traceroute.php)

***

### **IP Address History**

IP history provides details on previous ownership, hosting, and associated domains.

#### **Tools:**

* **Online Services:**
  * [SecurityTrails IP History](https://securitytrails.com/)
  * [ViewDNS.info IP History](https://viewdns.info/iphistory/)

***

### **Reverse IP Lookup**

Reverse IP lookup finds all domains hosted on a specific IP, which can reveal shared hosting environments.

#### **Tools:**

* **Online Services:**
  * [MxToolbox](https://mxtoolbox.com/ReverseLookup.aspx)
  * [ViewDNS.info Reverse IP](https://viewdns.info/reverseip/)
  * [DNS Checker](https://dnschecker.org/reverse-dns.php)

***

### **Common Open Ports Check**

Checking commonly open ports helps identify services running on a target without actively scanning it.

#### **Online Tools:**

* [Shodan](https://www.shodan.io/)
* [Censys](https://censys.io/)
* [Pentest-Tools Port Scanner](https://pentest-tools.com/network-vulnerability-scanning/tcp-port-scanner-online)

***

### **ASN (Autonomous System Number) Lookup**

ASN lookups help identify which organization owns an IP range, helping track down infrastructure details.

#### **Tools:**

* **Command-line:**
  * `whois -h whois.cymru.com " -v 8.8.8.8"`
* **Online Services:**
  * [Hurricane Electric BGP Toolkit](https://bgp.he.net/)
  * [IPInfo.io ASN Lookup](https://ipinfo.io/)
  * [ViewDNS.info ASN Lookup](https://viewdns.info/asnlookup/)

***

### **IP Logger**

IP loggers track a user’s IP address when they interact with a specific URL. These can be used for **tracking** but also have ethical concerns.

#### **Online Services:**

* [Grabify](https://grabify.link/)
* [IP Logger](https://iplogger.org/)