Suspicious IP Investigation Guide
How to investigate a suspicious IP address: reputation, geolocation, passive DNS, port/service posture and linked infrastructure.
Quick Answer
Investigate a suspicious IP by checking reputation signals against known threat data, its ASN/geolocation and hosting type, passive-DNS links to domains and pivot to other infrastructure before deciding a block or hunt.
Definition
An investigation procedure for a suspicious IP that combines reputation, geo/ASN, passive DNS and linked-infrastructure data to judge maliciousness.
Goal
Determine whether an IP is a likely origin of, ingredient in, or destination for malicious activity — against evidence, without fabrication.
Prerequisites
- The suspect IP; reputation/bulk data (ASN, geo, hosting); passive DNS/history.
Evidence collection
- Reputation: check the IP against OpenTrojan and TI IOC data (
guides:tool-ip-guide,guides:tool-ioc-guide). - Hosting context: ASN, geolocation, datacenter vs consumer/cloud ranges — rented VPS/C2 is a red flag.
- Passive DNS: which domains resolved to this IP; lookalike/phishing domains are a strong signal.
- Behavior: open ports, protocols, certificate/history, and any public report.
Indicators
- Known-bad hash-adjacent or C2-infrastructure attribution; fast-rotating hosting (T1071/T1573); domains with young registrations on the same IP.
Validation
- Correlate ≥2 independent signals (reputation hit + passive-DNS bad domain + hosting type) before calling it malicious; a bare IP seen in traffic stays uncertain.
Investigation
Pivot IP → domains (passive DNS) → certificates → other IPs/ASNs → email/network indicators → linked campaign (see guides:suspicious-domain-investigation).
Decision
- Block/hunt with strong correlation; monitor if uncertain; no action if benign traffic.
Containment & mitigation
- Add deny rules at the firewall/filter for confirmed C2 IPs; escalate any matching endpoint to response (
security:network-security).
References
- MITRE T1071 / T1573; IANA as listed.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.