Investigate an IP

Use this workflow when an IP appears in an alert, report, log, or case and you need a fast, defensible picture of the infrastructure around it.

This workflow uses 1.1.1.1 as an example. Replace it with the address you are investigating.

Investigation path

An IP address leads to host context, which branches into exposed services, passive DNS, and OSINT reports

Build host context

Start with hosts for one compact view of the address:

curl --get "https://api.infrawatch.com/api/v1/search/hosts" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=ip:1.1.1.1" \
  --data "limit=1"

Review the current ASN, ISP, country, first and last observation times, ports, protocols, visible tags, and bounded service summaries.

services_truncated: true means the host has more services than the summaries returned here. Continue to the service dataset for the complete matching page.

Inspect every matching service

Search services when you need endpoint-level HTTP, TLS, banner, status, fingerprint, and observation details:

curl --get "https://api.infrawatch.com/api/v1/search/services" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=ip:1.1.1.1" \
  --data "limit=100"

Each result represents one observed endpoint. Treat different ports and transports as separate evidence.

Pivot to names

Find DNS names observed pointing to the address:

curl --get "https://api.infrawatch.com/api/v1/search/dns" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=answer_ip:1.1.1.1" \
  --data "limit=100"

Use first_seen_at and last_seen_at to distinguish current-looking relationships from older infrastructure history. DNS observations are returned as UTC calendar dates.

Find related reporting

Search public intelligence associated with the address:

curl --get "https://api.infrawatch.com/api/v1/search/osint" \
  --header "X-API-Key: ${INFRAWATCH_API_KEY}" \
  --data-urlencode "q=ip:1.1.1.1" \
  --data "limit=25"

Results link to the original report and include its source and publication context.

What to record

Evidence	Why it matters
ASN and ISP	Establishes current network attribution
Ports and protocols	Shows the externally visible attack surface
HTTP, TLS, and fingerprints	Helps link technically similar services
First and last seen	Provides temporal context for the observation
DNS names	Reveals domains sharing or previously using the address
Visible tags and reports	Adds reviewed classification and external context

Start here

Language guide

Investigation workflows

Investigation path

What to record

Continue the investigation

Trace a DNS relationship

Hunt similar services

​Investigation path

​What to record

​Continue the investigation

Trace a DNS relationship

Hunt similar services

Investigation path

What to record

Continue the investigation