IP & network reconnaissance

Resolving a network address into facts about whoever is behind it: country and region, the ASN and organization that announces the prefix, WHOIS registration, the resolver answering its DNS, the upstream path to the Tier 1 backbones. It is one of the named branches of this spoke’s domain and, until myip, the one with no page.

Unlike people-profiling (gitsint, llm-osint), it is infrastructure recon: the unit of analysis is an address, a prefix, or an org, not a person. The two meet at attribution — an IP is only interesting once it’s tied to someone. Its opposite number on the identity side is username-reconnaissance: same shape of move (cheap identifier in, facts about a person out), different identifier — an address is assigned to you, a handle is one you chose and reuse.

Two directions on this branch. myip runs it inward (what does the public attribution layer already say about me?); cloakquest3r runs it outward against a target that is actively hiding, recovering an origin IP from behind a CDN. The second is the harder case and the more revealing one: what leaks the address is never the proxy but the target’s own DNS history, forgotten subdomains, and re-used certificates — so origin exposure is a configuration property, auditable with the same tools that attack it.

The attribution layer is a small set of shared datasets

Every tool in this area, offensive or defensive, resolves against roughly the same sources, which myip enumerates in its config:

• MaxMind GeoLite2 (City + ASN) — the default free geolocation and ASN database. Its license forbids redistribution, so tools ship a downloader rather than the data, and every operator holds an account key.
• CAIDA — as2org maps ASNs to organization names, as-rel2 gives the AS-relationship graph that makes upstream topology drawable.
• RIPEstat — historical AS announcements for a prefix, which turns a point-in-time lookup into a timeline of who announced what.
• Commercial geolocation APIs — IPInfo, IPAPI.is, IP2Location; consulted in parallel because they disagree.

Two consequences. Accuracy is inherited, not measured: a geolocation is a vendor’s claim, and querying three vendors at once is the standard hedge against any one being wrong. And the capability is cheap and public — the same free databases serve an analyst, an ad-tech fingerprinter, and someone checking their own VPN.

The leak surface

An IP is only as private as the paths that can reveal it. The three myip tests for are the canonical ones: WebRTC ICE candidates exposing the real address from inside the browser, DNS leaks where queries bypass the tunnel and reveal the ISP’s resolver, and browser fingerprinting which re-identifies the same visitor across addresses and makes the IP almost redundant. A VPN moves the address; it doesn’t by itself close any of the three.

Both directions

The same lookups serve reconnaissance against a target and self-audit by a subject. Pointed outward it is the infrastructure half of the classic toolkit on osint (Shodan, recon-ng); pointed inward it is the concrete answer to “what do I currently disclose?”, which is the defense-against-automated-OSINT thread in synthesis at the level of a single connection. The techniques are identical; only the target changes, which is this spoke’s dual-use stance in miniature.

Related

osint · myip · gitsint · username-reconnaissance · kafsiem · synthesis