IP & Domain Investigation Cheat Sheet

This IP and domain investigation reference sheet outlines essential techniques and tools for assessing suspicious infrastructure in cybersecurity contexts. It supports triage, reputation analysis, WHOIS lookups, DNS inspection, passive intelligence, and safe payload retrieval. Tailored for analysts, incident responders, threat hunters, and DFIR professionals, it streamlines workflows for identifying malicious indicators, uncovering historical associations, and making informed decisions during investigations.

Immediate Questions to Ask

• Is this a public IP or private/reserved?
• Is the domain newly registered, sinkholed, or typosquatted?
• Is the IP on threat feeds or blacklists?
• Does it belong to a known cloud/VPN/proxy provider?
• What are the historical DNS resolutions and WHOIS?

Tools for IP & Domain Analysis

IP Classes and Ranges

CLI Commands

WHOIS + DNS

# WHOIS lookup
whois example.com

# DNS records (A, MX, TXT, CNAME)
dig example.com ANY +short
dig +trace example.com

# Use alternative DNS resolver (Useful for internal DNS Servers)
nslookup example.com 8.8.8.8

IP Geolocation + ASN

curl ipinfo.io/8.8.8.8
curl https://ipapi.co/8.8.8.8/json/

Historical WHOIS and Certificates

curl "https://crt.sh/?q=%.example.com&output=json"

Curl Usage

⚠️ Always perform payload retrieval in an VM with VPN enabled.

# Download raw payload
curl http://example.com/payload

# View HTTP headers
curl -I https://example.com

# Follow redirects and trace
curl -v -L https://short.url

# Fetch page and convert to plaintext
curl -s https://example.com | html2text

# Custom headers - Some threat actors will perform "authentication" on their servers by using custom headers.
curl https://example.com -A "CustomUserAgent"
curl https://example.com -H "Header: value"
curl https://example.com -b "cookie=value"
curl https://example.com --referer "https://source.com"

Suggested Workflow

Step 1: Initial Triage – Begin with URLScan.io or AbuseIPDB

• For URLs: Use URLScan.io

  • Review the screenshot and network tab
  • Note any resource files and redirects
  • Check for unusual behaviour (e.g. strange hosting, suspicious scripts)

• For IPs: Use AbuseIPDB

  • Check report history
  • Look for associated abuse categories (e.g. brute force, phishing)

Step 2: IP & Domain Reputation Checks

Query the IP or domain in:

• Spur.us
• IPVoid
• GreyNoise
• Hunting.abuse.ch

Look for:

• Known blacklists
• Cloud hosting services (e.g. AWS, Azure, GCP)
• Scanning or malicious behaviour reports

Step 3: WHOIS Lookup

Use tools like

• whois
• DomainTools
• SecurityTrails

Look for:

• Domain creation/expiry dates
• Registrar details
• Registrant email (useful for pivoting to other domains)

Step 4: Certificate & Passive DNS Analysis

Query:

• Censys
• crt.sh
• SecurityTrails

Look for:

• SSL certificate reuse across domains
• Historical IP/domain associations
• Subdomain enumeration

Step 5: VirusTotal Search

Use VirusTotal to search for domain or IP.

Check for:

• Detection engine results
• Behavioural graph and activity
• Related malicious files or domains

Step 6: Retrieve Payloads

Use:

• Browserling
• curl (in a VM with VPN)
• A browser (in a VM with VPN)

Purpose:

• Safely interact with and collect potential payloads
• Observe dynamic behaviour without exposing your host system

Behavioural Indicators

✉️ For any domains/URLs shared with colleagues, consider defanging (e.g., hxxp://malicious[.]site) to prevent accidental clicks.