One-click install
npx skills add https://github.com/subimagesec/skills --skill investigate-ip
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: investigate-ip
Source: https://github.com/subimagesec/skills/tree/main/plugins/subimage-mcp/skills/investigate-ip
Command: npx skills add https://github.com/subimagesec/skills --skill investigate-ip

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you determine whether an IP address or domain belongs to your environment, where it maps in the cloud graph, and what it resolves to on the network.

Core Features & Use Cases

  • Ownership Resolution: Finds matching resources across AWS, GCP, and Azure, including EC2 instances, ENIs, elastic IPs, DNS records, CloudFront, and load balancers.
  • DNS Chain Tracing: Follows domain-to-record-to-IP resolution paths so you can see exactly how a hostname reaches an underlying resource.
  • Public IP Attribution: Enriches routable IPs with ASN, organization, geolocation, and anonymizer signals to help assess whether traffic looks suspicious.
  • Use Cases: Ideal for triaging alerts, investigating log entries, answering whether an address is yours, and understanding what a domain points to.

Quick Start

Ask the skill to investigate the IP or domain, trace its DNS chain, and enrich any public IP with external attribution details.

Frequently Asked Questions about investigate-ip

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I trace if an IP address belongs to my AWS, GCP, or Azure cloud resources?

IP ownership resolution traces addresses across AWS, GCP, and Azure to find matching resources like EC2 instances, ENIs, elastic IPs, load balancers, and DNS records, confirming whether an address belongs to your environment.

What is DNS chain tracing and how does it map a domain to a cloud resource?

DNS chain tracing follows the domain-to-record-to-IP resolution path to show exactly how a hostname reaches an underlying resource. It maps the full network path from your domain query to the final cloud infrastructure endpoint.

How do I enrich a public IP with ASN, geolocation, and anonymizer attribution signals?

Public IP attribution enriches routable IPs with ASN, organization, geolocation, and anonymizer signals to help assess whether traffic looks suspicious. It provides external threat context for triaging alerts and investigating logs.

Can I use this to investigate whether an IP in a security alert is owned by my organization?

Yes, this is ideal for triaging alerts and investigating log entries. It performs graph lookups across your cloud resources to answer whether an address or hostname belongs to your organization or points to external infrastructure.

What's the best way to find which cloud resource a specific domain points to?

The best way is to use DNS chain tracing to follow the domain-to-record-to-IP resolution path, which reveals exactly how a hostname reaches an underlying resource across your AWS, GCP, and Azure environments.