ip-analysis

Analyze IP addresses for geolocation, ASN ownership, threat intelligence, and risk assessment.

1|1|Updated Apr 25, 2026
One-click install
npx skills add https://github.com/chenchunrun/onyx-soc --skill ip-analysis
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ip-analysis
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/ip-analysis
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill ip-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Analyze IP addresses to deliver geolocation, ASN ownership, threat intelligence, and risk assessment.

Core Features & Use Cases

  • Geolocation & ASN attribution: identify country, city, organization, and ASN for a given IP.
  • Threat intelligence aggregation: pull multi-source indicators (malware, c2, scanner, botnet) and compute risk signals.
  • Decision-ready outputs: quick results for IR workloads and structured data for downstream skills.

Quick Start

Analyze a target IP by running the skill with an IP value to obtain immediate triage results.

Frequently Asked Questions about ip-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check an IP address for threat intelligence and geolocation data?

To check an IP address for threat intelligence and geolocation, this skill uses MCP tools to identify country, city, ASN ownership, and aggregate multi-source risk indicators like malware or botnet signals.

Can I analyze a batch of IP addresses for incident response triage?

You can analyze single IPs or small batches for incident response triage. The skill provides a deterministic fast path with safeguards to deliver quick, decision-ready outputs for network monitoring workloads.

What is ASN attribution and how does it work for cyber threat hunting?

ASN attribution identifies the organization and Autonomous System Number owning an IP address. It works by querying MCP tools during threat hunting to map network infrastructure and assess associated risk signals.

How do I perform a deep risk assessment on a suspicious IP address?

To perform a deep risk assessment on a suspicious IP, you can request optional deep analysis. This triggers port scanning decisions and multi-source threat intelligence aggregation to compute comprehensive risk scores.

Does this skill support port scanning decisions during network monitoring?

Yes, the skill supports port scanning decisions during network monitoring by utilizing MCP tools. It integrates these decisions into the overall risk assessment and threat intelligence gathering process for the target IP.