skills.rest
hoanghn61
hoanghn61COMMUNITY
Explore all skills by this author →
GitHub

ip-attribution

Map IP addresses to cloud providers, ASNs, and organizations via DNS and WHOIS.

Updated May 27, 2026
Search Tags:#threat intelligence#whois#asn#cloud provider#ip attribution#cdn detection#dns resolution
One-click install
npx skills add https://github.com/hoanghn61/.agents --skill ip-attribution-hoanghn61
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ip-attribution
Source: https://github.com/hoanghn61/.agents/tree/main/skills/techstack-identification/ip_attribution
Command: npx skills add https://github.com/hoanghn61/.agents --skill ip-attribution-hoanghn61

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It eliminates the effort of manually figuring out who owns an IP address or which cloud/CDN provider it belongs to.

Core Features & Use Cases

  • DNS Resolution & CNAME Tracing: Resolves domains to IPv4/IPv6 and follows CNAME chains to capture the actual endpoints.
  • WHOIS & ASN Identification: Extracts organization, netblock, country, CIDR, abuse/contact signals, and enriches results with Team Cymru ASN lookup.
  • Cloud Provider IP Range Matching: Detects likely AWS/GCP/Azure/Cloudflare and other providers by checking the IP against published provider IP ranges, including CDN-style matches.

Quick Start

Use the ip-attribution skill to attribute the IPs for the domain example.com and return provider, ASN, organization, and evidence.

Frequently Asked Questions about ip-attribution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map a discovered IP address to its cloud provider or organization?▼

To map an IP address to a cloud provider or organization, resolve DNS records and perform WHOIS enrichment. Cross-referencing the IP against published cloud IP ranges identifies the hosting provider, while ASN lookups reveal the owning organization.

Does this approach detect whether traffic is cloud-hosted or CDN-fronted?▼

Yes, CDN detection works by following CNAME chains during DNS resolution and matching IPs against known cloud and CDN IP ranges. This distinguishes direct cloud-hosted traffic from CDN-fronted endpoints across IPv4 and IPv6 addresses.

How do I trace a domain to its actual endpoint IP for threat intelligence?▼

Trace a domain to its actual endpoint by resolving IPv4 and IPv6 records and following CNAME chains. This captures the true underlying endpoints, which can then be enriched with WHOIS and ASN data for threat attribution workflows.

What is the best way to identify the ASN and netblock for an IP address?▼

Identify the ASN and netblock by performing a WHOIS lookup on the target IP and enriching it with Team Cymru ASN data. This extracts organization, country, CIDR netblock, and abuse contact signals for investigative purposes.

Can I use Bash-based DNS and WHOIS lookups for IP attribution?▼

Yes, IP attribution requires executable Bash support to run DNS resolution, WHOIS lookups, and ASN enrichment. The process uses external cloud range sources cached for performance and provides structured outputs with evidence and failure-safe fallbacks.

What happens when IP attribution fails to match a known cloud provider range?▼

When IP attribution fails to match a known cloud provider range, the workflow provides failure-safe fallbacks. It returns structured outputs containing available evidence, ensuring the investigation continues even with incomplete WHOIS or ASN data.

Related Skills

Explore More Data & Analytics Skills→
jwm-axonijwm-axoni
3

recon

Map network infrastructure via passive and authorized active reconnaissance.

Community
Advanced
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
ArianHobson333ArianHobson333
7

ip-attribution

Map IP addresses to cloud providers, ASNs, and organizations via WHOIS lookups.

Community
Intermediate