Identify IP ownership, ASN, geolocation, and reputation from passive sources.
npx skills add https://github.com/hpsgd/turtlestack --skill ip-intel
Please help me install this Agent Skill. Skill: ip-intel Source: https://github.com/hpsgd/turtlestack/tree/main/plugins/research/investigator/skills/ip-intel Command: npx skills add https://github.com/hpsgd/turtlestack --skill ip-intel
Investigate and document ownership, infrastructure, and reputation of an IP address using passive public sources to avoid active scanning.
Provide an IP address or CIDR range to generate a passive IP intelligence report.
High-intent search queries and answers about installing and using this skill.
Passive IP intelligence investigations collect ownership, ASN, geolocation, and reputation data without active scanning. This Skill queries ipinfo, RIR registries, VirusTotal, AbuseIPDB, and Shodan to build a comprehensive profile for incident response and due diligence.
Passive IP reputation lookups identify malicious infrastructure and summarize IP ownership for threat intelligence. They apply to incident response and due-diligence tasks across corporate networks, cloud environments, and partner ecosystems without alerting targets.
Yes, you can check IP geolocation and ASN ownership using public registries. This Skill aggregates data from ipinfo and RIR registries like RIPE NCC, ARIN, APNIC, LACNIC, and AFRINIC to accurately identify hosting infrastructure and network ownership.
Yes, passive IP research works with CIDR ranges. You can provide an IP address or a CIDR range to generate a structured report covering reverse DNS, related infrastructure, and historical context for the specified network block.
Passive IP intelligence relies on querying existing public sources like Shodan and AbuseIPDB, whereas active scanning sends packets directly to targets. Passive methodology avoids detection, making it safer for incident response and partner due-diligence.
Passive IP reputation data may be insufficient when you need real-time vulnerability status or live service banners. It relies on historical and third-party data from sources like MXToolbox and VirusTotal, which might not reflect instantaneous network changes.
firef1ieConvert IPv4 addresses, calculate subnets, and perform DNS lookups via the AgentPMT API.
chenchunrunAnalyze IP addresses for geolocation, ASN ownership, threat intelligence, and risk assessment.
balsm-healthAnalyze EDR, SIEM, and Sysmon logs for unusual network connections.
RooseveltAdvisorsAutomate network reconnaissance for domains, IPs, and netblocks.
