Analyze IPv4 and IPv6 addresses, resolve reverse PTR hostnames, determine RFC private/bogon classifications, and convert IPs to integer and hex representations for network forensics.
In cybersecurity incident response, an IP address is often the primary artifact surfaced in firewall alerts, SIEM logs, intrusion detection systems (Snort/Suricata), and suspicious authentication sessions.
However, raw IP addresses alone do not provide context. Analysts must immediately categorize the address to determine whether it represents an internal compromised workstation, a legitimate Cloudflare CDN proxy, or an external malicious command-and-control (C2) server.
10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. If an external alert claims an attack originated from one of these, packet spoofing or internal lateral movement is involved.100.64.0.0/10. Used by mobile telecom carriers and ISPs to share IPv4 addresses among multiple cellular subscribers.169.254.0.0/16. Assigned automatically by Windows when a DHCP server fails to respond.
Reverse DNS resolves an IP address into its Pointer (PTR) hostname via the .in-addr.arpa (for IPv4) or .ip6.arpa (for IPv6) zones.
When an investigator analyzes an IP connected to a phishing campaign or brute-force attack, the PTR hostname can expose:
ec2-xx-xx.compute-1.amazonaws.com or vps.ovh.net).cpe-xx.res.rr.com), which often indicate infected IoT devices or compromised home routers recruited into botnets.http://0x7f000001 instead of 127.0.0.1) to evade basic URL regex filters while still resolving properly inside web browsers and cURL requests. Converting to and from hex assists analysts in deciphering obfuscated attack vectors.