IP Intelligence Case Studies
Detailed, technical walkthroughs of security incidents, fraud prevention, and network troubleshooting solved with IP intelligence.
Tracing a Suspicious IP During a Database Leak: A Walkthrough
An illustrative walkthrough: a replica database starts streaming data to an unknown IP at 2 AM. How to stop it, identify the IP’s owner, and find the misconfiguration that let it in.
Diagnosing a Partial Outage After a DNS Change: A Walkthrough
An illustrative walkthrough: after a server move, some users reach the site and others time out. How cached DNS records cause it, how to confirm it, and how to avoid it next time.
Investigating an “Impossible Travel” Login Alert: A Walkthrough
An illustrative walkthrough of triaging an impossible-travel alert with WHOIS, reverse DNS and a port scan, and deciding whether it’s an attack or an employee on a VPN.
Using IP and ASN Checks to Cut Checkout Fraud: A Worked Example
An illustrative example of how a small online store could use ASN and network-type checks to hold suspicious orders for review, and where those checks fall short.
Our Investigative Methodology
When auditing network activity or debugging threat logs, we use structured investigative frameworks. These case studies walk through the investigative steps using IP intelligence.
Network Reconnaissance
Identifying suspicious subnets, autonomous systems (ASNs), and ISP routing characteristics to map external actors.
DNS & Records Audit
Resolving DNS pointers (PTR), validating mail servers, checking SSL validity, and scanning target open ports.
Reputation & Threat Scoring
Correlating target IP ranges against active blacklists, spam traps, and historical botnet threat feeds.
Remediation & Action
Hardening network configurations, whitelisting or blocking ranges, and submitting abuse reports to hosting operators.