Every device connected to the internet carries a numerical address that can be mapped to an approximate physical location and to the autonomous system network, or ASN, that controls it. IP address geolocation identifies infrastructure: the country, region, and network operator associated with an address at a given moment. Attribution goes further, connecting that infrastructure to a specific actor through ISP subscriber records, passive DNS history, hosting patterns, and behavioural correlation. The two operations are distinct, and conflating them produces findings that will not survive scrutiny.
This method applies when tracing the hosting infrastructure of a disinformation network, identifying the ASN controlling addresses linked to a cyberattack, mapping shared infrastructure across nominally separate campaigns, or detecting anonymisation services that obscure an originating address. A single IP address places a server on a network; it does not identify its operator. Each indicator, individually, is ambiguous. The pattern, corroborated across sources, is not.
DIG-002 sets out the methodology for geolocating, fingerprinting, and attributing IP address infrastructure to evidentiary standard.
Eight workflow steps, five tooling sources, six false-positive checks, seven chain-of-custody requirements.
|
01
Required Tools
Five platforms covering geolocation, ASN lookup, infrastructure indexing, and passive DNS.
|
02
OPSEC
Lookup isolation, platform logging risks, and geolocation accuracy limits.
|
|
03
Workflow
Eight-step sequence from IP acquisition to documentation.
|
04
False Positives
Cloud provider ownership, shared hosting, VPNs, Tor, and dynamic address reassignment.
|
|
05
Chain of Custody
Seven requirements covering source logging, tool records, hashing, and archiving.
|
06
Key Queries
Five query patterns across IPinfo, Shodan, Censys, SecurityTrails, and BGP.tools.
|
Download the card.
A PDF version of DIG-002 is available below for Signal subscribers.
The rest of this card is for Signal subscribers.
What remains: the step sequence, the tool list, the false-positive checks and the chain-of-custody note. Signal is €90 a year, or €9 a month. Students, €49 a year.
Join SignalSignal includes:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every prompt and field report
- Shadow Analysis, every forensic dossier
- OSINT Hub community access
