# Ip Investigation

> Use when a user asks to investigate, check, enrich, or characterize an IP address (IPv4 or IPv6). Chains VirusTotal, Shodan, AbuseIPDB, GreyNoise, OTX, and optionally Censys in parallel, then consolidates findings and prioritizes follow-up IOCs. Invoked by /cti-orchestrator when the target is an IP.

- **Type:** Skill
- **Install:** `agentstack add skill-liberty91ltd-cti-skills-ip-investigation`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Liberty91LTD](https://agentstack.voostack.com/s/liberty91ltd)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** https://github.com/Liberty91LTD/cti-skills/tree/main/skills/ip-investigation
- **Website:** https://liberty91.com/cti-skills

## Install

```sh
agentstack add skill-liberty91ltd-cti-skills-ip-investigation
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# ip-investigation

Investigate an IP address end-to-end. Chain multiple `lookup-*` skills, consolidate results, prioritize follow-up IOCs, and return a rated investigation summary. You invoke skills — you don't call APIs directly.

**This skill invokes:** `/lookup-virustotal`, `/lookup-shodan`, `/lookup-abuseipdb`, `/lookup-greynoise`, `/lookup-otx`, optionally `/lookup-censys`, optionally `/lookup-reversinglabs` (network threat-intel + sample fan-out), optionally `/lookup-crowdstrike` (IOC reputation + actor/malware links), optionally `/lookup-misp` and/or `/lookup-opencti` (internal correlation), then `/source-assessment`, `/tlp-guide`, `/confidence-levels`.

## When to invoke

- User asks to investigate, check, or enrich an IP
- User pastes an IP and asks "what is this?" / "is this malicious?"
- Another skill hands off an IP indicator for follow-up
- IOC triage pipeline

## Inputs

```yaml
indicator: 
context: 
tlp_ceiling: 
```

## Procedure

### 1. Validate + triage (before spending API quota)

- Reject RFC 1918 / loopback / link-local / documentation-range (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) unless the user specifically asks — these are not public infrastructure and enrichment is wasted
- Check if the IP is already in `data/iocs/` — if yes, load existing enrichment and note age
- Decide whether to include Censys (skip by default due to 250/month quota)

### 2. Parallel lookups

Invoke in parallel (agents should batch these calls):

```
/lookup-greynoise ip     # FAST — filter out noise early
/lookup-virustotal ip    # reputation aggregate
/lookup-abuseipdb ip     # abuse reports
/lookup-shodan ip        # infrastructure fingerprint
/lookup-otx ip           # community pulses
```

**Add to the same parallel batch if credentials are configured**:
```
/lookup-reversinglabs ip                  # if $REVERSINGLABS_USER is set. Network reputation from RL's malware-analysis corpus — files seen contacting this IP, RL classification. One API call, no pivot fan-out.
/lookup-crowdstrike indicator             # if $CROWDSTRIKE_CLIENT_ID is set. Falcon Intel view — malicious confidence, linked actors + malware families, report refs. One API call.
/lookup-misp search-attributes --value    # if $MISP_URL + $MISP_KEY are set. Internal correlation against your own catalogued events.
/lookup-opencti lookup                    # if $OPENCTI_URL + $OPENCTI_TOKEN are set. Internal correlation against your OpenCTI knowledge base (observables + indicators in one call).
```

Optionally add (escalation — separate API budget):
```
/lookup-censys ip                                                 # ONLY if Shodan insufficient + quota available
/lookup-reversinglabs ip  --pivot files,domains,urls --max-results 25
# only when you want sample fan-out from the IP — each --pivot entry is a separate API call
```

### 3. Short-circuit on noise

If GreyNoise returns `noise: true` and `classification: benign`, AND AbuseIPDB confidence 
type: ipv4 | ipv6
consolidated_verdict: malicious | suspicious | clean | benign-noise | unknown
detection_signals:
  - source: virustotal
    detection_ratio: 
    verdict: 
  - source: abuseipdb
    abuse_confidence: 
    recent_reports: 
  - source: greynoise
    noise: 
    riot: 
    classification: 
infrastructure:
  asn: 
  org: 
  country: 
  open_ports: 
  services: 
  vulnerabilities: 
  certificates: 
community_context:
  pulse_count: 
  key_actors_attributed: 
pivot_candidates:
  - type: domain
    value: 
    reason: 
  - type: hash
    value: 
    reason: 
```

### 5. Prioritize follow-up IOCs

Rank pivot candidates by investigative value:

1. **Certificate matches** (highest — strong infrastructure link)
2. **Communicating files** (medium-high — active C2 signal)
3. **Passive DNS resolutions** (medium — historical association)
4. **Recent WHOIS/registration overlaps** (medium)
5. **Generic ASN/org neighbors** (low)

Return the top 3-5 candidates to the invoking skill or orchestrator for optional deep-dive via `/domain-investigation`, `/hash-investigation`, or `/indicator-pivoting`.

### 6. Apply rigor

Before returning, chain:
- `/source-assessment` — rate each lookup result (defaults in each lookup skill's frontmatter)
- `/tlp-guide` — mark the investigation output (default AMBER)
- `/confidence-levels` — score the consolidated verdict (MISP 0-100)

### 7. Return

```yaml
title: "IP Investigation: "
tlp: AMBER
confidence: 
summary: 
verdict: 
detection_signals: 
infrastructure: 
community_context: 
pivot_candidates: 
source_ratings:
  virustotal: B2
  shodan: B2
  ...
investigation_date: 
recommended_next_steps:
  - 
```

## When to stop

- GreyNoise benign-noise short-circuit (step 3)
- All lookups returned "not found" → report no signal; don't escalate
- Clear malicious verdict with high confidence → return; leave deeper pivots to the user

## Rate-limit awareness

Respect the lookup skills' own rate limits. Parallelizing 5 lookups on one IP = 5 API calls total, well within all free tiers. Don't loop over a list without throttling — use `/ioc-enrichment-workflow` for bulk.

## Related skills

- `/domain-investigation`, `/hash-investigation`, `/url-investigation` — sibling investigation skills
- `/indicator-pivoting` — deeper graph traversal from a starting IOC
- `/ioc-enrichment-workflow` — bulk IOC list enrichment
- `/threat-actor-profiling` — if the IP is attributed to a known actor, consider profiling
- `/cti-orchestrator` — typically the caller

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** [Liberty91LTD/cti-skills](https://github.com/Liberty91LTD/cti-skills)
- **License:** MIT
- **Homepage:** https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-liberty91ltd-cti-skills-ip-investigation
- Seller: https://agentstack.voostack.com/s/liberty91ltd
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.