From investigator
Investigate an IP address: ownership, hosting provider, ASN, reputation, and associated infrastructure. Passive sources only — no active scanning.
How this skill is triggered — by the user, by Claude, or both
Slash command
/investigator:ip-intelThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Produce an IP intelligence report for $ARGUMENTS using passive public sources only.
Produce an IP intelligence report for $ARGUMENTS using passive public sources only.
Use ipinfo.io for the primary lookup: ASN, organisation name, and geolocation.
Then cross-reference with the authoritative regional internet registry for the IP's allocation:
| Region | Registry | URL |
|---|---|---|
| North America | ARIN | arin.net |
| Europe, Middle East, Central Asia | RIPE NCC | ripe.net |
| Asia Pacific (including AU/NZ) | APNIC | apnic.net |
| Latin America | LACNIC | lacnic.net |
| Africa | AFRINIC | afrinic.net |
The RIR record gives the authoritative allocation — who IANA assigned the block to, and any sub-allocations.
Look up the PTR record via MXToolbox reverse lookup.
Reverse DNS naming conventions often reveal:
mail.company.com, api-prod-1.cloud.company.com)compute.amazonaws.com, servers.ovh.net)syd01.hosting.example.com suggests Sydney data centre)Check multiple reputation sources — a clean result on one doesn't mean clean everywhere:
Note: Shodan data may be stale. It's a historical record of what was observed, not necessarily current state.
Has this IP been notable before? Search:
[IP address] incident / [IP address] breach / [IP address] attack## IP intelligence: [IP address]
**Date:** [today]
**Purpose logged:** [stated purpose]
**Methods:** Passive open-source only
### Ownership
| Attribute | Value |
|---|---|
| Organisation | — |
| ASN | — |
| RIR | — |
| Allocated to | — |
| Geolocation | — |
### Reverse DNS
[PTR record and what it reveals about the operator]
### Reputation
| Source | Result | Details |
|---|---|---|
| VirusTotal | Clean / [N detections] | — |
| AbuseIPDB | [N reports] | [Types of abuse] |
| Shodan | [Services observed] | [Date of last scan] |
### Related infrastructure
[Other domains on this IP, ASN pattern, shared hosting context]
### Historical context
[Any notable history — incidents, ownership changes, notable associations]
### Notable observations
[Anything significant — unusual patterns, discrepancies between sources]
### Gaps
[What couldn't be established with passive methods]
### Sources
1. [Tool/Registry](URL) — [what it contributed]
Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub hpsgd/turtlestack --plugin investigator