> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/osint/threat-intel-lookups.md).

# Threat Intel Lookups

## IP-address Lookup

### IP-address Lookup at ipinfo.io

You can lookup IP-address info from `ipinfo.io` with `curl` like this

```bash
curl http://ipinfo.io/<ip>
```

Example:

```bash
┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Sherlocks/Very_Easy/Operation_Blackout_2025_Phantom_Check]
└─$ curl http://ipinfo.io/65.2.161.68                                                                                                  
{
  "ip": "65.2.161.68",
  "hostname": "ec2-65-2-161-68.ap-south-1.compute.amazonaws.com",
  "city": "Mumbai",
  "region": "Maharashtra",
  "country": "IN",
  "loc": "19.0728,72.8826",
  "org": "AS16509 Amazon.com, Inc.",
  "postal": "400017",
  "timezone": "Asia/Kolkata",
  "readme": "https://ipinfo.io/missingauth"
}  
```