Understanding IP Intelligence
A single IP address can reveal the hosting provider or ISP behind it, what services are publicly exposed, the security posture of the system, and potential vulnerabilities.
Active scanning means directly probing a target with tools like nmap or masscan. Passive reconnaissance relies on data already collected by services like Shodan and Censys. Shodan continuously indexes the entire internet, scanning every public IP and cataloging the services it finds. You can look up information about any IP without sending a single packet to the target.
For OSINT practitioners, passive reconnaissance is strongly preferred. Because you never make direct contact with the target, there is no risk of triggering intrusion detection systems, no legal ambiguity around unauthorized scanning, and no trace of your investigation on the target's logs. Services like Shodan InternetDB act as a legal safe harbor: the data is already public, and you are simply querying a search engine.
What Open Ports Tell You
Here are some common ports and what they tell you:
- Port 22 (SSH) - Secure shell access, typically indicates a Linux/Unix server with remote administration enabled
- Port 80 / 443 (HTTP / HTTPS) - Web servers
- Port 3306 (MySQL) - MySQL database server, should never be publicly exposed
- Port 5432 (PostgreSQL) - PostgreSQL database server, another service that should remain internal
- Port 3389 (RDP) - Remote Desktop Protocol, indicates a Windows machine with remote access
- Port 8080 (Proxy / Alt HTTP) - Often used for proxy servers, development environments, or alternative web services
- Port 27017 (MongoDB) - MongoDB database, historically a major source of data leaks when left exposed
When database ports like 3306, 5432, or 27017 are exposed to the internet, it almost always indicates a misconfiguration. These services are designed to run behind a firewall and should never be directly accessible. Similarly, an exposed RDP port (3389) is a common attack vector and suggests weak security practices.
Port combinations can also reveal the underlying technology stack. For example, an IP with ports 80, 443, and 22 open is a typical Linux web server. If you see port 3389 instead of 22, the system is likely running Windows. An IP with ports 80, 443, 8080, and 3306 might be running a LAMP stack with a reverse proxy or development server.
CPE: Common Platform Enumeration
CPE (Common Platform Enumeration) strings are a standardized way of naming and identifying software, operating systems, and hardware. They follow a structured format that makes it possible to precisely identify what is running on a target system.
A CPE string looks like this: cpe:/a:apache:http_server:2.4.41. The format breaks down as follows:
- /a: indicates an application (as opposed to /o: for operating system or /h: for hardware)
- apache is the vendor
- http_server is the product name
- 2.4.41 is the exact version number
CPE strings let you identify the exact software versions running on a target. When Shodan detects a service, it extracts version information from banners and maps it to a CPE. This gives you a fingerprint of the software stack, which can then be cross-referenced against known vulnerabilities.
CVE: Known Vulnerabilities
CVE (Common Vulnerabilities and Exposures) identifiers are unique labels assigned to publicly disclosed security flaws. Each CVE follows the format CVE-YEAR-NUMBER (for example, CVE-2021-44228 for the Log4Shell vulnerability) and serves as a universal reference for a specific security issue.
Shodan maps CVEs to IP addresses by detecting the software versions running on each host (via CPE strings) and cross-referencing them against known vulnerability databases. This means that when you look up an IP, you can immediately see which known security flaws may affect the services running on it.
The National Vulnerability Database (NVD) maintained by NIST is the authoritative reference for CVE details, including technical descriptions, affected software versions, and severity scores.
Each CVE is assigned a CVSS (Common Vulnerability Scoring System) score that indicates its severity:
- 0.0 - 3.9 (Low) - Minor issues with limited impact
- 4.0 - 6.9 (Medium) - Moderate vulnerabilities that require some conditions to exploit
- 7.0 - 8.9 (High) - Serious flaws that can lead to significant compromise
- 9.0 - 10.0 (Critical) - Severe vulnerabilities, often remotely exploitable with little or no user interaction
Beyond Shodan InternetDB
Other services that can complement Shodan InternetDB:
- Censys provides internet-wide scanning data with a focus on TLS certificates and service discovery, offering a different perspective from Shodan
- GreyNoise helps you determine whether an IP is a known scanner or part of internet background noise, useful for distinguishing between targeted activity and automated scanning
- AbuseIPDB is a community-driven database of IP addresses reported for malicious activity. It can tell you if an IP has been flagged for spam, brute-force attacks, or other abuse
- IPInfo provides ASN (Autonomous System Number) lookups, geolocation data, and hosting detection, helping you understand the network infrastructure behind an IP
Combining data from multiple sources gives you a much more complete picture than any single tool can provide. For example, an IP flagged on AbuseIPDB that also shows exposed database ports on Shodan and is identified as a known scanner by GreyNoise paints a very clear picture of a compromised or malicious host.
OSINT Tools for IP Intelligence
Here are some useful tools for IP address intelligence gathering:
