How to Investigate a Suspicious IP Address: A SOC Analyst's Workflow

An alert fires. Somewhere in it is an IP address, and the clock is already running. The question is never just "is this IP bad?" — it is "is this IP bad enough, right now, to act on?" Here is a workflow that answers that consistently, without twelve open tabs.

Start with reputation, not geography

The most decision-relevant signal is reputation: has this IP been reported for abuse, and by how many independent sources? AbuseIPDB gives you a confidence-of-abuse score and the categories behind it. VirusTotal aggregates dozens of vendor verdicts in one place. If both are clean and the IP is well-known infrastructure, you can often de-prioritise in seconds.

Treat a single malicious verdict as decisive, not as one vote to be averaged away. Worst-verdict-wins is the right mental model: one high-confidence malicious hit outweighs a pile of "clean" results, because the clean results only mean "not seen," not "safe."

Separate signal from noise

A huge share of "suspicious" IP hits are internet background noise — mass scanners, researchers, and benign crawlers. GreyNoise exists precisely to tell you whether an IP is scanning the entire internet indiscriminately or targeting you specifically. If GreyNoise classifies it as common benign noise, the urgency drops sharply.

Rule of thumb: reputation tells you if it is bad; noise classification tells you if it is about you.

Check exposure and ownership

Shodan shows you what services and ports the IP exposes, which turns an abstract address into a concrete picture: is this a hardened cloud host, a misconfigured RDP box, or a known VPN exit? ipinfo rounds it out with ownership, ASN, and geolocation — useful for spotting "this login came from an ASN our staff never use" patterns.

Reach a verdict, then pivot deliberately

1. 1Reputation (AbuseIPDB, VirusTotal) — is it reported malicious?
2. 2Noise (GreyNoise) — is it targeting us or scanning everyone?
3. 3Exposure (Shodan) — what does it expose, and does that fit the alert?
4. 4Ownership (ipinfo) — whose ASN and geography is this?

Only after you have a verdict should you open deeper Tier 2 sources — and then one at a time, deliberately, for the specific question you still have. Opening ten tabs reflexively is how context gets lost.

Make it fast and repeatable

The reason this workflow breaks down in practice is friction: copying the IP, defanging or refanging it, logging into five portals, and reconciling five layouts. Deep Detect collapses that into a right-click — it queries all five Tier 1 sources in parallel and returns a single verdict, so the workflow above takes seconds instead of minutes. The analysis is the same; the tab-hopping is gone.