 |
| IP & MAC Address? Technical Findings in OSINT Context |
Discover how IP and MAC addresses are used in OSINT investigations. Learn technical methods, critical risks, and best practices for cybersecurity and ethical intelligence gathering.
In field of OSINT (Open Source Intelligence), two identifiers often play a crucial role in digital investigations: IP address and MAC address. These technical elements are essential for mapping digital footprints, attributing activity, and understanding how devices interact within a network.
However, while IP and MAC addresses provide valuable intelligence, they also come with limitations and vulnerabilities.
IP Addresses in OSINT
An IP (Internet Protocol) address is unique identifier assigned to a device connected to internet. In OSINT investigations, IP addresses are used to:
- Geolocate Users: Approximate physical location through IP based geolocation services.
- Map Infrastructure: Identify hosting providers, DNS records, or server locations.
- Track Malicious Actors: Correlate suspicious activity across logs, leaks, or forums.
Technical Methods in OSINT:
- WHOIS Lookup - Provides ownership and registration data of IP blocks.
- Passive DNS Databases - Reveal historical DNS resolutions connected to an IP.
- Shodan & Censys - Scan and index internet connected devices, tied to IPs.
- Log Correlation - Cross-referencing IPs found in phishing emails, breach data, or forums.
MAC Addresses in OSINT
A MAC (Media Access Control) address is a hardware identifier assigned to network interfaces. Unlike IP addresses, MAC addresses do not usually leave local network. However, they may still appear in:
- Public Wi-Fi Tracking: Some hotspot systems log device MAC addresses.
- IoT Devices: Misconfigured IoT systems sometimes expose MAC details.
- Leaked Databases: Data dumps from telecoms or network providers may contain MACs.
Technical OSINT Uses of MAC Addresses:
- Device Fingerprinting – Identifying unique devices even if IPs change.
- Vendor Identification – first half of a MAC address reveals device manufacturer.
- Network Mapping – In local penetration testing or red team operations, MACs show relationships between devices.
