Pivot map
Pivot from here
Outputs from ARIN can become inputs for the next tool. These are the most relevant follow-on pivots in the library.
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
AccountKiller provides direct deletion links and step-by-step instructions for removing accounts on hundreds of websites and social platforms.
Ahmia indexes Tor hidden services, enabling investigators to search .onion sites by keyword without the Tor browser.
Investigator Use
ARIN, the American Registry for Internet Numbers, manages the allocation and registration of IP addresses and Autonomous System Numbers for North America, including the United States, Canada, and many Caribbean and North Atlantic territories. ARIN's WHOIS database is a critical OSINT resource for tracing the ownership and assignment history of IP addresses and network ranges.
What investigators use ARIN for: identifying which organization owns or has been allocated a specific IP address, finding the ASN associated with an IP range, discovering contact information for network administrators, tracing IP address history and re-assignment, and pivoting from an IP to the parent organization for further investigation.
What ARIN exposes: organization names and IDs for IP address holders, point of contact records including names and email addresses (where not redacted), network range allocations and sub-allocations, ASN registration details, registration dates, and routing policy information.
ARIN WHOIS is most useful when investigating North American IP space. Enter an IP address to see its full allocation record — who the block was allocated to, when, and what organization currently holds it. For large organizations, ARIN records often show multiple sub-allocations to different divisions, data centers, or subsidiary companies.
ASN investigation: every IP address belongs to an Autonomous System. The ASN registered with ARIN typically corresponds to the organization that routes that IP space — which may be a hosting provider, ISP, or the end organization itself. Querying an ASN in ARIN returns all IP ranges registered to that ASN, allowing investigators to map the complete network footprint of an organization.
Limitations: ARIN covers North America only. For IP addresses in Europe use RIPE, for Asia-Pacific use APNIC, for Latin America use LACNIC, and for Africa use AFRINIC. For unknown regions, the global WHOIS aggregator at who.is or the IANA lookup can route your query to the appropriate RIR.
In a workflow: after obtaining an IP address from a log file, email header, or Shodan result, query ARIN to identify the owning organization. If the IP is allocated to a cloud provider like AWS or Azure, the actual customer is usually identified through the sub-allocation record or through the cloud provider's own IP lookup tool.
Before You Pivot
Capture the target, search terms, and why this source is relevant before you leave the page.
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Treat one tool as a lead source. Confirm important findings with independent sources.
Related tools
Free online network tools, including traceroute, nslookup, dig, whois, ping, and our own Domain Dossier and Email Dossier. Works with IPv6.
An open source intelligence tool to crawl the graph of certificate Alternate Names
Finds certificates and subdomains using Certificate Transparency data. An alternative to crt.sh that presents the information a bit differently.
DNS History archives historical DNS records, letting investigators track IP changes, hosting migrations, and infrastructure pivots over time.
DNS Twister generates and monitors domain permutations for typosquatting detection, brand protection, and phishing infrastructure discovery.
Free DNS, WHOIS, and email-authentication lookups for any domain: SPF analysis with the 10-lookup limit check, DKIM selector discovery, DMARC checks, email header analysis, and blacklist checks. Results explain in plain English what each record means. No account needed for basic lookups; free API tier available.