Pivot map
Pivot from here
Outputs from RIPE can become inputs for the next tool. These are the most relevant follow-on pivots in the library.
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
Algo VPN automates deployment of a personal WireGuard or IKEv2 VPN server in the cloud for private, secure OPSEC browsing.
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
AccountKiller provides direct deletion links and step-by-step instructions for removing accounts on hundreds of websites and social platforms.
Investigator Use
RIPE NCC (Réseaux IP Européens Network Coordination Centre) is the Regional Internet Registry (RIR) responsible for IP address allocation and registration in Europe, the Middle East, and parts of Central Asia. The RIPE WHOIS database is the authoritative source for IP address and ASN assignments in this extensive geographic region covering 75 countries.
For OSINT investigators, RIPE is the primary reference for IP addresses in the RIPE service region. When a suspicious IP address traces to European, Middle Eastern, or Central Asian infrastructure, the RIPE WHOIS database provides the authoritative record of which organization holds the allocation, their registered contact details, abuse reporting contacts, and the network block structure.
RIPE WHOIS is searchable by IP address, network name, organization, and contact details. This reverse lookup capability allows investigators to find all IP addresses and networks registered to a specific organization — mapping the complete IP infrastructure of a target entity.
The organization database within RIPE WHOIS contains registered business information for network operators including company names, addresses, and contact details submitted at registration time. While this information may be out of date and is not independently verified by RIPE, it provides an investigative starting point for identifying network operators.
For law enforcement investigations, RIPE's abuse contact data identifies the correct reporting party for malicious activity originating from specific IP ranges. Legal process targeting the correct network operator requires accurate identification of who holds the IP allocation — which RIPE WHOIS provides authoritatively.
RIPE also provides historical route object data showing BGP routing history, which reveals how IP blocks have been routed and transferred over time. Route history is relevant for investigations involving infrastructure changes or ownership transfers.
RIPE's bulk data downloads are available for researchers needing to analyze the complete RIPE database programmatically — useful for large-scale infrastructure mapping projects.
Document the IP or network queried, the registered organization and contact information, network block coverage, and query timestamp for all RIPE WHOIS lookups used in investigation documentation.
Before You Pivot
Capture the target, search terms, and why this source is relevant before you leave the page.
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Treat one tool as a lead source. Confirm important findings with independent sources.
Related tools
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
Internet-wide search interface for hosts and certificates with large-scale host, service, and virtual host coverage plus API access.
Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network
Criminal IP delivers AI-powered IP threat intelligence, attack surface data, and fraud detection for cyber threat investigations.
Free domain research tool to discover hosts related to a domain. Find visible hosts from the attackers perspective for Red and Blue Teams.