IP address lookup
An IP address shows up in breach data as a registration or last login value. It is the weakest identifier on its own, because addresses are recycled and shared, but it becomes useful when it appears repeatedly alongside the same account.
Run a ip address lookupexample: 203.0.113.10
What a result contains
Account activity
Accounts recorded with the address at registration or login.
Co-occurrence
Other identifiers recorded with the same address.
Provider context
Whether the address belongs to a hosting or residential range.
Persistence
Whether the address appears across multiple breaches.
How to read the result
- Treat a shared or carrier NAT address as weak evidence. A single IP match alone does not tie two accounts to one person.
- Repeated appearances of the same address with the same username across years is the pattern worth acting on.
Modules queried
- Snusbase
- IntelX
- BreachBase
Each row in a result set names the module it came from, so findings stay traceable.