Investigate an IP or domain

What this does

Given an IP address or a domain name, answers two questions:

1. Is it ours, and where? Resolves ownership across every cloud resource type in the SubImage graph (compute, network interfaces, elastic IPs, DNS records, CDN, load balancers, GCP, Azure), and traces the DNS resolution chain (domain → CNAME → A → IP → resource).
2. What is it on the internet? For a public IP, enriches with subimageEnrichIp (Spur): owning ASN/org, geolocation, and whether it is a datacenter, VPN, proxy, Tor exit, or residential proxy.

The graph is authoritative for internal ownership; subimageEnrichIp adds the external attribution you need to judge whether inbound/outbound traffic is suspicious.

When to use

✅ "Who owns 203.0.113.42?" / "is this IP one of ours?" ✅ "What does app.example.com resolve to / point at?" ✅ Triaging an IP or domain from a log line, alert, or finding. ✅ Tracing a domain's resolution chain to the resource behind it.