# IP Addresses, Domains, DNS, and Network Infrastructure

> Read IP addresses, ASNs, hosting context, domain names and DNS records as an analyst, and know the limits of each.

Canonical: https://codelivly.com/rooms/cti-ip-domain-dns-infrastructure
Last updated: 2026-10-28

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

**Purpose.** Network infrastructure indicators (IPs, domains and the DNS records that connect them) are the backbone of most indicator analysis. This module teaches you to read them precisely and to recognise when an apparently precise indicator is actually shared infrastructure.

**Prerequisites.** Module 1 of this learning path. Basic familiarity with what an IP address and a domain name are.

**Learning outcomes.** After this module you can:

- Calculate CIDR block sizes, normalise IPv6 addresses, and recognise special-purpose ranges that are never external indicators.
- Interpret ASN and hosting context (dedicated, shared, CDN, residential, mobile, anonymiser) and its effect on false positive risk.
- Explain what A, AAAA, CNAME, MX, NS, TXT, PTR and SOA records can and cannot tell you.
- Identify the registrable domain, recognise lookalike techniques and scope domain indicators correctly.

**Practical completion objective.** From a supplied set of DNS, IP context and RDAP records, characterise a suspicious domain, link it to a related domain with a justified confidence level, and produce a block list that excludes shared infrastructure.

## Lessons

1. IP Addressing Essentials for Analysts (15 min)
2. ASNs, Hosting Context and Shared Infrastructure (15 min)
3. DNS Record Types and What They Reveal (15 min)
4. Domain Structure, Lookalikes and Shared Namespaces (15 min)
5. Lab: Investigate a Suspicious Domain from DNS and Registration Records (45 min)

## Related

- [Learning path: OSINT and Indicator Analysis](https://codelivly.com/learning-paths/cti-osint-indicator-analysis)
- [All rooms](https://codelivly.com/rooms)