Summary

A person received a banking security notification for an unexpected login attempt. The notification provided an IP address, Android device information, and an approximate timestamp.

The objective was to determine what could be established about the source using passive OSINT without attempting to access, scan, or interact with the source system.

  • Duration: ~30 minutes
  • Outcome: Network operator identified; individual not identified
  • Jurisdiction: Maldives

Initial Information

The notification contained:

Device: Android Mobile App
OS: Android 10
IP: [Redacted]
Location: Unknown
Time: [Redacted]

The bank, account, person, IP address, and exact timestamp are intentionally omitted.

Investigation

WHOIS

The IP was queried through the relevant Regional Internet Registry.

Network:       [Redacted]/24
Organization:  Ooredoo Maldives Plc
Country:       Maldives
Registry:      APNIC
ASN:           AS55944

This established that the address belonged to an Ooredoo Maldives network.

BGP / ASN

The result was independently verified using BGP information:

AS55944 → Ooredoo Maldives
[Redacted]/24 → AS55944

This confirmed the network origin rather than relying on a single IP database.

Reverse DNS

dig -x [REDACTED-IP]

Result:

NXDOMAIN

The address had no useful PTR record.

Public IP Intelligence

Public IP intelligence was checked for:

  • Hosting/VPS associations
  • VPN/proxy indicators
  • Tor associations
  • Hosted domains
  • Reputation reports

No information was found that could identify the individual behind the connection.

Result

The investigation established:

IP address
    ↓
BGP prefix
    ↓
AS55944
    ↓
Ooredoo Maldives
    ↓
Maldives

It did not establish the subscriber or physical location of the user.

Mobile networks can use dynamic addressing and carrier-grade NAT, meaning a public IP should not automatically be treated as a unique identifier for an individual.

Further attribution would require provider-side records, potentially including precise connection timestamps, NAT/session information, and subscriber records.

Tools

whois [REDACTED-IP]

whois -h whois.cymru.com " -v [REDACTED-IP]"

dig -x [REDACTED-IP]

Additional public IP intelligence sources were used for reputation and infrastructure checks.

Lessons Learned

IP Attribution Has Limits

WHOIS and BGP can establish who operates an IP range, but generally cannot identify the person using it.

BGP Provides Independent Verification

ASN and route information can corroborate WHOIS results and establish the network announcing an address.

Reverse DNS Is Not Guaranteed

A customer-facing IP may have no PTR record, providing no additional hostname or infrastructure information.

Mobile IPs Require Caution

Dynamic assignment and carrier-grade NAT can make IP-to-person attribution impossible without ISP logs.

Know When Public OSINT Ends

The practical boundary in this investigation was:

IP → Network → Provider

Going further requires private provider records rather than additional public enumeration.

Responsible Disclosure

The published version intentionally omits:

  • Affected person's identity
  • Bank and account information
  • Exact IP address
  • Exact timestamp
  • Subscriber information
  • Personal contact information

No active scanning, exploitation, authentication attempts, or interaction with the source system was performed.

This case study demonstrates passive OSINT methodology using publicly available network information. Identifying details have been redacted or generalized.