Objectives:
The study aimed to determine whether passive OSINT techniques, executed locally via Python scripts, can effectively identify structural patterns and anomalies within the IPv4/IPv6 address space. The analysis examined the utility of diverse OSINT metadata, such as ASN, DNS, TLS certificates, and reputation data, for profiling potentially malicious infrastructure, while accounting for technical, methodological, and ethical limitations.

Methods:
A five-stage OSINT pipeline was developed, encompassing IP address collection, data acquisition from public sources, normalization and aggregation of metadata into a local SQLite database, and correlation and statistical analysis. The process relied exclusively on passive sources, including ASN registries, DNS records, TLS certificate logs, geolocation data, and reputation databases. This pipeline enabled an assessment of data consistency and its utility in identifying infrastructural interdependencies.

Results:
The metadata exhibited significant variability in terms of completeness. Addresses enriched with data from multiple sources were easier to classify and more frequently revealed recurring patterns. DNS and TLS data proved to be the most informative, while geolocation offered limited analytical value. Furthermore, suspicious activity was observed to be concentrated within specific Autonomous System Numbers (ASNs), alongside small, compact clusters of high-risk IP addresses that appeared across various public repositories.

Conclusions:
The study confirms that a passive OSINT pipeline can effectively support the early detection of malicious infrastructure and the enrichment of data within analytical processes. Its modular design allows for integration with Threat Intelligence systems. Future work will focus on analyzing infrastructure changes over time, evaluating the reliability of OSINT sources, and developing models for automated risk assessment.