IP Address Lookup

About the IP Address Lookup

Paste an IPv4 or IPv6 address — from a server log, an e-mail header, a firewall alert or your router — and see everything that is public about it, each part from the source that is responsible for it: the organisation it is registered to and its abuse contact (from the regional internet registry over RDAP), the network that routes it (origin AS number, AS name and BGP prefix), the country it is used in (DB-IP), the hosting provider or cloud service and region, its reverse DNS name with forward confirmation, and whether it is a Tor relay or exit.

Private, carrier-grade NAT, documentation and other special-purpose addresses are recognised from IANA’s registries and explained instead of being looked up. Location is deliberately country-level only: for someone else’s address, a city guess is often wrong and never needed to report abuse.

Common uses

• Finding out who is behind an address in your server, firewall or mail logs, and where to report attacks, spam or scanning.
• Checking whether a visitor or sign-up comes from a cloud server, a VPN or proxy host, or Tor rather than a home or mobile connection.
• Seeing which AWS, Google Cloud, Azure, Oracle Cloud, DigitalOcean, Akamai (Linode) or Vultr region or service an address belongs to.
• Verifying that a server’s reverse DNS is set up and forward-confirmed before it sends e-mail.

Where each answer comes from

• Registration (RDAP): IANA’s bootstrap file names the regional internet registry — ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC — and your browser asks it directly (RFC 9083); registries can refer the question on to another registry or to a national registry such as NIC.br, KRNIC or JPNIC.
• Routing: the origin AS, BGP prefix and AS name come from Team Cymru’s IP to ASN mapping, a free community service whose BGP data is refreshed every four hours, asked over DNS.
• Country: DB-IP IP to Country Lite (CC BY 4.0), shipped with this site in small pieces — only the piece that covers your address is downloaded, from MySmartCoPilot.
• Hosting: the AS number names the provider; for AWS, Google Cloud, Azure, Oracle Cloud, DigitalOcean, Akamai (Linode) and Vultr the service and region come from their own published IP range files.
• Reverse DNS: a PTR query and a forward A/AAAA query over DNS over HTTPS.
• Tor: the Tor Project’s Onionoo relay list (relays that ran in the past week).
• Address type: IANA’s special-purpose and address-space registries (RFC 6890).

How accurate is the location?

IP location is an estimate from a database, not a measurement. VPNs, proxies, Tor, mobile networks that route through another country, satellite internet and anycast services (Google DNS, Cloudflare, CDNs) can appear in a different country — the same anycast address is served from many places at once. DB-IP describes the free Lite edition as a subset of its full database with reduced accuracy. That is why this tool shows the country only and never a city or street for someone else’s address.

The registration country in the RDAP record and the routing data is something else: where the holder registered the block, which often differs from where it is used.

Owner, network and hosting are different questions

The RDAP holder is the organisation the block is registered to. The origin AS is the network that announces the route to it on the internet — often the same organisation, but not always: a company’s own block can be announced by its internet provider, and an address in a cloud provider’s range can be rented by anyone. The hosting provider is named from the origin AS (for example AS16509 is Amazon) and, where the provider publishes its ranges, refined to the service and region. An address on a CDN such as Cloudflare, Akamai or Fastly is shared by many websites and does not identify one of them.

Reverse DNS and forward confirmation

Reverse DNS turns an address back into a host name through a PTR record. Whoever controls the reverse zone can set any name, so a PTR record alone proves nothing: it is forward-confirmed (FCrDNS) only when that name also resolves back to the same address. Mail servers and crawler checks (such as Google’s documented way to verify Googlebot) rely on forward confirmation.

Limitations

• Location is country-level and an estimate from DB-IP’s monthly Lite database (built into this page); it cannot locate a person, a street or a city.
• Cloud regions and services are known only for the seven providers whose published range files are built in, as of their snapshot dates; other providers are recognised by AS number only, and unknown networks are shown with their registered AS name.
• The registry, Team Cymru (through Cloudflare’s DNS resolver) and the Tor Project must be reachable from your browser; some corporate networks and content blockers stop these requests, and registries may limit how many lookups they answer.
• It does not list the websites hosted on an address: a list of domains per address is not available from these public sources.

Privacy

The address you enter is sent from your browser, without cookies, to the regional internet registry responsible for it (RDAP; the browser first downloads IANA’s public bootstrap file, which does not contain your address), to Cloudflare’s DNS-over-HTTPS resolver (Google’s if Cloudflare cannot be reached) for the reverse DNS and Team Cymru routing questions, and to the Tor Project’s Onionoo service. The country is looked up in a data file downloaded from MySmartCoPilot that covers a large block of addresses, so it does not reveal the exact address. MySmartCoPilot does not store or log your lookups.