IP Address Lookup
Who holds an IP address or AS number, how it’s routed, where it appears to be and how to report abuse.
Asked from our server in Newark, US · the registry over RDAP, routing from RIPE’s route collectors
CONSOLE The instruments
Each one lights as its check lands. Routes are what RIPE’s route collectors see; the place is approximate.
Route map
How the internet reaches an address
Each line is an AS path as one of RIPE NCC’s route collectors (RIS) sees it, via RIPEstat. We don’t run BGP. A diagram, not to scale.
- Route collector
- Network (AS)
- On several paths
- Signed (RPKI)
- The address
At the terminus
Line indexevery line in words
The full report
Everything the lookup found
What the IP address lookup shows
Every public IP address sits in a block that one of five regional internet registries has handed to an organisation, such as an internet provider, a hosting company or a large business. The IP address lookup asks the right registry over RDAP, from our server in Newark, US, and shows who holds the block, how big it is, where it sits in the registry’s tree and who to contact about abuse. It also accepts AS numbers, the IDs that networks use when they route traffic between each other.
It then checks how the address is routed: which network announces it, whether that route is signed with RPKI and how widely it is seen. It adds an approximate place from DB-IP, the reverse DNS name and whether it points back, whether the address answers on port 443 and how quickly, and whether it is on six public blocklists of spam senders, infected machines and open proxies, or on Tor’s list of exit relays.
How to use it
- Type a public IP address, IPv4 or IPv6, or an AS number such as AS13335.
- Press Look up. We ask the registry first, then check the route, reverse DNS and the blocklists.
- Read the holder and the abuse contact. Copy a ready-made abuse report or the raw RDAP record, or make a PDF report.
Understanding the results
The registry record names the network, its range and the organisation that holds it. A small business’s address is often registered to its internet provider, so the holder may be the provider rather than whoever is using the address today.
The route comes from public data gathered by RIPE NCC’s route collectors around the world; we don’t run BGP ourselves. RPKI “valid” means a signed record says this network may announce the block. “Not found” is common and means no record covers it. “Invalid” means networks that check will drop the route.
The place is approximate and often shows where the holder is based rather than the server you reach. We test it against the speed of light: if a reply reaches Newark faster than light in fibre could cover the distance, the server is closer than the database says, which usually means the address is anycast and answered from many places.
Questions
How do I report abuse from an address?
Use the abuse contact from the registry record. The tool can copy a report with the address, the network and space for your log lines. It never sends anything for you.
What is an AS number?
An autonomous system is a network with its own routing policy, such as an internet provider or a large company. Each has a number, and the lookup shows what it announces and which networks it connects to.
Is the location exact?
No. It comes from DB-IP’s free database, which is usually right about the country and less often about the city. On a VPN or a cloud network it is the network’s place, not the person’s.
Why is an address on a blocklist?
Lists add addresses that sent spam, hit spam traps or acted as open proxies. Each list has its own removal process, and the holder has to fix the cause first.
Which addresses can’t be looked up?
Private and reserved addresses, such as 192.168.x.x or 10.x.x.x, and private or reserved AS numbers. They aren’t assigned to any one organisation in the public registries, so we refuse them.
Are lookups stored?
Recent lookups stay in your browser. A PDF report keeps a copy so anyone with its reference can verify it.