How to use it
- Type an IPv4 or IPv6 address in IP address, or press Look up my own IP.
- Press Check. Square brackets around an IPv6 address are removed for you.
- Read Organisation, Address range and Abuse contact.
- Press Copy as text to paste the facts into an abuse report, or Copy link to share the result.
Where the answer comes from
Five regional internet registries hand out address blocks: AFRINIC, APNIC, ARIN, LACNIC and RIPE NCC. IANA publishes bootstrap files that say which registry's RDAP server holds each block. The tool reads them, then asks that registry over RDAP, the structured JSON successor to WHOIS (RFC 9083). At the same time it asks Cloudflare's resolver for the reverse DNS name. When the site owner has switched it on, IPinfo adds the ASN and country, and the result credits it.
| Field | What it tells you |
|---|---|
| Network name | The registry's label for the block, with its handle (ID) underneath |
| Organisation | Who the block is registered to: an ISP, hosting company, university or business |
| Address range | First and last address of the block, and the same range in CIDR form |
| Country | Where the block is registered, not where a device is |
| Network (ASN) | The autonomous system number and its name, from IPinfo when enabled |
| Reverse DNS | The PTR name if the owner set one, otherwise No PTR record |
| Abuse contact | The e-mail address the registry lists for spam and attack reports |
| Registry | The registry named in the record's WHOIS server field, such as ARIN or RIPE |
| Registered | The date the block was registered |
The holder isn't the user
A lookup names the holder of a block, almost never a person. For a home connection that's the ISP; for a server it's often a cloud or hosting company. The country is where that organisation registered the block. A large network can use addresses from one block in several countries, so a geolocation site may show a different country for the same address. Both can be correct.
How reverse DNS names work
Reverse DNS turns an address back into a name. For an address such as 192.0.2.10, the PTR record lives at 10.2.0.192.in-addr.arpa: the four numbers reversed under in-addr.arpa. IPv6 uses every hex digit, reversed, under ip6.arpa. The owner of the block decides whether a name exists, so many addresses have none.
Reporting spam or an attack
- Copy the address under Abuse contact.
- Include the IP address, the exact time with its time zone, and the log lines or e-mail headers that show the problem.
- Expect a ticket number, not a name: the network operator, not you, matches an address and time to a customer.
- No abuse contact listed? Write to the organisation's general contact, or ask the registry shown under Registry.
Addresses the tool refuses
Private addresses (10.x.x.x, 172.16–31.x.x, 192.168.x.x), carrier-grade NAT addresses (100.64.0.0/10), loopback, link-local and the documentation ranges get the message that the address is inside a private network. No registry lists them as anyone's public block, and nothing about them can be checked from the internet.
Questions
- Can an IP lookup tell me who sent an e-mail or visited my site?
- It tells you the network: the ISP, company or hosting provider. Only that network's operator can link an address at a given time to one of its customers.
- Why does it say the registry didn't answer?
- Registries limit how many RDAP requests they accept. The tool then shows The registry didn't answer, so only part of the data is shown. Reverse DNS and the IPinfo fields still appear. Try again later.
- What is an ASN?
- An autonomous system number identifies one network that announces its own address blocks on the internet, such as an ISP or a cloud provider. One ASN usually covers many blocks.
- Does it work with IPv6?
- Yes. Type the address in any normal form, such as the example
2a00:1450:4001:80b::200e. The tool finds the registry from IANA's IPv6 bootstrap file. - Can it look up my own address?
- Press Look up my own IP, or open What is my IP for your IPv4 and IPv6 address with your provider and location.