An unknown address shows up in a firewall log, an SSH brute-force report, a mail header or a billing dispute, and the first question is always the same: whose is it? The answer has two parts that people often mix up. The registry says which organization holds the address block. BGP routing says which network actually carries traffic for it. Add reverse DNS and an approximate location and you usually know enough to decide whether to block, report or ignore it.
IP Lookup shows all of these for any public IPv4 or IPv6 address in one report, with each source shown separately so one slow source does not hide the rest.
What is an IP lookup?
In simple terms
An IP lookup asks the public internet registries "who was given this address?" and asks the routing system "which network announces it right now?". The registries keep records of every allocated block of addresses, including an organization name and an abuse mailbox. The routing system knows which network number (ASN) advertises the block. Together they identify the provider, hosting company, cloud platform or enterprise behind an address.
Technical background
IANA allocates large blocks to five Regional Internet Registries: ARIN (North America), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America and Caribbean) and AFRINIC (Africa). They sub-allocate to providers, which may register further assignments to customers. The authoritative data is published over the Registration Data Access Protocol (RDAP, RFC 9082 for queries, RFC 9083 for JSON responses). Clients find the right server through the IANA bootstrap registry (RFC 9224), which maps address ranges to RDAP base URLs.
An RDAP IP network object contains the start and end address, often a list of CIDR blocks (the cidr0 extension), a handle, name, type (for example an allocation or assignment), country, events such as registration and last change, and entities with roles like registrant and abuse.
Routing is separate. Networks announce prefixes in BGP from their Autonomous System. Team Cymru publishes the origin AS for any announced prefix over DNS: a TXT query for the reversed address under origin.asn.cymru.com (or the nibble-reversed IPv6 address under origin6.asn.cymru.com) returns the origin ASN, prefix, country, registry and allocation date. Reverse DNS is a PTR lookup in in-addr.arpa or ip6.arpa, controlled by whoever has delegated reverse authority for the block.
Why use IP Lookup?
- Abuse handling. Find the abuse mailbox for a scanning, spamming or attacking address instead of guessing.
- Firewall decisions. See whether an address belongs to a cloud provider, a residential ISP or a known service before writing a block or allow rule, and get the CIDR range.
- Incident triage. Quickly tell whether traffic comes from your CDN, monitoring provider or partner, or from somewhere unexpected.
- Mail troubleshooting. Check the owner and PTR of a sending server that fails reverse DNS checks.
- Understanding leased or re-routed space. A mismatch between holder and announcing network is visible at a glance.
Who should use it?
- Security analysts and SOC teams triaging alerts and writing abuse reports.
- System and network administrators reviewing firewall, VPN and web server logs.
- Email administrators investigating senders and their reverse DNS.
- Hosting and ISP support staff identifying customer ranges.
- Developers who need to know whether a client address belongs to a cloud or proxy network.
How IP Lookup works
The address is first validated in your browser. Anything that is not a globally routable unicast address is rejected with an explanation of its special-use range (private RFC 1918, carrier-grade NAT, loopback, link-local, documentation, benchmarking, multicast, reserved, IPv6 unique-local, transition prefixes and so on). Public addresses are sent to the NetTools.tech API, which runs three lookups in parallel:
- RDAP. The server picks the responsible registry from the IANA bootstrap data and fetches its RDAP record over HTTPS. It extracts the holder organization (registrant entities of kind
orgor non-individual), network name, handle, type, range, up to 20 CIDR blocks (or computes them from the start and end address when the record has none), country, registration and update dates and the abuse role contact. Names of individual persons are not shown. - Team Cymru. TXT queries for the origin record and the AS name through the public resolvers 1.1.1.1 and 8.8.8.8 return up to five origin ASNs, the announced prefix and the AS organization. An address with no origin record is reported as not announced in global BGP routing.
- Reverse DNS. A PTR query through the same resolvers returns up to 20 hostnames.
The server then matches the address against a local copy of the DB-IP "IP to City Lite" database for an approximate location (see the IP Geolocation guide). Each section is returned as "ok" or "unavailable" with its own error message. The operation has a 20-second server limit; the page gives up after 25 seconds. Requests are rate limited per client, and RDAP registries can rate-limit the server too.
Command-line equivalents for comparison:
curl -s https://rdap.arin.net/registry/ip/8.8.8.8 | jq '.name, .handle, .startAddress, .endAddress'
dig +short TXT 8.8.8.8.origin.asn.cymru.com
dig -x 8.8.8.8 +shortHow to use the NetTools.tech IP Lookup
- Open IP Lookup.
- Enter an address in the IP address field, for example
8.8.8.8or2606:4700:4700::1111, and press Look up. Or press Use my IP to look up your own connection, or click one of the Try chips. - The page updates its address to
/ip-lookup?ip=…, so you can bookmark or share a specific lookup. - Read the overview, then the cards: network owner, routing, location, abuse contact, reverse DNS.
- Use the Copy buttons for the handle, CIDR, announced prefix, coordinates, abuse email or hostname.
- Follow the ASN link to ASN Lookup, or the links under Reputation & related checks to open MultiRBL Check and Open Resolver Check with the address prefilled (those tools do not run until you start them).
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| IP and IPv4/IPv6 badge | The normalized address that was looked up | IPv6 is shown in compressed form |
| Regional Internet Registry | RIR whose RDAP server answered, with full name and region | Tells you whose policies and records apply |
| Organization | Holder of the block from the registry | "Not published" means no organization entity was found |
| Network name, Handle, Type | Registry identifiers and allocation type | The handle is what to quote to the registry or provider |
| Range / CIDR blocks | Registered block containing the address | The registered block may be much larger than the routed prefix |
| Registered / Updated | Registry event dates | Recent updates often mean transfers or re-assignments |
| ASN / Origin ASNs | Network(s) announcing the address in BGP, linked to ASN Lookup | Multiple origins can indicate anycast or a multi-homed customer |
| AS organization | Name of the announcing AS | A note appears if it differs from the registered holder |
| Announced prefix | The BGP prefix covering the address | Use this, not the registry range, for routing-level filters |
| Location | Approximate city, region, country, coordinates and continent (DB-IP Lite) | An anycast note appears for well-known anycast networks |
| Registration country / Routing data country | Country in the RDAP record, and the Team Cymru country if different | Never a physical location |
| Abuse contact | Role name and email for abuse reports | "No abuse contact published" means use the provider's general channels |
| Reverse DNS | PTR hostname(s), or "No PTR record" | Generic names suggest residential pools; descriptive names suggest servers |
| Looked up | Timestamp of the result | Data can change; repeat for evidence in reports |
Example: investigating an SSH brute-force source
Illustrative result for a documentation address (real lookups show live registry data):
198.51.100.77 IPv4
Regional Internet Registry: ARIN · North America
Network owner (registry)
Organization: Example Hosting Inc.
Network name: EXAMPLE-HOSTING-4
Handle: NET-198-51-100-0-1
Range: 198.51.100.0 – 198.51.100.255
CIDR: 198.51.100.0/24
Routing (BGP)
ASN: AS64500
AS organization: EXAMPLE-TRANSIT
Announced prefix: 198.51.100.0/24
Note: The announcing network differs from the registered holder.
Abuse contact
Contact: Abuse Desk
Email: [email protected]
Reverse DNS
Hostname: vps-77.example.netInterpretation: a VPS at a hosting company, routed by its upstream. Report to the abuse address with timestamps and log lines, and block the single address (or the announced prefix if abuse continues) rather than the holder's entire registered space.
Common use cases
- Writing an abuse report with the correct contact and network handle.
- Deciding whether a block of failed logins comes from a cloud region, a residential ISP or a VPN service.
- Checking that a new mail server's address has the intended PTR record.
- Confirming that a partner's traffic originates from the ASN and prefix they announced.
- Feeding the announced prefix into a temporary firewall or WAF rule.
Troubleshooting
"Cannot look up this address" or a special-use message
The address is private, reserved or otherwise not publicly routed. Internal addresses have no registry owner; look them up in your own IPAM or DHCP logs instead.
The registry card says unavailable
The RDAP server did not answer, returned an error, or rate-limited the request. The routing and reverse DNS cards are still valid. Retry later or use the WHOIS tool for related domain data.
"Not announced in global BGP routing"
Team Cymru has no origin for the address. The block may be allocated but unused, recently withdrawn, or only reachable inside a private network. Traffic claiming to come from it may be spoofed.
The owner is a large cloud or CDN
Cloud addresses are reassigned to customers constantly and the registry rarely names the tenant. Report through the provider's abuse channel; they can map the address and timestamp to a customer.
No PTR record
Many operators do not configure reverse DNS for every address. For mail servers, missing PTR records cause delivery problems and should be fixed with the provider who controls the reverse zone.
Common mistakes
- Blocking the entire registered range of a large provider because of one abusive address.
- Treating the registration country as the source location of traffic.
- Assuming the AS organization is the owner of the address, or vice versa.
- Contacting individuals or technical contacts found elsewhere instead of the published abuse role.
- Forgetting that a source address in logs may be a NAT gateway, proxy or CDN edge rather than the actual client.
Limitations
- Registry data is only as good as what holders register; small assignments are often not registered separately, and the record may describe a parent allocation.
- Cloud, VPN and CGNAT addresses are shared or frequently reassigned; the lookup cannot name the end user.
- Routing data shows the origin AS seen in global BGP, not the full path or regional differences.
- Geolocation is approximate and can be wrong, especially for mobile, VPN, cloud and anycast networks.
- Lookups reflect the moment of the query; historical ownership or routing is not shown.
Security & privacy
The address you enter is sent to the NetTools server, which queries IANA-listed RDAP servers over HTTPS and the public resolvers 1.1.1.1 and 8.8.8.8 (including Team Cymru's DNS zones). Those services see the NetTools server, not you. The geolocation database is local. Only organizations and role mailboxes are displayed from registry records. The server keeps a short tool log (tool, target, your IP shortened to /24 or /48) for 30 days, as described in the privacy policy; results are not stored. Do not use lookups to compile information about private individuals; registry data is meant for network operations and abuse handling.
Related tools
- ASN Lookup – details of the announcing network. Guide: ASN Lookup guide.
- IP Geolocation – the location view of the same report. Guide: IP Geolocation guide.
- Reverse DNS – PTR records on their own. Guide: Reverse DNS guide.
- MultiRBL Check – is the address on DNS blocklists? Guide: MultiRBL guide.
- WHOIS Lookup – domain registration records. Guide: WHOIS guide.
- My IP – the same report for your own connection. Guide: What is my IP.
- Overview: IP & Network Utilities.
Summary
IP Lookup combines the registry record (RDAP), the BGP origin (Team Cymru), reverse DNS and an approximate DB-IP location for any public IPv4 or IPv6 address. Read the holder and the announcing network as two different facts, use the abuse contact and the announced prefix for reports and filters, and treat country and city as context rather than location proof.
Frequently asked questions
How do I find out who owns an IP address?
The holder of an address block is recorded by one of the five regional internet registries and published over RDAP, the successor of WHOIS. IP Lookup finds the responsible registry through the IANA bootstrap registry and shows the holder organization, network name, range and abuse contact from that record.
Why do the network owner and the AS organization differ?
The registry records who holds the address block, while BGP shows which network announces it. Providers often route space held by their customers, and blocks are leased or sold, so the two names can legitimately be different organizations.
Is the country shown where the IP is located?
No. The registration country is where the block is registered, which can be far from where the address is used. The separate approximate location comes from the DB-IP Lite geolocation database and is itself only an estimate.
How do I report abuse coming from an IP address?
Use the abuse contact from the registry record, which IP Lookup shows with a copy button. Include exact timestamps with time zone, the destination you saw traffic on, and relevant log excerpts, and contact only the published role address.
Why can't I look up 192.168.1.1 or 10.0.0.1?
Those are private addresses from RFC 1918 that are not routed on the internet, so no registry assigns them to an owner. The tool explains which special-use range an address belongs to instead of returning a misleading result.
What is the difference between IP Lookup and WHOIS?
WHOIS is the older plain-text protocol; RDAP returns structured JSON over HTTPS from the same registries. IP Lookup uses RDAP for addresses and adds BGP origin data, reverse DNS and geolocation in one view, while the WHOIS tool is meant for domain registration records.
Does IP Lookup support IPv6?
Yes. IPv6 addresses are accepted in any valid notation and shown in compressed form; registry, routing (via Team Cymru's origin6 zone), reverse DNS and geolocation work the same way as for IPv4.