IP address lookup

Shows which network an IP address belongs to, its range, PTR record and abuse contact.

What this check shows

The data comes from the regional internet registry that allocated the address block: RIPE NCC for Europe and the Middle East, ARIN for North America, and APNIC, LACNIC and AFRINIC for the other regions. You see the range the address belongs to, the organisation holding it and the abuse contact that complaints are sent to.

Registry data describes the holder of the network, not the end customer. If the block belongs to a hosting company, the hosting company is what you see, not whoever rents that particular server.

Geographic location

The country code in a registry record says where the holder of the block is registered. It is not proof of where the hardware stands: a company registered in one country can announce its addresses from a rack in another. This tool does not pretend to know the city.

Frequently asked questions

How do I find out which server is behind an address?

Check the PTR record with the reverse DNS tool and read the HTTP headers. The registry record says nothing about it.

Where do I send a complaint about attacks from this address?

To the abuse address shown in the result. That is the mailbox the network holder published in the registry for exactly this purpose.

Why does this differ from a geolocation service?

A geolocation service estimates the location from measurements and from its own database, while this shows what the registry actually holds. When the two disagree, the registry record is the one the network holder is responsible for.

Why does the result cover a whole range instead of one address?

Registries hand out blocks, not single addresses, so the smallest published object is a range. A provider can document a smaller part of a block separately, and when it has, the more specific record is the one shown.