IP Info / ASN lookup: who owns this address, where it lives, what kind of host it is
Paste any IPv4 or IPv6 address and in one second you get the full background check on it: which network operator (ASN) announces it to the internet, which country and registry assigned it, what reverse DNS name it carries, what city the geo databases place it in, and whether it is a bogon, private, CGNAT, Tor exit node or a known datacenter.
This is what abuse desks, security teams, and curious developers do when an unknown IP shows up in their logs. You do not need to install whois, type ARIN queries by hand, or trust a single commercial geo provider: the tool combines Team Cymru's ASN service, the OS reverse DNS resolver, the public Tor exit list and a curated list of cloud / hosting ASNs to give you a clear, multi-signal verdict.
Use it the moment a strange IP shows up in your server logs, a comment-spam IP needs context, a customer complains "I am being blocked", or you just want to know whether a given IP is a regular home connection or an AWS EC2 instance.
How to use it
- Paste an IP address in any form: IPv4 like `8.8.8.8`, IPv6 like `2606:4700:4700::1111`. The field validates as you submit, no `http://`, no port, just the address.
- Click Lookup. The tool runs all checks in parallel: ASN lookup via Team Cymru DNS, reverse DNS via the OS resolver, geo via a public API, bogon / CGNAT / multicast checks via local bitmask matching, and Tor exit check against a cached daily list.
- Use the sample IP chips to try common test cases instantly: `8.8.8.8` (Google DNS, datacenter), `1.1.1.1` (Cloudflare), `192.168.1.1` (RFC1918 private), `100.64.0.1` (CGNAT).
- Read the flag badges at the top: family (v4 / v6), public vs bogon, datacenter, Tor. Red badges mean "do not treat this as a normal client IP".
- Identity card: shows the IP, family and reverse DNS (PTR). A reverse like `dns.google` is a strong hint the IP belongs to that organisation.
- ASN card: ASN number, registry name (ARIN, RIPE, APNIC...), allocated prefix and the network owner (CLOUDFLARENET, AMAZON-02, GOOGLE).
- Geo card: country, region, city, coordinates, timezone, ISP and organisation. Treat city-level data as a hint, not a fact, especially for cellular networks and VPN exits.
- Flag card: explicit verdicts for bogon / Tor / datacenter, plus the age of the Tor list cache so you know how fresh the answer is.
When this is useful
Six concrete situations where this tool replaces "I will just google the IP":
- Triage of suspicious traffic in server logs. A login from `45.61.x.x` looks weird. You paste it: the ASN is a known hosting provider, the reverse DNS is a generic VPS hostname, and the tool flags it datacenter. That single hit is enough to tighten your rate limits or trigger MFA.
- Tor exit detection for fraud / abuse policies. Someone abused your free tier from `185.220.x.x`. You paste the IP, the tool returns tor: yes with a Tor list refreshed within the last 24h. You add a policy "block signups from Tor exits, allow login through them" and you are done.
- Customer complains they cannot reach you. They send their IP. You see CGNAT, ASN is a mobile carrier, country matches what they say. Their issue is likely on their NAT (port range), not your service.
- Investigating spam comments / form abuse. The IP shows up as datacenter (DigitalOcean) in São Paulo, the reverse DNS is a generic droplet name. That tells you to block the entire subnet on the front edge instead of playing whack-a-mole.
- Verifying a "private IP" before reporting it. You see `100.64.5.10` in a bug report. The tool flags it CGNAT (not a real public IP) and you ask the user to share their public IP from another site.
- Sanity-checking a network change. You changed the upstream provider on a server. After the cutover you paste your server's IP into the tool. The ASN should now be the new provider. If it still shows the old ASN you know route advertisement has not finished propagating.