ASN & IP lookup.
Who is behind an IP address. Reverse DNS, the autonomous system announcing it, the prefix it sits in, the country it is registered to, and the registry's own RDAP record for the block. Works for IPv4, IPv6 and hostnames.
Results for 2606:4700:4700::1111 JSON · text
2606:4700:4700::1111
Registry record ARIN via RDAP
Source: https://rdap.arin.net/registry/ip/2606:4700:4700::1111
About this tool
Three independent lookups run in parallel. Reverse DNS asks for the PTR record. Routing data (origin ASN, AS name, announced prefix, country and registry) comes from Team Cymru's DNS-based IP-to-ASN service, which reflects the live BGP table. The registry record is fetched over RDAP, the structured successor to WHOIS, and shows the network name, address range and the organisation and contacts on file at ARIN, RIPE, APNIC, LACNIC or AFRINIC. Hostnames are resolved first and the first address is used.
What is an ASN?
An autonomous system number identifies one network on the internet that runs its own routing policy: an ISP, a cloud provider, a large company, a university. Every public IP address is announced from some AS, and the AS is a far better answer to "who is this?" than the address alone. AS13335 is Cloudflare, AS15169 is Google, AS16509 is Amazon. The prefix is the block (such as 1.1.1.0/24) that the AS announces; the address you looked up is somewhere inside it.
What the lookup returns
| Field | Meaning |
|---|---|
| Reverse DNS | The PTR record for the address. Mail servers and many services expect it to match the forward name. |
| Origin AS | The autonomous system currently announcing the prefix in BGP, and its registered name. |
| Prefix | The announced route containing the address. Useful for allow-listing a whole provider range rather than one address. |
| Country and registry | The country the block is registered to and which regional registry holds it. Registration country, not geolocation. |
| RDAP record | The registry's network object: name, handle, exact range, type (allocated, assigned) and the organisation, abuse and technical contacts. |
About the country
Country here is the registration country of the block, not a street-level geolocation. It is accurate for "which network and country does this belong to" and deliberately does not guess at cities. Private, loopback and reserved addresses are identified but have no public data.
Uses
- Log forensics: work out which network suspicious traffic in your logs originates from, and whether it is a hosting provider, a residential ISP or a known scanner.
- Allow-listing: confirm a CDN or cloud range before adding it to a firewall, and get the whole prefix rather than one address.
- Abuse reports: the RDAP record gives the abuse contact for the block.
- Checking your own address: press My IP to see what your provider looks like from the outside.
Examples
- 1.1.1.1: Cloudflare, AS13335
- 8.8.8.8: Google, AS15169
- 2606:4700:4700::1111: an IPv6 address
- github.com: a hostname, resolved first
From the command line
curl "kirkdiamond.com/tools/ipinfo?q=1.1.1.1" or add &format=json. To look up the records a name points to rather than who owns an address, use the DNS lookup.
Every parameter, the JSON field names, rate limits and ready-made CI checks are in the API and curl reference.