IP Intelligence
Look up an IP address's network, ASN, reverse DNS, registry allocation and abuse contact, or show your own.
Related tools
- Blacklist CheckerCheck whether an IP address or a domain's mail server is listed on DNS blocklists.
- DNS LookupLook up DNS records by type, including reverse (PTR) lookups for IP addresses.
- Ping & TraceroutePing a public host for loss and latency, or trace the route to it hop by hop.
- Port ScannerCheck which TCP ports on a public host accept connections, and read what each open port means on that host and what to do about it.
About this tool
IP Intelligence describes one address. From the address itself it derives the version, the compressed form, the reverse pointer name and the scope - public, private, loopback, link-local or reserved - then asks public DNS for the PTR record and, for a globally routable address, looks up the network and location: ASN, organisation, ISP, country, region, city and time zone. Enter a hostname instead and XGM resolves it first and describes its first public address, listing up to eight resolved addresses. The location is an estimate at city level at best, and the tool identifies a network, not a person, a household or a street address. It does not connect to the address, does not test whether anything is listening there and does not query blocklists.
The address or hostname you enter is sent to the XGM API. The XGM server resolves the name if needed, asks public DNS for the PTR record, and for a globally routable address requests https://ipwho.is/<address> - so ipwho.is, the geolocation provider, sees the address you looked up and nothing else about you. The same address is also sent to the regional internet registry that allocated it (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC) over RDAP, to read the prefix, the allocation date and the abuse contact; the registry server is found through the IANA RDAP bootstrap list. “Show my IP” sends your own address into those lookups only when you press the button. The map is loaded only when you press “Show map”, and its tiles are fetched by the XGM server from CARTO's basemap CDN and passed through the XGM API, so your browser never contacts the tile provider. Nothing is sent to the address itself: no port is opened, no packet is directed at it, and the address you looked up is not stored with the result.
How to use it
- Open the IP Intelligence tool.
- Enter the public domain, hostname or IP address you want to check.
- Run the check; XGM queries it from its server and lists the findings.
- Copy the output only after checking it looks correct.
- Use related XGM tools if you need a broader diagnostic view.
FAQ
How accurate is the location?
City level at best, and often much coarser. Geolocation databases map an address range to wherever the operator registered or announces it, so a mobile network, a VPN exit, a satellite link or a large ISP pool can be placed hundreds of kilometres from the actual user, frequently at the country centroid. Use it as network context, never as evidence of where a person is.
Why does the reverse DNS name disagree with the organisation and ASN?
They come from two different sources. The PTR record is published by whoever controls the reverse zone for that address block and is often left over from an earlier customer or template, while the ASN, organisation and ISP fields describe the network that currently announces the prefix. After a lease change or an address transfer the two can disagree for a long time; the ASN is the more reliable of the pair.
I entered a hostname - which address did I get?
XGM resolves the name from its server and describes the first public address it received; the other resolved addresses are listed above the result. For anycast networks and CDNs that answer is the one closest to the XGM server, which is normally not the one your own resolver would give you. Look up a specific address directly if you need the node that serves you.
Why is there no location for this address?
Private, loopback, link-local and other non-global addresses (RFC 1918, RFC 4193 and the reserved ranges) are never sent to the geolocation provider, so the result shows scope only. A global address can also come back without data when the provider has no entry for the range, which is still common for IPv6 and for recently allocated blocks.
Can I find out who was behind an address at a given time?
Not from here. This result shows the network that holds the address today - the operator, not the subscriber - and address assignments inside a provider change constantly through DHCP, CGNAT and pooling. Only the operator holds the mapping from address and timestamp to a customer, and it is released to law enforcement under legal process, not to a lookup tool.
Read the full IP Intelligence guide