IP Address & Internet Lookup Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

What an Internet lookup can tell you

An IP address lookup answers questions about registration and about datasets that describe a prefix. It does not visit the host, open a port, or identify a person. That limit is the point of this guide. The tools on this page query public sources, or explain a result you already have. They are not a scanner and they are not evidence by themselves.

Use documentation addresses when you are practising. 192.0.2.1, 198.51.100.1, and 203.0.113.1 are not production targets. A lookup of those ranges should look empty or special. If a playbook only works on a famous public address, it is not a playbook yet.

Write down why you looked. Capacity planning, abuse desk, and a firewall change are different uses of the same record. The abuse desk can care about the abuse contact. The firewall change should care about whether the prefix is stable enough to name in a rule. The capacity plan should care about the provider, not the city. One screenshot stuffed into all three tickets will be wrong in at least two of them.

Time matters. Prefixes move between providers, geolocation vendors correct cities, and cloud ranges are reassigned. A lookup you saved in January is a clue in June, not a citation. Put the timestamp in the ticket. If the decision is expensive, look again on the day you implement it.

Sources and the question each one actually answers

A RDAP lookup answers the current registration record for an IP network or a domain, in a structured form. It does not answer who sat at a keyboard, or whether the address is hostile. The mistake to keep out of the ticket is pasting the whole record into a block list because the name looked unfamiliar. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A legacy WHOIS lookup answers a text registration record that varies by registry. It does not answer a guaranteed machine-readable field, or a live probe of the host. The mistake to keep out of the ticket is parsing one registry's layout and assuming the next registry uses it. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A reverse DNS lookup answers the PTR name, if someone published one. It does not answer proof of the organisation, because the PTR can be missing, stale, or generic. The mistake to keep out of the ticket is trusting a PTR that says mail or dynamic as if it were an identity check. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A geolocation lookup answers a vendor's estimate of country and sometimes city, learned from registries, measurements, and corrections. It does not answer the GPS location of a laptop, or a courtroom-grade place. The mistake to keep out of the ticket is blocking a country because one address of interest mapped there yesterday. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A ASN lookup answers the autonomous system that originates the prefix in a routing database. It does not answer the path your packet will take, or the owner of every customer behind that AS. The mistake to keep out of the ticket is equating an AS number with a single building. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A prefix lookup answers the routed block that contains the address. It does not answer your internal subnet plan, which can be a longer prefix inside a larger announcement. The mistake to keep out of the ticket is writing the announced /16 into a host mask because that was the longest public object. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A allocation history lookup answers which RIR and which organisation received the block, when the database says so. It does not answer a complete list of tenants, cloud customers, or yesterday's VM. The mistake to keep out of the ticket is calling a cloud provider's whole range one application. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A bogon and documentation ranges lookup answers whether the address is private, documentation, or otherwise not a normal public target. It does not answer a substitute for your own anti-spoofing filters. The mistake to keep out of the ticket is being surprised that 192.0.2.1 has no useful city. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A hosting and ISP labels lookup answers a commercial classification that a dataset attached to the prefix. It does not answer proof that a human is absent, or that a VPN is in use. The mistake to keep out of the ticket is treating the word hosting as a verdict. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A anycast lookup answers a hint, sometimes, that the same address is announced in many places. It does not answer which site answered your packet. The mistake to keep out of the ticket is opening a ticket with a city that was only the anycast node's city. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A shared and translated addresses lookup answers little by itself. CGNAT and proxies hide many users behind one address. It does not answer a unique person. The mistake to keep out of the ticket is blocking a CGNAT address and taking a neighbourhood offline. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A your own logs lookup answers what your firewall, proxy, or server actually saw. It does not answer a public database's opinion. The mistake to keep out of the ticket is skipping the log because a lookup was faster. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A a domain RDAP record lookup answers registrar, nameservers, and dates the registry is willing to show. It does not answer the DNS records inside the zone, which you get from DNS itself. The mistake to keep out of the ticket is assuming a hidden WHOIS privacy contact is the operator of the website. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A a routing view lookup answers whether a prefix is visible to the collectors a tool asked. It does not answer a full map of every Internet path, or proof that your ISP accepts the prefix. The mistake to keep out of the ticket is declaring a prefix down worldwide because one looking-glass had no route. Treat the result as a statement from a database at the time you asked, not as a fact about a person and not as a fact about every packet. An address can be anycast, translated, or shared. The record may name a company headquarters, a registrar, or the organisation that announced the prefix. Quote the field you actually used, the time, and the tool. Then confirm anything that will become a firewall change against logs on a device you run. A country name is a poor allow-list. A single lookup during an incident is a poor permanent block. If the question is who on your network talked to the address, the evidence is on your firewall or your proxy, and this lookup only helps you describe the far end.

A worked question: who announces 203.0.113.10

203.0.113.0/24 is a documentation prefix, so a real lookup should refuse to tell you a customer story. Treat the following as the shape of the work, and substitute an address you are allowed to investigate. First ask which prefix contains the address and which AS originates it. You now know a routed block and an AS number. You do not yet know a person, a city, or a motive.

Second, read the registration for the org name and the abuse contact. That is who the registry believes is responsible for the block. It may be a cloud provider or an ISP with millions of customers. The contact is the right place for an abuse report about the block. It is the wrong place for a demand that they identify a user, and it is the wrong object to paste into a ten-year firewall rule.

Third, if a geolocation field offers a city, write it down as a vendor estimate. If your own firewall log shows the flow, write that separately. The log is what you saw. The lookup is how you describe the far network. Mixing the two sentences into one is how a report claims a person was in a city your log never measured.

Fourth, decide the action. A rate limit on your own service, a ticket to your ISP, or an abuse mail to the published contact are all actions that stay inside your authority. A port scan of the address to see what they are running is not part of a lookup, and it is not a step on this page. Stop when the registration question is answered.

How to file the result

Keep four lines: the address, the prefix, the AS or org name, and the time. Add the geolocation city only if you label it as a dataset estimate. Add your log line if the question started from your log. Leave out adjectives. Hostile, suspicious, and bad are conclusions, and a lookup did not earn them.

If you will name the prefix in a firewall, prefer the shortest rule that matches the risk you actually have. A single address you saw once is not a whole provider's /12. A provider's /12 is not a single customer. Review the rule on a timer. Lookups go stale, and stale blocks become outages.

The tools linked here run in the browser against public lookup services, or they explain a paste. They do not log into your firewall. Copy the fields you need into the ticket and have a second person read the action you propose.

Write the question you are allowed to answer: registration, prefix, or a description of your own log.
Look up the address and record the prefix, the organisation, and the time.
Label any city or country as a dataset estimate.
Confirm the part that touches your network in your own logs.
Choose an action you control: a rule on your gear, a mail to a published contact, or no action.
Put an expiry on any block you create from a lookup.

Mistakes that turn a lookup into folklore

Quoting a city as if you had observed the user there.

Blocking a shared or CGNAT address to stop one flow.

Saving a January screenshot and implementing it in June.

Parsing WHOIS text with a regular expression you tested on one registry.

Calling an AS a building, a company, and a person interchangeably.

Using 192.0.2.0/24 in the example and then being angry that the result looks reserved.

Port-scanning the target because the lookup felt incomplete.

Pasting a whole provider range into a deny rule because one address in it appeared in a log.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.