IP
—
—
Registered country —
—
Technical details
- Reverse DNS (rDNS)
- —
- Block name
- —
- Registered block
- —
- Announced prefix
- —
- /64 prefix
- —
- IPv4-mapped address
- —
- NAT64 address
- —
- 6to4 prefix
- —
—
Where data goes
your own address is read by our server from this connection and not stored. A lookup sends the address to the regional registry that holds it (APNIC, ARIN, RIPE NCC, LACNIC or AFRINIC) and to RIPEstat, run by RIPE NCC. The UDP check sends one request to stun.cloudflare.com. The list check runs in your browser. Domain names and reverse DNS are looked up through Cloudflare DNS (cloudflare-dns.com).
What this tool shows
When the page opens it looks up your own public address: our server reads it from this page load, and the page measures it again with a UDP STUN request to stun.cloudflare.com. On a dual-stack network browsers prefer IPv6 for websites (Happy Eyeballs, RFC 8305), so the two readings are often one IPv6 and one IPv4 address. Both are listed under the Look up button; click either to look it up. An allowlist usually needs both; for IPv6, use the /64 prefix from Technical details.
Enter any IPv4 or IPv6 address or a domain. The result shows the address type, the owner and registered country, and the autonomous system that announces it in BGP. Technical details add reverse DNS (rDNS), the registered block, the BGP prefix and, for an IPv4 address, its three IPv6 forms. The address is also checked against Tor exit nodes and the published ranges of AWS, Google Cloud, Oracle Cloud, DigitalOcean and Cloudflare.
How to use it
Paste into the box and press Enter, or paste anywhere on the page. Forms copied from logs are understood: 203.0.113.7:443, [2001:db8::1]:8443, fe80::1%eth0, ::ffff:198.51.100.4, and an IPv4-mapped address is looked up as the IPv4 inside it. Paste a whole block of log text and every address in it is listed under the button, with private addresses, Tor exits and cloud ranges marked. A domain is first resolved to its A and AAAA records, and the result has a link to DNS Lookup. A link ending in ?ip= opens straight to the result for that address.
Things that trip people up
The country in a registry record is where the block was registered, which can be far from where the device is. ARIN records have no country field at all, so addresses in the United States and Canada show an empty country here. The country in the top panel comes from an IP database, and the page shows no province or city. Cloudflare's published ranges cover its proxy network; 1.1.1.1, its public DNS resolver, is outside them, so an address missing from every list can still belong to one of these companies. Tor exit relays change every hour, which is why each list carries its date. For IPv6 allowlists use the /64 prefix shown in the results: temporary addresses (RFC 8981) replace their last 64 bits about once a day, while the prefix stays the same.
Background: registries, WHOIS and RDAP
Five regional internet registries hand out address space: ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia and the Pacific, LACNIC for Latin America and AFRINIC for Africa. For decades the owner of an address was looked up with WHOIS on TCP port 43 (RFC 3912), which returns free text in a different layout at each registry. RDAP, published as RFCs 7480 to 7485 in March 2015, returns JSON over HTTPS and is what this page queries. The 100.64.0.0/10 block was set aside for carrier-grade NAT by RFC 6598 in April 2012, a year after IANA handed its last free /8 blocks to the registries in February 2011. The private ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 date from RFC 1918, published in February 1996.
Where it is used
Server admins use it to fill in allowlists for SSH, admin panels and database firewalls, and to confirm which address a server uses for outbound calls before registering it with a payment or SMS provider. Support staff paste an address from a log line to see whether it belongs to a cloud provider, a Tor exit or a home ISP. People setting up a NAS, a game server or a self-hosted chat server paste the router's WAN address: when its type shows a carrier-grade NAT shared address or a private address, connections from the internet cannot reach that router. Log lines usually pair an address with a time, and Unix Timestamp Converter turns the epoch number next to it into a readable date.
Frequently asked questions
Why is the IP on my router different from the one shown here?
Your router's WAN address is a private or 100.64.x.x address when your ISP or modem adds another layer of NAT. Paste it into the search box and the address type says which one it is.
Which address should I add to an allowlist?
The one the service will see. When your network and the service both have IPv6, requests usually arrive over IPv6, so add your /64 prefix, because the last part of an IPv6 address changes. Add the IPv4 address too.
Where does this page send the address I look up?
To the regional registry that holds it (APNIC, ARIN, RIPE NCC, LACNIC or AFRINIC) and to RIPEstat, run by RIPE NCC. The list check runs in your browser. Your own address is read by our server from the connection and is not stored.
Why does the page say no IPv4 or IPv6 address was found?
The page measures twice: over the web connection and with a STUN request on UDP port 3478. A version is missing when the network has none, or when UDP is blocked and the web connection used the other version. Corporate networks and some VPNs block outbound UDP, and voice or video calls on such a network need a TURN relay over TCP or TLS.
Can this tell me whether an IP is dangerous?
It shows facts you can act on: whether the address is a Tor exit, whether it sits in a cloud provider's range, and which organization the block is registered to. It does not assign a risk score.
More Network Tools
2 tools →
DNS LookupLook up every DNS record, mail setup and expiry date of a domain
JSON FormatterFormat, validate and minify, with exact error position
Password GeneratorGenerate random passwords; length, symbols, digits, entropy
Unix Timestamp ConverterConvert epoch seconds or milliseconds to dates and back
Base64 Encode / DecodeEncode text or files to Base64 and back; UTF-8, URL-safe
Simplified ⇄ Traditional ChineseConvert Simplified to Traditional (Taiwan, HK) and back
