How an IP lookup works
An IP lookup answers a simple question: which network announces this address block, and what is publicly registered about it? The address itself carries no personal file. Everything shown comes from public routing data, allocation registries and the address owner's own reverse DNS records.
This page parses the address locally in your browser. To show the network, the browser then downloads only the small static shard of the public ASN dataset that covers that address range. Our server can therefore see which broad range is being queried, but not the full address, and these requests are not written to the access log. The reverse DNS query is sent by your browser directly to Cloudflare's DNS-over-HTTPS resolver at cloudflare-dns.com and carries the reverse name of the address being looked up. The address can be placed in the address fragment so you can share or bookmark the result, and that fragment stays in your browser.
What is an ASN?
An Autonomous System Number identifies a network that exchanges routing information with the rest of the internet. Providers, hosting companies, universities and large organizations each have one. The number is written with the prefix AS, for example AS13335.
When a lookup shows an ASN, an organization name and a country, it is telling you which network owns or announces the address block. That is useful context: addresses from hosting providers often belong to datacenters, while addresses from access networks belong to homes, offices and mobile subscribers. The same ASN can hold thousands of address ranges, so the organization name describes the network, not an individual customer.
Reverse DNS
Normal DNS turns a name into an address. Reverse DNS does the opposite: it asks which name, if any, the owner has published for an address. The record used is called a PTR record, and the lookup is made under the special zones in-addr.arpa for IPv4 and ip6.arpa for IPv6.
Many addresses have no reverse name at all, and that is not an error. Consumer connections often publish nothing or something generic built from the provider's naming scheme, such as a city code or a service identifier. A reverse name usually tells you about the hosting or access network; it rarely identifies a person.
Special and private ranges
Not every address is a globally routed one. The lookup recognises reserved blocks and explains them instead of querying public sources, because those addresses cannot appear on the open internet:
- Private networks: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are used inside homes and offices behind NAT.
- Loopback: 127.0.0.0/8 and ::1 always refer to the local machine.
- Link-local: 169.254.0.0/16 and fe80::/10 are valid only on a single network segment and are assigned automatically.
- CGNAT: 100.64.0.0/10 is shared between customers by an internet provider.
- Documentation: 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 and 2001:db8::/32 are reserved for examples, so they never belong to a real host.
- Unique local IPv6: fc00::/7 is the IPv6 equivalent of a private range.
- Multicast and reserved: 224.0.0.0/4, 240.0.0.0/4 and ff00::/8 serve special purposes and are not ordinary unicast addresses.
If you paste an address from these ranges, you will still get the format conversions and the scope classification, but there is no public network to look up.
How accurate is an IP lookup?
Different parts of a result have very different reliability. The address family, the address range and the announcing network are precise, because they come from routing data. Country-level location is usually right. City-level location is an estimate and is often the provider's regional hub rather than the visitor's actual position.
Reverse DNS depends entirely on the network operator: some publish meaningful names, many publish nothing. Treat every lookup as a set of hints about infrastructure, not as proof of who or where someone is. A VPN, proxy or mobile network can make the published location differ completely from the physical one.
Frequently asked questions
Can I look up a private address such as 192.168.1.1?
Yes, but there is nothing public to find. Private, loopback, link-local and CGNAT addresses are not routed on the internet, so the lookup reports the range they belong to and gives you the format conversions instead of querying public sources.
Why does the lookup show an organization instead of a person?
Public IP addresses are allocated to organizations, not to individuals. The organization name is the network that announces the address block. It does not identify the subscriber, the household or the device behind that address.
What do the decimal, hexadecimal and binary forms mean?
They are the same address written in different bases. A 32-bit IPv4 address such as 203.0.113.42 can also be written as a single decimal number, as hexadecimal, or as 32 binary digits. Hexadecimal is common in firewall and router interfaces, and decimal appears in some log formats. IPv6 uses 128 bits and is usually shown in hexadecimal.
Why is there no reverse DNS name for my IP?
Publishing a PTR record is optional. Many access providers do not publish one, or publish only a generic name. A missing reverse name does not mean the address is suspicious, and it does not stop other lookups from returning the network information.
How exact is the location from an IP lookup?
Country-level results are usually accurate. Region and city results are approximate estimates, because the address blocks are assigned to a provider rather than to a street. Mobile users, VPN users and CGNAT customers can appear in a completely different place from where they are.
Do you store the addresses I look up?
No. The address is parsed and classified in your browser. The ASN data is fetched as a static shard that covers only the address range being queried, so our server sees the broad range and not the full address, and those requests are not written to the access log. The reverse DNS request is sent by your browser straight to Cloudflare's DNS-over-HTTPS resolver and contains the reverse name of the address. If the address ends up in the address fragment, it stays in your browser and you can remove it by clearing the address bar.