How It Works

The tool performs two complementary lookups. First, it queries regional Internet registry (RIR) databases using RDAP (Registration Data Access Protocol). RDAP is the modern replacement for legacy WHOIS and provides structured JSON with consistent fields. Second, it queries a routing data source to estimate how the address or prefix is propagated via BGP (Border Gateway Protocol), including likely origin ASNs and related prefixes.

Step-by-step flow

• 1) Input detection: The tool detects whether you entered an IPv4/IPv6 address, a CIDR prefix, or an ASN (for example, AS15169).
• 2) RDAP registration query: For IPs/prefixes it attempts RDAP IP endpoints across the major RIRs until it finds the authoritative response. For ASNs it uses RDAP autnum endpoints.
• 3) Routing query: For IPs and prefixes it queries a BGP routing API to retrieve covering prefixes and origin ASNs. For ASNs it retrieves announced prefixes and basic AS metadata.
• 4) Normalization: The tool extracts and formats the most useful fields into a readable report (allocation range, name/handle, org, country, status, and timestamps when available).
• 5) Presentation: Results are displayed as structured sections you can copy to clipboard or download as a text report.

Because Internet registry and routing data can change, treat the output as a snapshot at the time you run the lookup. If you need auditability, use the download option to attach the report to your case notes.

Key Features

Unified WHOIS + routing view

See ownership (registration/allocation) and routing (BGP) signals side-by-side. This is especially helpful when the organization that holds an allocation is different from the network currently announcing a prefix.

Supports IPv4, IPv6, CIDR, and ASN

Paste a single IP address (like 8.8.8.8), an IPv6 address, a CIDR prefix (like 203.0.113.0/24), or an ASN (like AS13335). The tool automatically adjusts the lookup strategy and the report layout.

Readable, ticket-friendly output

Instead of dumping raw JSON or unstructured WHOIS text, the tool produces a concise report with labeled fields and a routing summary. You can copy it into abuse reports, security investigations, customer support cases, or internal documentation.

Optional deeper details

Enable the “Include extra RDAP details” option to surface additional RDAP fields such as status values, events, and published contact references when registries provide them.

Downloadable report

Generate a plain-text report file for record keeping. This is ideal for compliance workflows, incident response notes, or attaching evidence to a support ticket.

Use Cases

• Network troubleshooting: Confirm which ASN and prefix an IP belongs to when diagnosing routing anomalies or unexpected latency.
• Abuse handling: Identify the responsible party for spam, scans, or attacks, then use the report to route a complaint to the correct organization.
• Vendor verification: Validate a third-party service’s IP space and compare allocation data with observed routing announcements.
• Security investigations: Correlate suspicious IPs with known ASNs, prefixes, and organizations to enrich alerts and incident timelines.
• Peering and BGP operations: Quickly pull origin ASN hints and prefix coverage before escalating to deeper routing analysis tools.
• Documentation and audits: Produce a consistent, time-stamped snapshot of registry and routing info for reports and internal reviews.

Whether you are an SRE, NOC engineer, SOC analyst, or a support agent, having both registry and routing context in one place reduces guesswork and speeds up resolution.

Optimization Tips

Use CIDR for infrastructure blocks

If you are investigating multiple IPs from the same subnet, paste the CIDR prefix instead of individual addresses. You will get the allocation boundary and routing view for the whole block, which is often more actionable.

Compare registry ownership vs routing origin

It is common for one company to hold an allocation while another ASN announces it (for example, hosting, DDoS protection, or IP leasing). If these do not match your expectations, investigate the business relationship or check for misconfigurations.

Validate IP format before lookup

For best results, paste clean values without ports or URLs. If you have a log line like 203.0.113.10:443, extract just the IP portion. The tool focuses on IP/prefix/ASN inputs to reduce ambiguity.

FAQ