Who is behind this IP address?

From a login alert, firewall log or email header. We show the owner network, reverse DNS and matches on open threat lists.

How the ip address checker works

  1. Paste the address

    IPv4 or IPv6. Private addresses such as 192.168.x.x are explained rather than looked up.

  2. Ownership and reverse DNS

    RDAP tells us which organisation holds the range; DNS tells us the address's name.

  3. Open threat lists

    abuse.ch Feodo Tracker (botnet command servers), Spamhaus DROP (hijacked and criminal networks), the Tor exit list and, where enabled, AbuseIPDB reports.

Questions people ask

An unknown IP logged into my account. Is it an attacker?

Check the owner and country here, then compare with where and when you were online. A login from a data-centre address in another country while you were asleep is a strong signal to change the password and enable MFA.

The address is not on any list. Is it safe?

Lists lag behind. Use the result with the context — what the address did and when.

Built and maintained by the Arventiq Labs team in Bengaluru. Free for anyone, source on GitHub (MIT). Results are indications, not verdicts. Something wrong? Tell us.