Skip to content

IP Intelligence guide

Tool guide. Updated .

What XGM IP Intelligence shows for an IP address or hostname: scope, reverse DNS, ASN, organisation and approximate location, and how reliable each is.

What an IP lookup can tell you

An IP address identifies a network interface, not a person or a building. Registries record which organisation holds each address block, networks announce the blocks they route with an autonomous system number (ASN), and commercial databases map address ranges to approximate locations. An IP lookup combines those sources into one view.

That makes it useful for questions such as "which provider sends this mail?", "is this address a data centre or a home connection?" or "which country is this traffic coming from?". It is not useful for finding where a specific person is, and the data can be wrong or outdated for any given address.

Where the parts of an IP lookup come fromThe address itself gives version and scope, reverse DNS gives a host name, routing data gives the ASN and organisation, and a geolocation database gives an approximate location.The addressIPv4 or IPv6, public or private scope, decimalformReverse DNS (PTR)Host name published by the address holder, ifanyNetwork dataASN and organisation or ISP announcing theaddressGeolocation databaseCountry, region, city and time zone estimate(ipwho.is)
The address itself gives version and scope, reverse DNS gives a host name, routing data gives the ASN and organisation, and a geolocation database gives an approximate location.

How to use IP Intelligence

  1. Open IP Intelligence and enter an IPv4 or IPv6 address, such as 8.8.8.8 or 2001:db8::1.
  2. Or press "Show my IP" to look up the address your browser connects from. This request is only sent when you press the button.
  3. Read the summary line with location and network, then the table of details.
  4. Press "Show map" if you want the approximate location on a map; map files load only at that moment.
  5. Continue with Run next for reverse DNS, ASN, reputation or blocklist checks on the same address.

Privacy of lookups

The address you look up is sent to the XGM server, which asks ipwho.is for location and network data. Private and reserved addresses are not sent to the geolocation provider at all.

Hostnames and ASN lookups

IP Intelligence also accepts a hostname such as github.com. The XGM server resolves it, refuses names that point to private or internal addresses, and describes the first public address; the result shows which addresses the name resolved to. This replaces the separate ASN Lookup tool: the autonomous system number, its organisation and the ISP are part of every result.

An ASN identifies the network that announces an address range on the internet. It tells you who operates the network, not who uses a particular address: a cloud provider's ASN covers thousands of unrelated customers.

The fields in the result

IP Lookup details
FieldMeaningReliability
VersionIPv4 or IPv6Exact
Reverse DNS (PTR)Host name published for the addressExact, but set by the address holder and can be generic or missing
ScopePublic, private, loopback or reservedExact, from the address ranges
DecimalIPv4 address as a single numberExact
ASN and organisationThe network that announces the addressGood; reflects routing data
ISPThe provider name in the databaseGood for large providers, less so for resellers
Country, region, cityEstimated locationCountry usually right; city often approximate or wrong
Time zoneTime zone of the estimated locationAs reliable as the location

Reverse DNS names often reveal the kind of address. A name like mail.example.com suggests a mail server configured by its owner, while 192-0-2-80.dynamic.isp.example.net points to a home or dynamic connection. Many mail filters treat generic dynamic names with suspicion for exactly that reason.

Mobile networks, VPNs, corporate proxies and cloud providers all break the connection between address and physical location. A phone on a mobile network may appear hundreds of kilometres away, and a VPN user appears where the VPN server is. Treat city-level results as a hint only.

Public, private and special addresses

Address ranges you will meet
RangeScopeSeen where
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16Private (RFC 1918)Home and office networks, cloud VPCs
100.64.0.0/10Shared address space (RFC 6598)Carrier-grade NAT at internet providers
127.0.0.0/8, ::1LoopbackThe local machine itself
169.254.0.0/16, fe80::/10Link-localAutomatic addressing without DHCP; cloud metadata services
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 2001:db8::/32Documentation (RFC 5737, RFC 3849)Examples in documentation; never on the internet
Everything else routedPublicInternet hosts

Private addresses exist in millions of networks at once, so they have no global owner or location. The lookup shows their scope and skips the geolocation request. If a log shows a private address as a client, the real client is behind a proxy or load balancer, and the original address is usually in a forwarded header.

Practical uses

Identifying senders in DMARC reports

Aggregate reports list source IPs. Looking them up shows whether an address belongs to your mail provider, a marketing platform or an unknown hosting network, which is the first step in sorting report rows. The aggregate report guide walks through that process.

Investigating suspicious logins or traffic

A login from an address in a hosting provider's range or from an unexpected country is worth a closer look. Combine the lookup with the Blacklist Checker, which also shows network context for the address. Be careful with conclusions: shared VPN and proxy addresses are used by many legitimate people.

Checking your own public address

"Show my IP" answers questions such as whether a VPN is active, which address to allow in a firewall, or whether your connection uses IPv6. Behind carrier-grade NAT, many customers share the same public address, which matters for services that limit or block by address.

Limits of IP data

Address blocks change hands, and databases update at different speeds. An address that belonged to a hosting provider last year may now be used by a different company, and reverse DNS may still show the old name. For decisions that matter, confirm with current registry data from the regional internet registry.

Registry lookup from the command line
whois 192.0.2.80
# or query RDAP over HTTPS through the regional registry that holds the block

Geolocation providers also disagree with each other. If a location matters, for example for a compliance question, compare several sources and the registry record instead of relying on one lookup.

Also remember that an address tells you about a network path at one moment. Dynamic addresses are reassigned, and one address can be shared by a whole office, a mobile network cell or a VPN service.

FAQ

How accurate is IP geolocation?

Country is usually right, region often, city frequently approximate. Mobile networks, VPNs and cloud providers make locations less reliable.

Can an IP lookup find a person's address?

No. IP data identifies networks and approximate areas, not people or homes. Only the provider can link an address to a customer, and only under legal processes.

Why does my IP show a different city?

Your provider may route traffic through a central location, or the database may be outdated for your address range. VPNs and mobile networks also change the apparent location.

What is an ASN?

An autonomous system number identifies a network that routes its own address blocks on the internet, such as an internet provider, cloud platform or large company.

Why is reverse DNS empty?

The holder of the address block has not published a PTR record. It is common for home connections and cloud instances that nobody configured.

Does XGM look up my IP automatically?

No. Your address is only looked up when you press "Show my IP".

Why is geolocation missing for some addresses?

Private, loopback and reserved addresses have no public location, so XGM does not query the provider for them.

Can I look up many addresses at once?

The page looks up one address at a time. For scripts, the XGM API offers the same lookup at /api/v1/ip/<address> within its rate limits.

Sources