IP Intelligence guide
What XGM IP Intelligence shows for an IP address or hostname: scope, reverse DNS, ASN, organisation and approximate location, and how reliable each is.
What an IP lookup can tell you
An IP address identifies a network interface, not a person or a building. Registries record which organisation holds each address block, networks announce the blocks they route with an autonomous system number (ASN), and commercial databases map address ranges to approximate locations. An IP lookup combines those sources into one view.
That makes it useful for questions such as "which provider sends this mail?", "is this address a data centre or a home connection?" or "which country is this traffic coming from?". It is not useful for finding where a specific person is, and the data can be wrong or outdated for any given address.
How to use IP Intelligence
- Open IP Intelligence and enter an IPv4 or IPv6 address, such as
8.8.8.8or2001:db8::1. - Or press "Show my IP" to look up the address your browser connects from. This request is only sent when you press the button.
- Read the summary line with location and network, then the table of details.
- Press "Show map" if you want the approximate location on a map; map files load only at that moment.
- Continue with Run next for reverse DNS, ASN, reputation or blocklist checks on the same address.
Privacy of lookups
Hostnames and ASN lookups
IP Intelligence also accepts a hostname such as github.com. The XGM server resolves it, refuses names that point to private or internal addresses, and describes the first public address; the result shows which addresses the name resolved to. This replaces the separate ASN Lookup tool: the autonomous system number, its organisation and the ISP are part of every result.
An ASN identifies the network that announces an address range on the internet. It tells you who operates the network, not who uses a particular address: a cloud provider's ASN covers thousands of unrelated customers.
The fields in the result
| Field | Meaning | Reliability |
|---|---|---|
| Version | IPv4 or IPv6 | Exact |
| Reverse DNS (PTR) | Host name published for the address | Exact, but set by the address holder and can be generic or missing |
| Scope | Public, private, loopback or reserved | Exact, from the address ranges |
| Decimal | IPv4 address as a single number | Exact |
| ASN and organisation | The network that announces the address | Good; reflects routing data |
| ISP | The provider name in the database | Good for large providers, less so for resellers |
| Country, region, city | Estimated location | Country usually right; city often approximate or wrong |
| Time zone | Time zone of the estimated location | As reliable as the location |
Reverse DNS names often reveal the kind of address. A name like mail.example.com suggests a mail server configured by its owner, while 192-0-2-80.dynamic.isp.example.net points to a home or dynamic connection. Many mail filters treat generic dynamic names with suspicion for exactly that reason.
Mobile networks, VPNs, corporate proxies and cloud providers all break the connection between address and physical location. A phone on a mobile network may appear hundreds of kilometres away, and a VPN user appears where the VPN server is. Treat city-level results as a hint only.
Public, private and special addresses
| Range | Scope | Seen where |
|---|---|---|
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | Private (RFC 1918) | Home and office networks, cloud VPCs |
100.64.0.0/10 | Shared address space (RFC 6598) | Carrier-grade NAT at internet providers |
127.0.0.0/8, ::1 | Loopback | The local machine itself |
169.254.0.0/16, fe80::/10 | Link-local | Automatic addressing without DHCP; cloud metadata services |
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 2001:db8::/32 | Documentation (RFC 5737, RFC 3849) | Examples in documentation; never on the internet |
| Everything else routed | Public | Internet hosts |
Private addresses exist in millions of networks at once, so they have no global owner or location. The lookup shows their scope and skips the geolocation request. If a log shows a private address as a client, the real client is behind a proxy or load balancer, and the original address is usually in a forwarded header.
Practical uses
Identifying senders in DMARC reports
Aggregate reports list source IPs. Looking them up shows whether an address belongs to your mail provider, a marketing platform or an unknown hosting network, which is the first step in sorting report rows. The aggregate report guide walks through that process.
Investigating suspicious logins or traffic
A login from an address in a hosting provider's range or from an unexpected country is worth a closer look. Combine the lookup with the Blacklist Checker, which also shows network context for the address. Be careful with conclusions: shared VPN and proxy addresses are used by many legitimate people.
Checking your own public address
"Show my IP" answers questions such as whether a VPN is active, which address to allow in a firewall, or whether your connection uses IPv6. Behind carrier-grade NAT, many customers share the same public address, which matters for services that limit or block by address.
Limits of IP data
Address blocks change hands, and databases update at different speeds. An address that belonged to a hosting provider last year may now be used by a different company, and reverse DNS may still show the old name. For decisions that matter, confirm with current registry data from the regional internet registry.
whois 192.0.2.80
# or query RDAP over HTTPS through the regional registry that holds the blockGeolocation providers also disagree with each other. If a location matters, for example for a compliance question, compare several sources and the registry record instead of relying on one lookup.
Also remember that an address tells you about a network path at one moment. Dynamic addresses are reassigned, and one address can be shared by a whole office, a mobile network cell or a VPN service.
FAQ
How accurate is IP geolocation?
Country is usually right, region often, city frequently approximate. Mobile networks, VPNs and cloud providers make locations less reliable.
Can an IP lookup find a person's address?
No. IP data identifies networks and approximate areas, not people or homes. Only the provider can link an address to a customer, and only under legal processes.
Why does my IP show a different city?
Your provider may route traffic through a central location, or the database may be outdated for your address range. VPNs and mobile networks also change the apparent location.
What is an ASN?
An autonomous system number identifies a network that routes its own address blocks on the internet, such as an internet provider, cloud platform or large company.
Why is reverse DNS empty?
The holder of the address block has not published a PTR record. It is common for home connections and cloud instances that nobody configured.
Does XGM look up my IP automatically?
No. Your address is only looked up when you press "Show my IP".
Why is geolocation missing for some addresses?
Private, loopback and reserved addresses have no public location, so XGM does not query the provider for them.
Can I look up many addresses at once?
The page looks up one address at a time. For scripts, the XGM API offers the same lookup at /api/v1/ip/<address> within its rate limits.