IP Reputation & ASN Lookup

For any valid public IPv4 or IPv6 address the tool returns country, region, city, timezone, ISP, ASN, organization, reverse DNS (PTR record), and hosting/proxy classification. All fields are pulled from a public reputation API and rendered instantly in a shareable snapshot.

Ask the provider for 3–5 sample exit IPs before signing up. Paste each into this lookup and compare advertised vs. reported country, ASN and hosting flag. Discrepancies are your negotiating leverage — most providers will refund or swap plans when their advertised pool doesn't match reality.

Yes. Both IPv4 (dotted quad) and IPv6 (colon-hex) addresses are validated before the lookup and displayed with the correct notation. IPv6 lookups return the same country, ASN and hosting fields as IPv4.

It returns the hosting/datacenter flag from the underlying database. A true 'is this a proxy' signal requires cross-referencing multiple vendors (IPQualityScore, IP2Proxy, MaxMind). Treat hosting=true as strong evidence of a datacenter proxy or VPN. Residential proxies with is_hosting=false may still be proxies — use reverse DNS and behavior as secondary signals.

An ASN (Autonomous System Number) identifies the network operator that announces an IP block. AS7922 is Comcast; AS16509 is Amazon AWS. Anti-bot systems use ASNs to distinguish residential ISPs from cloud providers — the strongest single signal for classifying a proxy exit.

Reverse DNS (PTR) is optional for the network operator. Consumer ISPs usually publish descriptive PTRs (c-24-6-100-200.hsd1.ca.comcast.net). Cloud providers and rotating proxy pools often skip PTRs or publish generic ones. An empty PTR is neutral evidence, not a red flag on its own.

Country and ASN data is refreshed weekly by the upstream database vendor. City and postal data can lag proxy rotations by 24–72 hours. If a freshly rotated IP shows unexpected geolocation, retry the lookup 1–2 days later before drawing conclusions.

This browser tool handles one IP per request. For bulk audits (100+ IPs) either script requests directly against the ipwho.is API from the terminal, or use a paid tier of IPQualityScore or MaxMind minFraud that supports batch endpoints.

Both return a consumer-labeled ISP, so the deciding signal is the ASN and reverse DNS. Residential exits usually rotate PTR records (c-24-6-100-200.hsd1.ca.comcast.net) and belong to consumer BGP ranges. ISP-static exits stay on a fixed PTR and often live in a small, dedicated announced range under the same ASN. Look up 3–4 sample IPs to see the pattern.

Unknown fields mean the upstream database has no record — usually a brand-new BGP announcement, a bogon block, or a private address you shouldn't be querying. Verify the IP is public and routable (not 10.x, 172.16.x, 192.168.x, or 100.64.x/CGNAT), then retry in 24 hours after the database refreshes.

The lookup returns geo, ASN and hosting flags — not real-time blocklist status. For SBL/XBL/CSS listings, cross-check with Spamhaus, AbuseIPDB or IPQualityScore. Combine both signals when auditing a new SOCKS5 provider's pool.

Query the exit IP the target site would see, then query any known intermediate hop. If both belong to hosting ASNs owned by the same operator, you're on a single-network chain that anti-bot systems can correlate. Prefer chains that cross ASN and country boundaries for stronger anonymity.

Vendors buy geo data from different upstream sources (MaxMind, ip2location, DB-IP, IPinfo) with independent refresh cycles. A newly rotated residential IP may be labeled correctly in one and incorrectly in another for 24–72 hours. When two databases agree, trust their reading over a third outlier.

Yes — expand the 'Raw JSON' panel in the tool and copy the response. It's the exact payload from ipwho.is, safe to paste into a ticket or attach to an audit report. The Share button also encodes the queried IP into the URL for one-click reproduction.