An IP lookup puts data from very different sources on one page. Some of it is published fact, some of it is an estimate, and it pays to tell them apart. We’ll use an address of the Hebrew University of Jerusalem, 128.139.7.8, as the example.
1. What kind of address it is
First we check whether the address is public or belongs to a special range: private (192.168.0.0/16 …), CGNAT (100.64.0.0/10), loopback, documentation, multicast. For those there is no network or location to look up, and we say so. The reserved ranges table lists them all.
2. Announced prefix and ASN — fact
The most reliable line: which prefix covers the address in the global routing table and which autonomous system originates it. For our example, 128.139.0.0/16, originated by AS378, IUCC, the network of Israel’s universities. This is what routers on the internet actually use to get there.
3. Registered block — fact, but can be out of date
The registry (RIPE NCC, for Israel) states which organisation the block was assigned to, in which country and when. The data comes from the delegation files and, live, from RDAP. It says who holds the block, not where the addresses are used.
4. RPKI — verifiable fact
RPKI says whether the holder of the block has authorised that AS to announce it. “Valid” means a signed authorisation (ROA) exists and matches; “invalid” that one exists but does not match — a configuration error or an unauthorised announcement; “not found” that no authorisation is published. In our October 2026 copy, about 81 % of Israeli networks’ routes were valid, and the Hebrew University’s block is one of them.
5. Reverse DNS — stated by the holder
The PTR record is the name the holder of the reverse zone chose to publish. It often hints at the type of connection; it proves nothing. See How does reverse DNS work?.
6. Location — estimate
Country, region, city and coordinates come from a geolocation database (here DB-IP Lite). They estimate where the block is used, with a radius of uncertainty. The country is usually right and the city often is not — especially on mobile networks, whose traffic leaves through a few central points. It never gives a street address. More in How IP geolocation works.
7. Network type and indicators — inferences
“Hosting network”, “mobile network” or “university” are inferred from the registered name and the PTR, and are labelled as such. The Tor flag is different: it comes from the official exit list published by the Tor Project and is a fact. We do not show “VPN” or “proxy” scores, because public data cannot support them honestly.
Summary
| Line | Source | Nature |
|---|---|---|
| Address type | IANA registries | Fact |
| Prefix and ASN | Global BGP table | Fact |
| Registered block | RIPE NCC and other RIRs | Stated fact |
| RPKI | Validated ROAs | Verifiable fact |
| Reverse DNS | Holder of the zone | Statement |
| Location | DB-IP Lite | Estimate |
| Network type | Our inference | Estimate |
| Tor exit | Tor Project | Fact |
Every field on a result shows its source. How it works describes every source and how often we update it.