September 1, 2026
How to Read an IP Lookup: ASN, Prefix, Geo, and Registry
An IP address is a pointer. The useful story is the prefix that covers it, the ASN that originates that prefix, and whether registry, geo, and reverse DNS tell the same story.
Field by field
| Field | What it means | Trust it for |
|---|---|---|
| Origin ASN | The AS currently originating the covering prefix in BGP | Incident response, abuse, peering |
| Announced prefix | The most specific live covering block | Scope of an outage or hijack |
| Geolocation | Best-effort city/country from commercial or registry hints | Rough user region, never legal proof |
| rDNS / PTR | A name the operator chose to publish | Hints like cdn, nat, mail |
| Registry / RDAP | Who was allocated the space | Contacts, org name, allocation date |
When the fields disagree
Disagreement is normal. A US company can announce European space from a London POP. An anycast CDN will geolocate “everywhere.” A cloud VM in Frankfurt can sit in a prefix still registered to a US holding company. Treat geo as a hint. Treat live origin as the operational fact.
Reverse DNS is optional and often stale. A missing PTR is not suspicious by itself. A PTR that claims mail.bank.example on a prefix originated by a bulletproof host is suspicious.
IPv4 and IPv6 are the same job
IP Lookup on bgplookup.io handles both families. The questions do not change: covering prefix, origin ASN, identity. IPv6 prefixes are often larger (/32 or /48 at the edge), so one “address” can represent a whole site. Do not assume a /128 is the unit of routing. It almost never is.
A practical reading order
- Confirm the address family and that the result is live, not a cached registry-only record.
- Write down the covering prefix. That is the blast radius.
- Write down the origin ASN and organization name.
- Open WHOIS / RDAP for abuse and technical contacts.
- If the service is broken in one region only, check Looking Glass paths.
- If origin looks wrong, check RPKI validity.
Bulk lookups for real incidents
One address is a ticket. Fifty addresses across two prefixes is a campaign or a routing event. Use bulk BGP Lookup to collapse IPs into unique prefixes and ASNs before you write the report. Executives want “AS64500 withdrew 203.0.113.0/24,” not a paste of fifty identical rows.
Look up your own public IP first. Then look up a CDN address you use daily. Compare prefix size, origin, and geo. The contrast teaches the tool faster than a glossary.
rDNS is a hint, not a signature
Reverse DNS can name a household CPE, a mail cluster, or a CDN edge. Attackers set pretty names. Registrars do not police PTR honesty the way people hope. Use rDNS to decide what to type next — “is this a resolver, a NAT pool, or a VM” — then confirm with origin ASN and port behavior. A name that says customer.isp.example on a hosting ASN is a leftover, not a fact.
Geolocation without the superstition
City-level IP geo is a best-effort product built from RIR data, latency probes, and user-submitted corrections. Anycast makes one address appear everywhere. CGNAT makes thousands of households share one city guess. For fraud review, “same ASN as last week” beats “same alleged postcode.” For content licensing, geo is a blunt instrument and everyone in the industry knows it.
When the lookup and the user story collide
A customer swears they are in one country. The origin ASN is a mobile carrier in another. Believe the table first, then ask about VPNs, travel, and dual-SIM phones. A vendor swears a DDoS came from “Russia.” The covering prefix belongs to a cloud region in Frankfurt announced by a US ASN. Write the prefix and ASN in the report. National folklore wastes response time.
FAQ
FAQ
Why does geo say a country I have never visited?
Anycast, CGNAT, cloud regions, and outdated city databases. Geo is not GPS.
Is the origin ASN the same as the hosting company I paid?
Often yes, sometimes no. Resellers and downstreams announce through an upstream ASN.