Skip to content

Host report

Who owns an address, which network announces it, where it is and whether it is blocklisted, from public sources, in one report.

What a host report tells you

An IP address on its own says little. The report puts together what public sources know about it: the regional registry (who holds the range and whom to write about abuse), the global routing table as RIPE's route collectors see it (which network announces it, through which upstreams, and whether RPKI confirms it), the geolocation databases, and the reputation sources (DNS blocklists such as Spamhaus, and AbuseIPDB reports). Give it a domain name and it reports on the address the name resolves to.

Read it from the top: the organisation and the autonomous system tell you who to contact, the routing card whether the address is reachable from the internet at all, the reputation card whether mail or traffic from it will be refused. Nothing in this part touches the host. The two checks underneath do: they open connections to the common ports and to HTTPS, which is why they wait for your click.

Frequently asked questions

How is this different from Shodan?
Shodan scans the whole internet continuously and shows the banners it collected, including services you never asked about. This report scans nothing on its own: it reads public sources about the address, and only connects to the host when you click to check its ports or HTTPS, at that moment and from our server.
Where does each part come from?
The owner, range and abuse contact from the regional registry (RDAP, or WHOIS when the registry's RDAP fails). The route and RPKI from RIPEstat, which aggregates RIPE's route collectors. The location from IPinfo, then MaxMind GeoLite2. The reputation from five DNS blocklists queried live and from AbuseIPDB.
Why is the location sometimes wrong?
Geolocation databases record where an address is registered or usually seen, not where the machine is. Anycast addresses (1.1.1.1, large CDNs) are served from dozens of cities, and cloud ranges move between regions. A traceroute shows where the path really goes.
Why are ports 25 and 465 not testable?
Our hosting provider blocks outgoing connections to the mail ports to fight spam. The check says so instead of calling them filtered, which would wrongly blame the host you are testing.

Related tools

Go further

Network glossary: ASN, Reverse DNS, Anycast

Run a visual traceroute to this host