What happens when you submit an address
The input can be an IPv4 address, an IPv6 address or a hostname. A hostname is resolved to its first IPv4 address on the server, so a name with only an AAAA record is reported as unresolvable. URL parts are stripped, so pasting https://example.com/page works. The address is then classified as IPv4 or IPv6 and as public or private, looked up in reverse DNS, and sent to a location provider for ownership and geography.
The provider, ip-api.com, is queried from the server with a short timeout and returns the country, region, city, timezone, autonomous system and organisation. When it fails, or the address is private, the ASN and location cards show N/A and a warning explains why: Private or reserved address, Location provider did not respond, or the HTTP status it returned. The tool never fills those cards with placeholder data.
Reverse DNS uses the server's resolver to fetch the PTR record for the address. Only the first name is shown when there are several. No PTR record is a normal result for many consumer and cloud addresses and does not mean the lookup failed.
Reading the result card
The header carries the address, a version badge and a Public Routable or Private / Bogon badge, with the PTR hostname beneath. The left card lists the AS number in the form AS13335, the network name and the organisation. The right card gives the country with its two-letter code, region, city and timezone. The JSON you can copy or download also includes the latitude and longitude the provider returned.
The AS name and the organisation often differ, and the difference is informative. The AS is the network that announces the address block to the rest of the internet. The organisation is who the block is registered to or who uses it. An address announced by a transit carrier but registered to a small company is a customer on that carrier's lines.
A website that resolves to an address in a CDN or cloud network tells you that you are looking at the provider's edge, not the origin server. The website hosting checker goes further and names the hosting, CDN, DNS and mail providers behind a domain in one pass.
Autonomous systems and who holds an address
An autonomous system is a network under one administrative control that exchanges routes with its neighbours using BGP, identified by a number from 1 to 4294967295. The regional registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC) allocate both AS numbers and address blocks, and the AS that announces a block is what the lookup reports. Well-known examples are AS13335 for Cloudflare and AS15169 for Google.
For an abuse report the organisation shown here is the right starting point, and the WHOIS lookup covers the domain side of the same incident. For a judgement on whether the address is trustworthy, the IP reputation checker adds blocklist status and proxy and hosting flags, and the blacklist checker queries the DNS-based lists mail servers consult.
Reverse DNS and why mail servers care
A PTR record lives in the in-addr.arpa zone for IPv4 or ip6.arpa for IPv6 and maps an address back to a name, the mirror image of an A or AAAA record. It is published by whoever holds the address block, usually the ISP or hosting provider, so a domain owner cannot set it from their own DNS zone. They ask the provider to.
Receiving mail servers check that the PTR exists and that the name it gives resolves forward to the same address, known as forward-confirmed reverse DNS. A sending server without it, or whose PTR is a generic string like 203-0-113-5.static.example.net, is treated as suspicious. Cloudflare's resolver address 1.1.1.1 shows the idea done well: its PTR is one.one.one.one, which resolves straight back.
If you run a mail server, make the PTR match the hostname the server uses in its HELO greeting. The SMTP test connects to a mail server and reports its PTR alongside STARTTLS and banner details, and the email header analyzer shows how receivers judged a message that already went through.
Accuracy limits and private addresses
IP geolocation is an estimate built from registry allocations and routing data. It usually gets the country right and the city roughly right, but it reports the registered location of the block or the provider's point of presence, not a street address. Mobile carriers, VPN exits and corporate networks can place a user hundreds of kilometres from where they are, and anycast addresses such as 8.8.8.8 show a single location while being served from many.
Private and reserved input is flagged as Private / Bogon with no owner or location: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, loopback, link-local, carrier-grade NAT 100.64.0.0/10, the documentation ranges and the IPv6 unique local and link-local prefixes. Seeing one of these in a server log means the traffic came through NAT or a proxy and the real source is further out.
Lookups go to a third-party provider from the server, not from your browser, and are rate limited per visitor IP. Nothing you look up is stored, as the privacy policy explains. To see your own public address and network, use What is my IP instead.