About ipctl.io
ipctl is a network intelligence platform built for engineers, security teams, and anyone who needs to understand what an IP address, prefix, or autonomous system is doing on the Internet - right now.
What we do
We collect, correlate, and serve data from authoritative Internet infrastructure sources - routing tables, address registries, RPKI validators, geolocation, threat intelligence, and network node detection. Our API and web interface let you look up any IP address, ASN, or network prefix and instantly see the full picture: who operates it, where it is, how it's routed, whether the routing is cryptographically valid, what services it runs, and if it has been associated with abuse.
We process live BGP data giving us visibility into over 1 million IPv4 and 200,000+ IPv6 prefixes. Our data pipeline runs continuously, so the information you see reflects the current state of the global routing table - not a stale snapshot.
Data sources
ipctl aggregates and correlates data from authoritative Internet infrastructure sources to build a comprehensive picture of every IP address, prefix, and autonomous system.
BGP Routing Table
Full BGP routing tables providing a comprehensive view of how prefixes are announced, which ASNs originate them, and how routes propagate across the Internet.
Regional Internet Registries
Delegated statistics and WHOIS data from all five RIRs - RIPE NCC, ARIN, APNIC, LACNIC, and AFRINIC. This provides authoritative IP address and ASN allocation records: who holds which address space, when it was allocated, and under which registry.
RPKI Validation
Route Origin Authorizations (ROAs) from all five trust anchors, validated in real time. Every BGP announcement is checked against published ROAs to determine RPKI validity - valid, invalid, or not found.
IRR Route Objects
Internet Routing Registry data showing which prefixes an ASN intends to announce - a critical cross-reference for detecting unauthorized route announcements and verifying routing policy.
IP Geolocation
City-level geolocation mapping IP addresses to countries, regions, cities, and coordinates. Updated regularly to track address reassignments and new allocations.
Threat Intelligence
Aggregated threat signals tracking malicious IPs, botnets, C2 servers, scanners, open proxies, Tor exit nodes, and other abuse indicators with historical context.
Network Node Detection
Identification of cryptocurrency nodes (Bitcoin, Ethereum), VPN endpoints, and other network infrastructure. Tracked continuously to maintain an up-to-date view of what services are running on each IP address.
How it works
Collect
Automated pipelines collect BGP table dumps, RIR delegation files, RPKI ROAs, IRR route objects, geolocation data, threat intelligence, and network node information on a regular schedule.
Correlate
We merge and cross-reference data across sources - matching BGP announcements against RIR allocations, validating routes against RPKI ROAs, and enriching with geolocation and threat signals.
Serve
The enriched data is available through a fast REST API and this web interface. Look up any IP, ASN, or prefix and get the full context in milliseconds.
Attribution
BGP routing data from the RIPE NCC Routing Information Service (RIS) and other public route collectors.
IP allocation data from ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC.
IP geolocation data provided by DB-IP (CC-BY 4.0), supplemented with operator-published RFC 8805 geofeeds.
Tor exit relay data from the Tor Project.
Threat intelligence from multiple independent community and commercial blocklist providers.
IRR route objects from RADb and ARIN IRR, in addition to all five RIR routing registries.
CDN and hosting provider detection via BGP community analysis and AS relationship mapping.
Cryptocurrency and P2P node detection via direct network protocol crawling.
Contact
Get in touch at [email protected]
Ready to get started?
Try a lookup or explore our API documentation.