About ipctl.io
ipctl.io answers three questions about any IP address, prefix or autonomous system: who holds it, how it is routed, and whether it has been seen in abuse.
What we do
We combine routing tables, the records of the five regional Internet registries, RPKI, geolocation and public abuse lists. One lookup on the website or one API call returns the holder, location, announcing ASN, RPKI status, detected services and abuse score together.
The routing table currently holds 1.3M+ IPv4 and 323k+ IPv6 prefixes. Data is reloaded on a fixed schedule: routes every 2 hours, RPKI every hour, Tor relays every 30 minutes, registry, IRR and blocklist data once a day. Each page shows the data as of the last run, not a live BGP feed.
Data sources
The sources below are cross-checked: each route is compared with its registry allocation, its ROAs and its IRR object.
BGP Routing Table
Full routing tables from public route collectors, reloaded every 2 hours: which prefixes are announced, which ASN originates each one, and where more-specific or overlapping announcements exist.
Regional Internet Registries
Delegated statistics and WHOIS data from all five RIRs - RIPE NCC, ARIN, APNIC, LACNIC, and AFRINIC. This provides authoritative IP address and ASN allocation records: who holds which address space, when it was allocated, and under which registry - plus the registries' published transfer logs, which record every IPv4, IPv6 and ASN transfer between organisations.
RPKI Validation
Route Origin Authorizations (ROAs) and ASPA objects from all five trust anchors, fetched every hour. Every BGP announcement is then re-checked against the ROAs and marked valid, invalid or not found.
IRR Route Objects
Route objects from the Internet Routing Registries, updated daily. They show which prefixes an ASN says it will announce, so announcements without a matching object stand out.
IP Geolocation
Country, region, city and coordinates per address, from licensed data supplemented by operator-published RFC 8805 geofeeds.
Threat Intelligence
Public blocklists for botnets, C2 servers, scanners, brute-force sources and open proxies, refreshed daily, plus Tor exit relays every 30 minutes. Each IP gets a 0-100 score; more independent lists raise it.
Network Node Detection
Cryptocurrency and P2P nodes found by crawling the public peer-to-peer protocols daily, plus known VPN endpoints. A node tag is hidden once the address has not been seen for 2 days.
How it works
Collect
Scheduled jobs download BGP table dumps, RIR delegation files and transfer logs, RPKI data, IRR route objects, geolocation and blocklists.
Correlate
Each announced prefix is matched to its RIR allocation, validated against ROAs, compared with IRR objects and tagged with location and abuse data.
Serve
The result is served from a cache through the REST API and this website, so a lookup does not wait on any upstream source.
Attribution
BGP routing data from public route collectors.
IP allocation data from ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC.
IP address and ASN transfer data from the official transfer logs published by AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC.
IP geolocation from licensed geolocation data, supplemented with operator-published RFC 8805 geofeeds.
Tor exit relay data from the public Tor relay directory.
Threat intelligence from multiple independent public threat intelligence feeds.
IRR route objects from the routing registries of all five RIRs and other public IRR databases.
CDN and hosting provider detection via BGP community analysis and AS relationship mapping.
Cryptocurrency and P2P node detection via direct network protocol crawling.
Contact
Get in touch at hello [at] ipctl [dot] io
abuse [at] ipctl [dot] io · security [at] ipctl [dot] io · support [at] ipctl [dot] io
Look something up
Start with an IP, ASN or prefix, or read the API documentation.