Data Sources & Methodology

MaxMind GeoLite2 is the foundation of our database. It provides three CSV datasets:

• GeoLite2-Country-CSV — Maps every allocated IPv4 CIDR block to its country. This is our authoritative source for "is this IP allocated or not" and "which country does it belong to." ~681K rows covering 4.25 billion IPs.
• GeoLite2-City-CSV — Finer-grained blocks mapped to city, region, postal code, latitude/longitude, and accuracy radius. ~4.68M rows. City-level accuracy varies by region: excellent in North America and Europe, approximate in other regions.
• GeoLite2-ASN-CSV — Maps IP blocks to Autonomous System Numbers (ASNs) and organization names. ~784K rows covering 3.50 billion IPs.

MaxMind publishes fresh data every Tuesday at 00:00 UTC. Our automated pipeline downloads, validates, and imports the new data by 04:00 UTC the same day.

License: Creative Commons Attribution-ShareAlike 4.0. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

The five Regional Internet Registries maintain public statistics files showing how IP address space is distributed:

• ARIN — North America
• RIPE NCC — Europe, Middle East, Central Asia
• APNIC — Asia-Pacific
• LACNIC — Latin America, Caribbean
• AfriNIC — Africa

We use these files to infer which RIR manages each address block and to cross-validate MaxMind's country assignments.

PTR records (the hostname associated with an IP) come from two layers that work together:

• Cached layer — Our continuous scanner pre-resolves every allocated IPv4 address and stores the result, so IP pages and PTR search work instantly without waiting for a live DNS call. See section 6 for how the scanner runs.
• Live freshness layer — When you load /what-is-my-ip or the embeddable widget, a real-time PTR lookup is also performed for your specific IP so the displayed value reflects the very latest DNS answer (and that fresh value is fed back into the cached layer for everyone else).

So a given hostname you see can be cached (pre-computed by the scanner) or freshly resolved on your visit — never both at once for a given page render.

Our import pipeline runs in three passes:

1. Country + city blocks — Each MaxMind CSV row becomes a row in tuxxin_ip_ranges with a data_source tag. A unique index on (ip_start, ip_end, data_source) ensures no duplicates.
2. ASN merge — ASN data is overlaid onto the same ranges using the ASN CSV's block boundaries.
3. Organization + RIR inference — Organizations are materialized from ASN names. RIR tags are inferred from IANA's /8 allocation registry. Aggregate counts (IPs per country, per ASN, per org) are recomputed.

The entire process takes ~5 minutes and runs as a single transaction with automatic rollback on failure.

We fetch and parse the official delegation statistics files from all five Regional Internet Registries every six hours, capturing new allocations, transfers and country re-assignments as the registries publish them — this is what powers our live RIR ownership feed:

• ARIN — North America
• RIPE NCC — Europe, Middle East, Central Asia
• APNIC — Asia-Pacific
• LACNIC — Latin America, Caribbean
• AfriNIC — Africa

These files provide authoritative RIR assignments, allocation dates, and country codes for IP blocks that MaxMind may not cover (e.g., non-BGP-announced allocations). RIR data backfills gaps without overwriting MaxMind's more granular geolocation. A full re-import of these files also runs during the weekly database refresh described above.

ipinfo Lite is a free, daily-updated dataset mapping every routed IPv4 network to its ASN, AS name, AS domain, country and continent. We use it to backfill ASN and country coverage that MaxMind does not include — newly-routed prefixes, reassignments, and blocks MaxMind leaves blank.

• Additive, never overriding — ipinfo rows are tagged data_source=ipinfo_lite at a lower priority than MaxMind, so MaxMind always wins where it has data; ipinfo only fills gaps (or refines a broad country block with a more-specific ASN range).
• AS domain — ipinfo supplies the network operator's domain (e.g. google.com for AS15169), shown on each ASN page.
• Refresh — downloaded and re-imported every day, independent of the weekly MaxMind refresh.

License: Creative Commons Attribution-ShareAlike 4.0. IP address data powered by IPinfo.

WorldIP.io operates a continuous PTR record scanner that resolves reverse DNS hostnames for all allocated IPv4 addresses. This data powers our PTR search feature and enriches individual IP pages.

• Method — Standard DNS PTR queries against authoritative nameservers for .in-addr.arpa zones. No ports are scanned; no connections are made to the target IPs themselves.
• Rate — Queries are rate-limited per authoritative nameserver to avoid overloading any single DNS operator.
• Freshness — Records are re-scanned when their DNS TTL expires, ensuring hostnames stay current.
• Coverage — Full IPv4 address space (4.25 billion allocated IPs), with continuous re-scanning.

PTR data is public DNS information, freely queryable by any recursive resolver. Our scanner simply aggregates and indexes it for search. For scanner identification, opt-out, and abuse contact details, see the scanner information page.

Allocation data tells you who an address block belongs to; BGP data tells you how it is actually routed. We ingest a live feed of the global routing table from the RIPE RIS project — 23 route collectors peering with networks across every continent.

• What we record — the prefixes currently announced on the Internet and the origin ASN that advertises each one. This is the difference between registered ownership (the RIR records above) and operational routing (what the routing system actually carries).
• Where it surfaces — announced prefixes and their origin AS appear on every IP, range, ASN and organization page, and feed the distributed BGP path tester.
• Anomaly detection — for each prefix we learn its long-stable expected origin (a 7-day window with 100+ samples). When a prefix starts being announced from an unexpected AS — the signature of a route leak or hijack — it is flagged on the live BGP anomaly feed.
• Storage — the routing stream is written to ClickHouse, the same column-store that holds our PTR dataset, and joined to allocation data at query time rather than merged into the weekly MariaDB import.

BGP visibility is inherently limited to the vantage points RIPE RIS peers observe: a prefix announced only within a region none of the collectors peer with may not appear. The feed reflects the global routing table as collectively seen, not any single operator's view.

Our own scanning covers the reverse direction — the PTR hostname for an address. GRIP (General Research IP) supplies the forward direction: the domains observed with an A record pointing at a given IP. The two views sit side by side on every IP page — our reverse DNS, and GRIP's “hosted domains” count plus a sample.

• What it adds — for an IP, how many domains resolve to it via an A record (GRIP's exact total) and a small sample of them. Useful for spotting shared hosting, CDN / parking front-ends and bulk-registration infrastructure.
• How it's used — looked up per IP on demand and cached briefly; GRIP data never blocks or alters the rest of the page, and reserved / private ranges are suppressed.
• Boundaries — GRIP's count is an accumulated observation, not a point-in-time guarantee. The reverse-DNS, allocation and routing data described above remain entirely our own.

Forward-DNS data provided by GRIP (General Research IP), used with attribution under their free arrangement.

Beyond who owns and routes an address, WorldIP.io surfaces what is exposed on it and whether it appears on public threat feeds, combined into a transparent 0–100 reputation score on every IP page.

• Exposure (Shodan) — open ports, detected services and known CVEs observed by Shodan, shown on IP pages and factored into the reputation score.
• Threat-intelligence blocklists — we bulk-ingest eight independent, freely-licensed feeds every six hours into a local lookup table (no live DNSBL queries), covering hijacked/criminal netblocks, botnet C2, compromised hosts, brute-force attackers, Tor exits and bogons.

Sources & attribution:

• Spamhaus DROP / DROPv6 / ASN-DROP — © The Spamhaus Project, used under the Spamhaus DROP terms.
• Feodo Tracker — botnet C2 data by abuse.ch (CC0).
• Emerging Threats — Compromised — © Proofpoint, Inc., ET Open (BSD 3-Clause).
• FireHOL Level 1 — aggregate via the FireHOL blocklist-ipsets project, under each component's terms.
• IPsum — aggregate by @stamparm (public domain, Unlicense).
• blocklist.de — attacker-IP data from blocklist.de.
• Tor exit list — from The Tor Project (CC0).
• Bogons — from Team Cymru Community Services.

Reputation score — a transparent, additive heuristic: every IP starts at a neutral baseline of 65, then blocklist hits (tiered by confidence, deduplicated per provider), Shodan exposure, reverse-DNS / FCrDNS, BGP routing stability (MOAS), RPKI validity and allocation category/age each adjust it up or down. Each IP page shows the full breakdown, so the number is explainable rather than a black box. It is an informational signal, not a definitive verdict. See the full blocklist source catalog for per-feed weights, licensing and live refresh status.

WorldIP.io tags IP addresses that participate in public blockchain / peer-to-peer networks. This is a neutral, positive signal — running a node is not abuse, so it is deliberately kept out of the reputation score. It appears as a badge on every IP page and on the web3 node map.

• Published peer feeds — decentralized networks gossip their peers publicly, so we pull each project's own node list daily and normalize it to IP addresses. No port scanning or active probing of the nodes themselves.
• First-party crawler — for networks without a published list we run our own discovery crawler (Nebula), which participates in each network's peer-discovery protocol to enumerate reachable nodes and records a daily census.

Sources & attribution:

• Arweave — peer list published by the Arweave network.
• Solana — cluster nodes via the getClusterNodes RPC.
• Monero — remote-node list by ditatompel.
• Bitcoin — reachable-node crawl by Bitnodes.
• Ethereum, IPFS, Filecoin, Polkadot & more — discovered by our own Nebula crawler.

• Geolocation accuracy — MaxMind GeoLite2 is less accurate than the paid GeoIP2 product. City-level accuracy is ~60-80% depending on region. Country-level accuracy is ~99%.
• Organization names — Names reflect the original allocation recipient, not necessarily the current operator. IP transfers and acquisitions may not be reflected.
• IPv6 — WorldIP.io currently covers IPv4 only. IPv6 support is on the roadmap.
• Mobile IPs — Mobile carrier IPs often geolocate to the carrier's gateway location, not the user's actual location.
• BGP visibility — Routing data only reflects what the RIPE RIS collectors can see. Prefixes announced solely within networks none of those collectors peer with may be missing, and propagation means a brand-new announcement can take minutes to appear.