Data Sources & Methodology

MaxMind GeoLite2 is the foundation of our database. It provides three CSV datasets:

• GeoLite2-Country-CSV — Maps every allocated IPv4 CIDR block to its country. This is our authoritative source for "is this IP allocated or not" and "which country does it belong to." ~580K rows covering 3.69 billion IPs.
• GeoLite2-City-CSV — Finer-grained blocks mapped to city, region, postal code, latitude/longitude, and accuracy radius. ~2.8M rows. City-level accuracy varies by region: excellent in North America and Europe, approximate in other regions.
• GeoLite2-ASN-CSV — Maps IP blocks to Autonomous System Numbers (ASNs) and organization names. ~650K rows covering 3.1 billion IPs.

Our automated pipeline checks for a new MaxMind GeoLite2 release every day and downloads, validates and imports it as soon as one is published.

License: MaxMind GeoLite End User License Agreement. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. The GeoLite2 data incorporates GeoNames geographical data, made available under the Creative Commons Attribution 4.0 License.

The five Regional Internet Registries maintain public statistics files showing how IP address space is distributed:

• ARIN — North America
• RIPE NCC — Europe, Middle East, Central Asia
• APNIC — Asia-Pacific
• LACNIC — Latin America, Caribbean
• AfriNIC — Africa

We use these files to infer which RIR manages each address block and to cross-validate MaxMind's country assignments.

PTR records (the hostname associated with an IP) come from two layers that work together:

• Cached layer — Our continuous scanner pre-resolves every allocated IPv4 address and stores the result, so IP pages and PTR search work instantly without waiting for a live DNS call. See section 6 for how the scanner runs.
• Live freshness layer — When you load /what-is-my-ip or the embeddable widget, a real-time PTR lookup is also performed for your specific IP so the displayed value reflects the very latest DNS answer (and that fresh value is fed back into the cached layer for everyone else).

So a given hostname you see can be cached (pre-computed by the scanner) or freshly resolved on your visit — never both at once for a given page render.

Our import pipeline runs in three passes:

1. Country + city blocks — Each MaxMind CSV row becomes a row in tuxxin_ip_ranges with a data_source tag. A unique index on (ip_start, ip_end, data_source) ensures no duplicates.
2. ASN merge — ASN data is overlaid onto the same ranges using the ASN CSV's block boundaries.
3. Organization + RIR inference — Organizations are materialized from ASN names. RIR tags are inferred from IANA's /8 allocation registry. Aggregate counts (IPs per country, per ASN, per org) are recomputed.

The entire process takes ~5 minutes and runs as a single transaction with automatic rollback on failure.

We fetch and parse the official delegation statistics files from all five Regional Internet Registries every six hours, capturing new allocations, transfers and country re-assignments as the registries publish them — this is what powers our live RIR ownership feed:

• ARIN — North America
• RIPE NCC — Europe, Middle East, Central Asia
• APNIC — Asia-Pacific
• LACNIC — Latin America, Caribbean
• AfriNIC — Africa

These files provide authoritative RIR assignments, allocation dates, and country codes for IP blocks that MaxMind may not cover (e.g., non-BGP-announced allocations). RIR data backfills gaps without overwriting MaxMind's more granular geolocation.

ipinfo Lite is a free, daily-updated dataset mapping every routed IPv4 network to its ASN, AS name, AS domain, country and continent. We use it to backfill ASN and country coverage that MaxMind does not include — newly-routed prefixes, reassignments, and blocks MaxMind leaves blank.

• Additive, never overriding — ipinfo rows are tagged data_source=ipinfo_lite at a lower priority than MaxMind, so MaxMind always wins where it has data; ipinfo only fills gaps (or refines a broad country block with a more-specific ASN range).
• AS domain — ipinfo supplies the network operator's domain (e.g. google.com for AS15169), shown on each ASN page.
• Refresh — downloaded and re-imported every day, independent of the MaxMind import.

License: Creative Commons Attribution-ShareAlike 4.0. IP address data powered by IPinfo.

WorldIP.io operates a continuous PTR record scanner that resolves reverse DNS hostnames for all allocated IPv4 addresses. This data powers our PTR search feature and enriches individual IP pages.

• Method — Standard DNS PTR queries against authoritative nameservers for .in-addr.arpa zones. No ports are scanned; no connections are made to the target IPs themselves.
• Rate — Queries are rate-limited per authoritative nameserver to avoid overloading any single DNS operator.
• Freshness — Records are re-scanned when their DNS TTL expires, ensuring hostnames stay current.
• Coverage — Full IPv4 address space (~3.69 billion allocated IPs), with continuous re-scanning.

PTR data is public DNS information, freely queryable by any recursive resolver. Our scanner simply aggregates and indexes it for search. For scanner identification, opt-out, and abuse contact details, see the scanner information page.

Allocation data tells you who an address block belongs to; BGP data tells you how it is actually routed. We ingest a live feed of the global routing table from the RIPE RIS project — 23 route collectors peering with networks across every continent.

• What we record — the prefixes currently announced on the Internet and the origin ASN that advertises each one. This is the difference between registered ownership (the RIR records above) and operational routing (what the routing system actually carries).
• Where it surfaces — announced prefixes and their origin AS appear on every IP, range, ASN and organization page, and feed the distributed BGP path tester.
• Anomaly detection — for each prefix we learn its long-stable expected origin (a 7-day window with 100+ samples). When a prefix starts being announced from an unexpected AS — the signature of a route leak or hijack — it is flagged on the live BGP anomaly feed.
• Storage — the routing stream is written to ClickHouse, the same column-store that holds our PTR dataset, and joined to allocation data at query time rather than merged into the MariaDB allocation tables.

BGP visibility is inherently limited to the vantage points RIPE RIS peers observe: a prefix announced only within a region none of the collectors peer with may not appear. The feed reflects the global routing table as collectively seen, not any single operator's view.

WorldIP covers what is behind an IP address: who holds it, how it is routed, and its reverse DNS. What is in front of an address — the domains whose DNS points at it — is the work of issued.live, WorldIP's sister service, also operated by Tuxxin LLC. issued.live reads public Certificate Transparency logs and registry zone files and resolves the names it finds from its own DNS resolvers.

• What it adds — for each IP address, a Domains hosted count: the number of registrable domains (like example.com) with at least one name resolving to the address. It is a count only — WorldIP shows no domain names. Useful for spotting shared hosting, CDN and parking front-ends and bulk-registration infrastructure.
• How it's made — issued.live publishes a full DNS snapshot once a week. WorldIP reads it once, computes one number per address, and shows it with the date of the snapshot (“as of”). Reserved and private ranges are not counted.
• Boundaries — a count of 0 means issued.live's latest weekly snapshot holds no domain resolving to the address, not that none ever did. Names that stop resolving drop out at the next weekly count, so a count can lag reality by about a week; an address record that issued.live has not been able to confirm for 30 days is not counted. The keyless API carries the count for IPv4 addresses. The reverse-DNS, allocation and routing data described above remain WorldIP's own.
• The domain names — issued.live's Reverse IP lists the hostnames seen on an address, current and past, with first- and last-seen dates, on its paid plans.

Domain data provided by issued.live — for full details visit https://issued.live/pricing

GRIP (General Research IP) supplies a residential and mobile proxy feed: addresses observed as exits of commercial proxy networks, with the proxy network's name where known. Together with WorldIP's own validated proxy-exit observations it drives the “Residential proxy” tag on IP pages, the VPN & proxy check, and the residential-proxy verdict in the API (classification.verdict, is_proxy). GRIP's per-address privacy signals also appear in the API's optional grip object.

Residential-proxy data provided by GRIP (General Research IP), used with attribution.

Beyond who owns and routes an address, WorldIP.io surfaces what is exposed on it and whether it appears on public threat feeds, combined into a transparent 0–100 reputation score on every IP page.

• Threat-intelligence blocklists — we bulk-ingest eight independent, freely-licensed feeds every six hours into a local lookup table (no live DNSBL queries), covering hijacked/criminal netblocks, botnet C2, compromised hosts, brute-force attackers, Tor exits and bogons.

Sources & attribution:

• Spamhaus DROP / DROPv6 / ASN-DROP — © The Spamhaus Project, used under the Spamhaus DROP terms.
• Feodo Tracker — botnet C2 data by abuse.ch (CC0).
• Emerging Threats — Compromised — © Proofpoint, Inc., ET Open (BSD 3-Clause).
• FireHOL Level 1 — aggregate via the FireHOL blocklist-ipsets project, under each component's terms.
• IPsum — aggregate by @stamparm (public domain, Unlicense).
• blocklist.de — attacker-IP data from blocklist.de.
• Tor exit list — from The Tor Project (CC0).
• Bogons — from Team Cymru Community Services.

Reputation score — a transparent, additive heuristic: every IP starts at a neutral baseline of 65, then blocklist hits (tiered by confidence, deduplicated per provider), reverse-DNS / FCrDNS, BGP routing stability (MOAS) and allocation category/age each adjust it up or down. Each IP page shows the full breakdown, so the number is explainable rather than a black box. It is an informational signal, not a definitive verdict. See the full blocklist source catalog for per-feed weights, licensing and live refresh status.

WorldIP.io tags IP addresses that participate in public blockchain / peer-to-peer networks. This is a neutral, positive signal — running a node is not abuse, so it is deliberately kept out of the reputation score. It appears as a badge on every IP page and on the web3 node map.

• Published peer feeds — decentralized networks gossip their peers publicly, so we pull each project's own node list daily and normalize it to IP addresses. No port scanning or active probing of the nodes themselves.
• First-party crawler — for networks without a published list we run our own discovery crawler (Nebula), which participates in each network's peer-discovery protocol to enumerate reachable nodes and records a daily census.

Sources & attribution:

• Arweave — peer list published by the Arweave network.
• Solana — cluster nodes via the getClusterNodes RPC.
• Monero — remote-node list by ditatompel.
• Bitcoin — reachable-node crawl by Bitnodes.
• Ethereum, IPFS, Filecoin, Polkadot & more — discovered by our own Nebula crawler.

• Geolocation accuracy — MaxMind GeoLite2 is less accurate than the paid GeoIP2 product. City-level accuracy is ~60-80% depending on region. Country-level accuracy is ~99%.
• Organization names — Names reflect the original allocation recipient, not necessarily the current operator. IP transfers and acquisitions may not be reflected.
• IPv6 — IPv6 addresses get geolocation (country, and region/city where the data has it), ASN, organization and CIDR from the same MaxMind GeoLite2 and ipinfo Lite releases as IPv4, rebuilt daily; reverse DNS from our own IPv6 scans; and IPv6 blocklists (blocklist.de, Spamhaus DROPv6, Team Cymru fullbogons) plus iCloud Private Relay egress on the API. City-level IPv6 geolocation is coarser than IPv4. About 99% of IPv6 PTR names come from an ISP naming template (most encode the address itself) or are shared wildcards; we label them as such. VPN/proxy exit detection, trust scores, BGP routing data and hosted domains are IPv4-only.
• Mobile IPs — Mobile carrier IPs often geolocate to the carrier's gateway location, not the user's actual location.
• BGP visibility — Routing data only reflects what the RIPE RIS collectors can see. Prefixes announced solely within networks none of those collectors peer with may be missing, and propagation means a brand-new announcement can take minutes to appear.