How to investigate an IP address

Start with DNS

Confirm which address the hostname currently uses

1. Look up the domain’s A record for IPv4 and AAAA record for IPv6.
2. Check the root and www hostnames separately; they may use different routes.
3. Repeat against more than one public resolver if a recent DNS change is involved.
4. Record the time, hostname and returned address so the result can be reproduced.

Network registration

Use RDAP to identify the allocated network

RDAP queries the Regional Internet Registry responsible for the address range. It can show the network block, organisation or service provider, registration dates, ASN references and abuse contact information.

The registered network organisation may be the data-centre or connectivity provider rather than the website owner.

Reverse DNS

Check the PTR hostname

A reverse lookup asks which hostname the IP owner has assigned to the address. It can reveal a server or mail hostname, but it is optional and does not list every domain hosted there.

No PTR result

This is not proof that the address is unused; reverse DNS may simply be unconfigured.

Generic provider hostname

The server may be part of shared or cloud infrastructure.

Mail hostname

For email diagnosis, also confirm forward DNS, SPF, DKIM and sending reputation.

Unexpected hostname

Check for a CDN, proxy, old DNS cache or recently reassigned address before escalating.

Interpret carefully

Know what a lookup cannot prove

• Geolocation databases do not provide a guaranteed physical server or visitor location.
• A list of “domains on this IP” is often incomplete and may include stale data.
• Shared IP use is not, by itself, an SEO problem.
• Registry ownership does not identify the person who controls a particular website.
• An IP address alone is not enough evidence to block a visitor or accuse a party of abuse.

Useful investigations

Use IP data to answer a specific question

Website points to wrong server

Compare current DNS with the server address supplied by the host.

Migration validation

Check root, www, mail and any important subdomains before and after the switch.

Connectivity incident

Combine DNS results with timestamps, traceroute and server logs.

Abuse report

Use the RIR abuse contact and include precise UTC timestamps and log evidence.

Email delivery

Check the actual sending IP, PTR, authentication records and provider logs.

SEO review

Focus on crawlability, performance, content and canonical URLs rather than shared-IP assumptions.