01BGP, the Internet's road map
The Internet is not one network but an assembly of tens of thousands of independent networks, the autonomous systems (ASes): your ISP, Google, the local university. The BGP protocol is the language each one uses to tell the others “the addresses of this prefix live with me”. Every packet follows these announcements — knowing who announces an IP means knowing who actually controls it.
This tool queries the RIPE NCC's RIPEstat data live, fed by the RIS collectors that listen to BGP announcements around the world. For the holder's administrative identity (contacts, exact range), complete with our IP/AS whois; for name resolution, the DNS lookup.
02Understanding each field
- AS
- Autonomous system: a network under a single administration, identified by a number (AS13335 = Cloudflare). More than 100,000 are active.
- Prefix
- The address block announced in BGP (e.g. 1.1.1.0/24). Routing always picks the most specific prefix containing the address.
- Origin AS
- The AS emitting the prefix announcement — the one actually hosting the addresses, not to be confused with the transit ASes propagating it.
- RPKI
- The routing public key infrastructure: holders publish ROAs there, signed authorizations saying “this prefix may only be announced by this AS”.
- ROA
- Route Origin Authorization: the signed object that makes an announcement verifiable. Valid, invalid or absent (unknown) — more and more operators drop invalid announcements.
- MOAS
- Multiple Origin AS: a prefix announced by several ASes at once. Legitimate for anycast, suspicious otherwise (leak or hijack).
03From the command line
The same URL as this page answers in plain text for curl:
$ curl "its-my-ip.com/bgp?q=1.1.1.1" resource: 1.1.1.1 prefix: 1.1.1.0/24 announced: yes origin: AS13335 (CLOUDFLARENET) rpki: valid
04Frequently asked questions
Why would I want to know who announces an IP address?
To identify the network actually responsible for an address: where does this suspicious traffic come from, who hosts this service, is my prefix properly announced by my operator? Whois gives the administrative holder; BGP gives the operational reality of routing, which can differ — and that gap is precisely what is interesting.
What does an RPKI “invalid” result mean?
That the observed announcement contradicts the authorization published by the holder: wrong origin AS, or a prefix more specific than the allowed maximum length. Two explanations: an ongoing BGP hijack, or — far more often — a ROA left misconfigured after an operator change. Either way, part of the Internet drops that announcement.
What is a BGP hijack, concretely?
An AS announces a prefix it does not own, by misconfiguration or malice, and attracts the traffic meant for the legitimate holder. Famous incidents have diverted YouTube (Pakistan Telecom, 2008) or cryptocurrency traffic. RPKI was created precisely to make such announcements automatically droppable.
Why does my IP address belong to no announced prefix?
Either it is a private or reserved address (192.168.x.x, 10.x.x.x, documentation ranges), which is not meant to be routed on the public Internet; or the block was allocated but its holder is not currently announcing it. A genuinely used public IP is necessarily covered by a BGP announcement.
Where does the displayed data come from?
From RIPEstat, the RIPE NCC's open data service (the regional Internet registry for Europe). Its RIS collectors maintain BGP sessions with hundreds of operators worldwide and observe routing tables in near real time. The data covers the whole Internet, not just the RIPE region.