TL;DRNo single lookup tells you where an IP came from. Six checks measure different things — ASN ownership, IP-intelligence flags, rDNS, RDAP registration, static behavior across a reinstall, and exclusivity — and a provider can pass some while failing others. The one people skip most often is a positive control: query a known datacenter IP through the same tool to confirm the field you're reading is actually working.
Why an IP's provenance matters
An IP address carries a history you inherit. Where it was allocated from, who else has used it, and whether it stays yours all determine how services treat your traffic and whether your inbound access keeps working.
Two addresses can look identical in a speed test and behave completely differently in practice. The difference is provenance, and provenance is checkable — which is the point of this guide. You should not have to take any provider's word for it, including ours.
The six checks
- ASN and allocation. Look up the address on a BGP or whois service and see which autonomous system announces it. An address handed out by a consumer ISP sits inside that ISP's access ASN.
- IP-intelligence flags — with a positive control. Query an IP-intelligence service and read its hosting / proxy / mobile fields; then, in the same session, query a known datacenter address through the same tool. If the control also comes back clean, the field is not working and your result means nothing.
- rDNS / PTR. See whether the reverse record matches the pattern that ISP uses for that kind of line. Read this alongside checks 1 and 4 — never alone.
- RDAP registration. Check whether the block has been reassigned (SWIP'd) to a company. Registration shape tells you how the address was handed down, which is often more informative than the PTR string.
- Static behavior — reinstall, then look again. Reconnects and reboots are not enough. Reinstalling the OS is what separates 'stable so far' from 'configured and fixed'.
- Exclusivity. Ask, in writing, whether the address serves one instance at a time. A shared address and a dedicated one look identical in every lookup above; the difference only surfaces when something goes wrong.
How each check gets gamed
| Check | Common way around it | What catches it |
|---|---|---|
| ASN | A provider buys or leases its own block and announces it — technically not a datacenter, but never handed to a subscriber | Look at the neighbours in that block and who owns the ASN |
| Intelligence flags | A clean screenshot with no control, taken from a tool whose field was not populated | Run the positive control in the same session |
| rDNS | A generic or absent PTR that reveals nothing either way | Combine with ASN and RDAP; treat PTR as one signal, not a verdict |
| Static | 'It hasn't changed in months' — true right up until it does | Reinstall and check the address again |
| Exclusivity | Nothing in the lookups distinguishes shared from dedicated | Get it in writing, and ask what happens when the address is flagged |
Our own results, so you can check the same way
Measured 2026-08-08 on our own lines. We publish the method alongside the result so you can reproduce it rather than trust it.
- ASN: our lines sit in Spectrum / Charter's access ASN, AS33588, in Wyoming.
- Intelligence flags: our static blocks return hosting=false, proxy=false, mobile=false — and the positive control worked: a known datacenter address queried through the same interface returned hosting=true, proxy=true, and a well-known public resolver returned hosting=true.
- RDAP: our static blocks are not SWIP'd to any company — whois shows the carrier and a backbone block name, the same registration shape as the ISP's other access blocks.
- Static: the address delivered at provisioning is the address in the configuration, and it survives a reinstall — your existing key still logs in at the same place.
- Exclusivity: one customer per IP, stated in writing before you order.
A test worth running on any provider, including us
Record the address, reinstall the OS, and look again. On one of our own dynamic lines we ran exactly that: the pool record, the address actually delivered, and the addresses after the first and second reinstall were four different values, and the last one landed in a different subnet entirely — with the same hardware and the same MAC throughout.
That is why we treat statically configured lines as the product and describe dynamic ones honestly. 'I have never seen it change' is not evidence. One reinstall is.
When this level of checking is overkill
If your workload is short-lived, purely outbound, and nothing depends on the address staying put, none of this matters and you should buy on price.
It starts mattering when you host something reachable, when a partner allowlists your address, when outbound reputation affects delivery, or when re-establishing your setup after an address change would cost you real time.
Frequently Asked Questions
How do I check if an IP is really static?
Reinstall the operating system and check the address again. Reconnects and reboots can both keep an address that is not actually fixed; a reinstall is the point where a configured address and a merely stable one behave differently.
Why does an IP-intelligence lookup show my server as clean when it isn't?
Often because the field was not populated for that query. Always run a positive control: look up a known datacenter address through the same tool in the same session. If the control also comes back clean, your result is meaningless.
What does it mean if an IP block is not SWIP'd?
It means the block was not reassigned in the registry to a downstream company, so whois shows the carrier rather than an end customer. It tells you how the address was handed down, and is a useful signal alongside ASN — not a verdict on its own.
Can a lookup tell me whether an IP is shared?
No. A shared address and a dedicated one look the same in whois, RDAP, rDNS and intelligence databases. Exclusivity is a contractual fact, so get it in writing and ask what happens when an address is flagged.
Why do different IP reputation tools disagree with each other?
Because they score different things on different data, and some vendors are incentivised to flag broadly. Treat any single score as one opinion: run a positive control, compare at least two sources, and weight allocation facts (ASN, RDAP) above a numeric score.
What does it mean if Google or Cloudflare shows a CAPTCHA immediately?
Something in that address's recent history is being treated as suspicious. It is a fast, free signal worth checking, but it reflects reputation rather than provenance — a properly allocated address can still carry a bad history from a previous user.
Is there one command that checks all of these databases at once?
Yes. The open-source script xykt/IPQuality — bash <(curl -Ls https://IP.Check.Place) — queries IPinfo, ipregistry, ipapi, IP2Location, AbuseIPDB, Scamalytics, IPQS, DB-IP and Cloudflare and prints them side by side. The value is not just convenience: side by side, the disagreements become visible on their own.
Updated 2026-08-25 · Back to Guides · View plans →