Datacenter IP check: how to tell if an IP is a datacenter IP

Step 1: what does an RDAP lookup show?

An RDAP lookup shows the registry record of the address block: its range, its name, the organization that holds it and that organization's country. RDAP is the JSON successor to WHOIS, defined in RFC 9082 (queries) and RFC 9083 (responses).

Open https://rdap.org/ip/203.0.113.10 in a browser, with your own IP in place of the documentation address. rdap.org forwards the query to the right registry: ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC. Read three fields:

• name and the registrant entity: a hosting, cloud or colocation company points to a datacenter IP.
• startAddress and endAddress: the size of the block.
• country: the holder's country. It is not proof of where the server stands, and some records leave it out.

The registry record can name a different company from the one that routes the IP. On 19 October 2026, 1.1.1.1 was registered to APNIC Research and Development (country AU) but announced by Cloudflare's AS13335. That is why step 2 matters.

Step 2: how do I find the ASN and the network type?

Ask a routing database which ASN announces the IP, then look that ASN up in PeeringDB. Both have free JSON APIs without keys:

• RIPEstat: https://stat.ripe.net/data/network-info/data.json?resource=<ip> returns the announced prefix and the ASN.
• PeeringDB: https://www.peeringdb.com/api/net?asn=<asn> returns the network's name and its info_types.

A network type of "NSP" (network service provider) or "Content" with a hosting company name means a datacenter IP. "Cable/DSL/ISP" means a consumer provider. Not every network has a PeeringDB record; when it is missing, search the ASN name: hosting companies say what they sell on their own websites.

Step 3: what does reverse DNS add?

Reverse DNS returns the hostname that the IP's network attached to the address, and hosting networks often use names that say "server", "vps", "static" or "dedicated". Run dig -x 203.0.113.10 +short or nslookup 203.0.113.10, with a real address.

Treat the answer as a hint. A missing PTR record proves nothing, and the network operator can write any name it likes. Residential providers often encode the customer's line type or town in the name, which is the opposite pattern.

Step 4: what do "hosting" flags in IP databases mean?

A "hosting" flag means the database has classified the IP's network as a datacenter, cloud or transit provider rather than a home or mobile provider. Databases build that label from the same public data you just read: registry records, ASN ownership and network type, plus their own measurements.

Two cautions. First, databases disagree: one can say "hosting" while another says "business". Second, the flag describes the network, not the person using it. A datacenter proxy is labelled hosting because it is hosted. RackProxies does not sell IPs that pretend otherwise. Datacenter IPs are registered to hosting networks, not to home internet providers. IP geolocation databases can place the same IP in a different city, or even a different country, from the datacenter that announces it. The geolocation guide explains why the city can also differ.

Can I run the whole check from a script?

Yes. The Python script below uses only the standard library (urllib, json, socket). It queries rdap.org, RIPEstat and PeeringDB, none of which needs a key. Save it as ip_check.py and run python ip_check.py 1.1.1.1.

"""Who holds this IP? Public, keyless sources only: RDAP, RIPEstat, PeeringDB."""
import json
import socket
import sys
import urllib.request

HEADERS = {'Accept': 'application/json', 'User-Agent': 'datacenter-ip-check/1.0'}


def get_json(url):
    request = urllib.request.Request(url, headers=HEADERS)
    with urllib.request.urlopen(request, timeout=20) as response:
        return json.load(response)


def vcard_name(entity):
    # RDAP contacts are jCards: ['vcard', [['fn', {}, 'text', 'Name'], ...]]
    for field in entity.get('vcardArray', ['vcard', []])[1]:
        if field[0] == 'fn':
            return field[3]
    return ''


def check_ip(ip):
    rdap = get_json('https://rdap.org/ip/' + ip)
    print('Network name :', rdap.get('name'))
    print('Range        :', rdap.get('startAddress'), '-', rdap.get('endAddress'))
    print('Country      :', rdap.get('country', 'not given'))
    for entity in rdap.get('entities', []):
        if 'registrant' in entity.get('roles', []):
            print('Holder       :', vcard_name(entity))

    try:
        print('Reverse DNS  :', socket.gethostbyaddr(ip)[0])
    except OSError:
        print('Reverse DNS  : none')

    info = get_json('https://stat.ripe.net/data/network-info/data.json?resource=' + ip)['data']
    print('BGP prefix   :', info.get('prefix') or 'not announced')
    for asn in info.get('asns', []):
        nets = get_json('https://www.peeringdb.com/api/net?asn=' + asn)['data']
        kind = ', '.join(nets[0].get('info_types') or []) if nets else 'no PeeringDB record'
        print('ASN          : AS' + asn, '-', nets[0]['name'] if nets else '', '-', kind)


if __name__ == '__main__':
    check_ip(sys.argv[1] if len(sys.argv) > 1 else '1.1.1.1')

Network name : APNIC-LABS
Range        : 1.1.1.0 - 1.1.1.255
Country      : AU
Holder       : APNIC Research and Development
Reverse DNS  : one.one.one.one
BGP prefix   : 1.1.1.0/24
ASN          : AS13335 - Cloudflare - Content