# IPmap.info

> Free, server-rendered IP address geolocation tool: detects the visitor's public IP
> address, shows its country, city, network (ASN and organisation) and coordinates on a
> world map, and lets users look up any IPv4/IPv6 address, with reverse DNS, WHOIS,
> Tor exit-node and blocklist status. Available in English, Turkish, Spanish, Russian,
> Hindi and Chinese.

## Main pages

- [Home](https://ipmap.info/): shows the visitor's own IP address, location and map
- [About](https://ipmap.info/about.htm): what the site does and how it works
- [Contact](https://ipmap.info/contact.htm): data corrections, abuse reports, privacy and advertising enquiries
- [Terms](https://ipmap.info/terms.htm): acceptable use, accuracy limits and data sources
- [Daily IP puzzle](https://ipmap.info/puzzle.htm): guess the country of one address a day
- [Email alerts](https://ipmap.info/alerts.htm): watch an address or domain and get one plain-text mail when it changes (double opt-in, one-click stop)
- [Daily network puzzle](https://ipmap.info/provider.htm): guess which operator announces the day's address
- [Network tools](https://ipmap.info/tools.htm): the index of every lookup below
- [Games](https://ipmap.info/games.htm): the index of every network game — daily puzzles, routing, subnetting, address notation
- [DNS records](https://ipmap.info/dns-records.htm): A, AAAA, CNAME, MX, NS, TXT, CAA plus SPF and DMARC for any domain
- [HTTP status and security headers](https://ipmap.info/http-headers.htm): redirect chain and HSTS/CSP/X-Frame-Options for any site
- [TLS certificate](https://ipmap.info/tls-certificate.htm): the certificate a server presents, issuer, validity, names, hostname match
- [IP geolocation API](https://ipmap.info/api.htm): the read-only JSON API. Not public: a Google ID token is required (see below)
- [Embeddable badge](https://ipmap.info/badge.htm): an SVG IP badge for your own site
- [AdSense & analytics checker](https://ipmap.info/checker.htm): the ad and tracking code a site loads, its ads.txt and robots.txt (URL pattern /checker.htm?url={site})
- [Cloudflare bot check](https://ipmap.info/botcheck.htm): whether Cloudflare challenges, blocks or passes a plain no-JavaScript request to a site — the honest way to test Bot Fight Mode (URL pattern /botcheck.htm?url={site})
- [Why is my location wrong?](https://ipmap.info/accuracy.htm): how we place an address, why a geolocation can be off, and how to report a wrong one
- [IP Duel](https://ipmap.info/duel.htm): compare any two addresses side by side (URL pattern /duel.htm?ip1={a}&ip2={b})
- [Connection card](https://ipmap.info/card.htm): your own connection as a shareable card and PNG
- [Watchlist](https://ipmap.info/watchlist.htm): keep addresses in the browser and see what changed
- [Route globe](https://ipmap.info/route.htm): the measured traceroute from the server to any address, drawn on a globe (URL pattern /route.htm?ip={address})
- [Internet time machine](https://ipmap.info/history.htm): the earliest and latest Internet Archive captures of a domain (URL pattern /history.htm?name={domain})
- [IP passport](https://ipmap.info/passport.htm): a stamp for every country you look up, kept in the browser
- [What sites see](https://ipmap.info/visibility.htm): the facts a request carries and what they do and do not reveal, with no fingerprinting
- [Example IP lookup](https://ipmap.info/ip/8.8.8.8.html): geolocation, reverse DNS, WHOIS, ASN, organisation and blocklist status for any address (URL pattern /ip/{address}.html)
- [Country index](https://ipmap.info/country/US.htm): addresses we cover by country (URL pattern /country/{cc}.htm)
- [Network index](https://ipmap.info/asn/15169.htm): addresses by AS number and operator (URL pattern /asn/{asn}.htm)
- [IPv4 blocks by country](https://ipmap.info/cidr/): every country's allocated and assigned IPv4 space as a minimal CIDR list, from the five RIRs (one plain-text file per country at /cidr/{cc}.txt; registry allocation data, not who uses an address today)
- [Address of the day](https://ipmap.info/today.htm): one notable address or prefix a day with the story behind it and its source (URL pattern /today.htm?d={day})
- [Public or Reserved?](https://ipmap.info/reserved.htm): a daily puzzle on whether an address is routable on the public internet or reserved by an RFC, answered from the IANA special-purpose address registry
- [Longest Prefix Match](https://ipmap.info/prefix.htm): a daily routing puzzle — given a routing table and one address, which line does the router use
- [Same Address?](https://ipmap.info/notation.htm): a daily puzzle on two spellings of one address (octal, hexadecimal, short forms) and whether they mean the same host
- [Odd One Out](https://ipmap.info/oddballs.htm): a share-first puzzle — eight IP addresses, seven of them real and routable, one reserved by an RFC and impossible on the public internet; fourteen grids in sixty seconds, and the grid is the picture that gets posted

## Machine endpoints (GET)

All return JSON. The badge is public and needs no key; the JSON API is not public and requires a
Google ID token (see below).

- https://ipmap.info/api/v1/8.8.8.8: geolocation for an address or domain — country, region,
  city, postal code, continent, latitude/longitude, and the ASN, organisation and reverse DNS
  when already known. Cached 5 minutes, rate limited to 60 requests per minute per client.
  NOT PUBLIC: requires `Authorization: Bearer <Google ID token>` — a JWT signed by Google whose
  audience is our OAuth client ID and whose account is on the allowlist. Anything else is 401.
  Documentation: https://ipmap.info/api.htm
  Geolocation is the DB-IP city lite database (CC BY 4.0) — keep the attribution.
- https://ipmap.info/badge.svg: an SVG badge for the requesting address
- https://ipmap.info/badge/8.8.8.8.svg: an SVG badge for any address (embed with
  `<img src="https://ipmap.info/badge/8.8.8.8.svg">`)
- https://ipmap.info/ip: the requesting address as plain text, with a trailing newline, for a
  shell pipeline (`curl ipmap.info/ip`). Caller's own address only — there is no parameter to
  look up anyone else, by design. Sent `cache-control: private, no-store`.
- https://ipmap.info/ip.json: the requesting address plus the country, country code and city we
  already hold for it — geo only, never ASN or reverse DNS (that data needs a Google ID token at
  /api/v1/). Caller's own address only. `cache-control: private, no-store`.
- https://ipmap.info/cidr/us.txt: one country's minimal IPv4 CIDR list, one prefix per line.
- https://ipmap.info/hostname.htm?ip=8.8.8.8: reverse DNS hostname for an IP
- https://ipmap.info/whois.htm?ip=8.8.8.8: whois record text for an IP
- https://ipmap.info/netinfo.htm?ip=8.8.8.8: ASN, organisation, abuse contact, Tor exit-node
  and blocklist status in one call
- https://ipmap.info/wayback.htm?name=example.com: earliest and latest Internet Archive
  captures of a domain, with links
- https://ipmap.info/dns.htm?name=example.com: DNS records (A, AAAA, CNAME, MX, NS, TXT, SOA,
  CAA, PTR) plus the SPF and DMARC policy
- https://ipmap.info/http.htm?name=example.com: HTTP and HTTPS status, redirect chain and
  security headers
- https://ipmap.info/tls.htm?name=example.com&port=443: the TLS certificate the server
  presents — protocol, cipher, ALPN, subject, issuer, validity, days left, names, hostname
  match, self-signed status. The chain is not validated, on purpose

The aux endpoints (`hostname`, `whois`, `netinfo`, `dns`, `http`, `tls`, `wayback`) require a same-site referer
and the current build token, and are limited to 20 requests per minute per client; they exist
for the site's own pages. `/api/v1/` is not open to automated use: it needs a Google ID token.