RDPSchool is not a separate company or service. The brand has been retired and rdpschool.com now points here permanently.
Same team, same servers, same support — new name. Existing RDPSchool accounts, services and renewals continue exactly as before; only the name and the web address have changed.
Find out which network owns an IP address or domain, where it is roughly located, its reverse DNS name and who holds the block at the registry. Paste up to 100 addresses for a bulk report.
IP ADDRESS INTELLIGENCE
Lookups run on the VPSLake server and nothing you enter is saved. Network and location come from a database on our own server; the server only resolves domain names and asks public DNS and the regional registries about the address. Private and reserved addresses are explained without any lookup.
LOOKUP RESULT
Location is an estimate for the network block. Network data: iptoasn.com. IP Geolocation by DB-IP, licensed under CC BY 4.0. Database updated 2026-10-17. Registry owner via RDAP.
HOW TO USE IT
Works for a single suspicious IP from a log line or a whole list exported from your firewall.
Use Single for one IP or a domain name. Use Bulk to paste a list straight from last, fail2ban-client status, an access log or a firewall export.
The server matches each address against its routing and location database and asks public DNS for the reverse DNS name.
The AS name tells you whether traffic comes from a home ISP, a mobile operator, a cloud provider or a hosting company. Select the AS number to see every range that network announces.
Copy the table or download CSV, then block the prefix, report abuse to the registry contact, or allow-list a partner's network.
Network and AS number identify the autonomous system announcing the address in BGP, which is the company actually routing it. Prefix is the announced block it sits in. Reverse DNS is the PTR name the owner set; servers and mail hosts usually have a meaningful one.
Registered owner comes live from the regional internet registry (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC). When it differs from the network, the block is usually leased or sub-allocated.
Paste the top offenders from /var/log/auth.log, the Windows Security event log (event 4625) or your web server log. If most of them share one AS or one prefix, a single firewall rule for that range is cleaner than hundreds of single-IP bans.
Hosting and cloud networks rarely send human visitors, so a login page hammered from data-centre ranges is almost always automated.
Enter a hostname and the tool resolves its A and AAAA records the way a browser would, then shows the network behind each address. A site on Cloudflare or another CDN returns the CDN's edge addresses, not the origin server, so the network shown will be the CDN.
Country is right for the vast majority of addresses. City is an estimate based on where the provider registers or uses the block, so mobile and residential addresses can show a regional hub. Data-centre ranges are usually placed in the right city.
An IP address identifies a network, not a person. Shared addresses (carrier-grade NAT, VPN exits, corporate proxies) can put many innocent users behind one address, so test a block on a short timer before you make it permanent, and keep your own management address on an allow-list.
FREQUENTLY ASKED QUESTIONS