Frequently Asked Questions

What is ipconfig.sh?

ipconfig.sh is a free collection of online network tools built for system administrators, network engineers, and security professionals. It provides quick access to essential utilities like DNS lookups, WHOIS queries, subnet calculations, traceroutes, threat intelligence scanning, and internet speed testing - all from your browser or the command line.

Simply visit ipconfig.sh to see your public IP address and access all tools instantly.

Yet-another-ip-lookup-site, but why? Some history.

The project started in 2018 as a small hacky tool at the 35th Chaos Communication Congress in Leipzig, Germany, at the Luxeria Assembly. I wanted a simple tool to calculate subnets and utilize standard Linux networking toolsets on arbitrary systems - namely Windows or mobile devices - without complicated remoting.

It initially was a very small PHP script running on a sandboxed server, and admittedly quite vulnerable. Some high-risk features were disabled over time due to abuse.

In 2025, development of a complete reboot was started. Modern Python tooling allowed a fairly easy transition to a more robust and feature-rich Quart application. The reboot was released in the beginning of 2026, bringing all the tools you see today.

Who is running ipconfig.sh?

The service ipconfig.sh is hosted, maintained, and developed by Wyna Informatik GmbH - a Swiss IT company specializing in network and cloud technologies. We use tools like this every day in our own work, and we're happy to share them with the community.

The source code is also maintained by our team. If you have feedback, ideas, or run into issues, don't hesitate to reach out!

What is my IP address?

When you visit ipconfig.sh, your public IP address is displayed immediately at the top of the page. This is the IP address that websites and services see when you connect to them. It may differ from your local/private IP if you are behind a NAT router or VPN.

For CLI users, simply run curl ipconfig.sh to get your public IP as plain text.

How does ipconfig.sh determine my hostname and provider?

Your hostname is resolved via a PTR (reverse DNS) lookup on your IP address. This queries the DNS system for the domain name associated with your IP. Not all IPs have a PTR record, so this field may be empty.

Your internet provider is determined via a WHOIS lookup on your IP, which returns the organization that owns the IP address block. If the WHOIS data doesn't include an AS number, we fall back to BGP routing data from Team Cymru's IP-to-ASN service.

What is the Subnet Calculator?

The subnet calculator helps you plan and verify IP address allocations. Enter any IPv4 or IPv6 address with a prefix length (e.g., 192.168.1.0/24) and it will show you:

  • Network and broadcast addresses
  • Usable host range and count
  • Subnet mask in dotted-decimal notation
  • Binary representation of the network

It supports both IPv4 and IPv6, and you can also access it via CLI: curl ipconfig.sh/calc/192.168.1.0/24

How does the DNS Lookup tool work?

The DNS lookup tool queries DNS servers for records associated with a domain name or IP address. It supports all standard record types including A, AAAA, MX, NS, TXT, SOA, CNAME, SRV, and PTR.

Special features include:

  • Multiple resolvers - query different DNS providers (Cloudflare, Google, Quad9, etc.) simultaneously to compare results
  • DMARC & SPF analysis - automatically follows SPF include chains and checks DMARC records
  • Subdomain enumeration - scans common subdomains (www, mail, ftp, api, etc.) for A/AAAA records
  • Reverse DNS - enter an IP address to get its PTR hostname

Results stream in real-time as each query completes.

How does the WHOIS Lookup tool work?

The WHOIS tool queries the WHOIS protocol to retrieve registration information for domain names and IP addresses. This includes:

  • Domain registrar and registration dates
  • IP address block owner and organization
  • AS number (ASN) and route information
  • Abuse contact details

The raw WHOIS output is displayed as-is from the authoritative registry (ARIN, RIPE, APNIC, LACNIC, or AfriNIC for IP addresses).

How does the Traceroute tool work?

The traceroute tool maps the network path from our server to any destination host. It sends packets with incrementally increasing TTL (Time to Live) values to discover each router hop along the path.

For each hop, you'll see the router's IP address, hostname (if available), and round-trip time. This helps diagnose network latency, routing issues, and connectivity problems.

Results stream in real-time as each hop responds.

What is the Threat Intelligence Scanner?

The threat intelligence scanner checks IP addresses, domains, and URLs against multiple threat intelligence databases to determine if they are associated with malicious activity. It aggregates data from sources like:

  • Abuse.ch (ThreatFox, URLhaus, Feodo Tracker)
  • Spamhaus (DROP, EDROP, SBL)
  • Other community-maintained blocklists

Results include a threat level score, source categories (malware, phishing, spam, botnet), and detailed match information. It also performs DNS cross-referencing - PTR hostnames are checked against domain threat lists, and domain A records are checked against IP threat lists.

CLI usage: curl ipconfig.sh/scan/example.com

How does the Speed Test work?

The speed test measures your internet connection performance in three phases:

  1. Latency (RTT) - measures round-trip time to our server using WebSocket ping/pong
  2. Download - transfers random data from our server to your browser and measures throughput
  3. Upload - transfers random data from your browser to our server and measures throughput

All measurements happen directly between your browser and our server with no third-party involvement. Results are stored anonymously for aggregate statistics.

Is ipconfig.sh free to use?

Yes, ipconfig.sh is completely free to use. There are no accounts, no ads, and no tracking. Rate limiting is applied to prevent abuse, but normal usage is not affected.

Can I use ipconfig.sh from the command line?

Yes! ipconfig.sh detects CLI clients (curl, wget, HTTPie, etc.) and returns plain-text responses:

curl ipconfig.sh                   # Your public IP
curl ipconfig.sh/ptr               # Your PTR hostname
curl ipconfig.sh/whoami            # Your IP, hostname, provider, ASN
curl ipconfig.sh/calc/10.0.0.0/24  # Subnet calculation
curl ipconfig.sh/scan/8.8.8.8      # Threat intelligence lookup

JSON output is available by appending ?fmt=json to most endpoints.

Am I allowed to use this in my script or monitoring?

Yes! You are welcome to use ipconfig.sh in your scripts, cron jobs, or monitoring setups. A few recommendations:

  • Respect rate limits. Keep automated requests reasonable - a check every few minutes is fine, every few seconds is not. If you get a 429 response, back off and retry later.
  • Set a descriptive User-Agent. Something like my-monitoring-script/1.0 helps us distinguish legitimate automation from abuse.
  • Cache results where possible. Your public IP doesn't change every second - caching for a minute or two saves resources on both ends.
  • Use the plain-text or JSON endpoints. They return minimal data and are designed for programmatic use (e.g. curl ipconfig.sh or curl ipconfig.sh/?fmt=json).

Disclaimer: ipconfig.sh is provided as-is on a best-effort basis. There is no guarantee of uptime, availability, or response format stability. While we have no plans to change the existing API, endpoints and output formats may change without notice. Do not build critical infrastructure that depends solely on this service without a fallback.

Is IPv6 supported?

Partially. The server is currently only available over IPv4 until it moves to a new site, so IPv6-based IP detection and IPv6-only requests won't work yet.

That said, everything under the hood is IPv6-ready. All tools - DNS lookups, WHOIS, subnet calculations, traceroutes, and threat intelligence - already fully support IPv6 addresses. Once the server gains a v6 address, full dual-stack support will be available.

Privacy

ipconfig.sh is designed with minimal data collection in mind.

What is logged:

  • Your IP address, browser type, and OS are recorded when you visit the site. This data is used for rate limiting and basic usage statistics. It is not shared with anyone.
  • PTR hostnames and WHOIS-derived provider information are cached locally to avoid repeated external lookups. This cache is per-IP and not linked to any user identity.
  • Speed test results are stored anonymously for aggregate statistics.

What is NOT logged:

  • No cookies are used for tracking.
  • No analytics scripts, no ads, no third-party trackers.
  • DNS queries, WHOIS queries, traceroute targets, and threat intelligence lookups you perform are not stored or associated with your IP.

Third-party services:

  • DNS lookups are forwarded to the resolver you select (or the server default, typically Cloudflare 1.1.1.1). The resolver sees the queried domain.
  • WHOIS lookups contact the relevant regional registry (ARIN, RIPE, APNIC, LACNIC, or AfriNIC). They see the queried IP or domain.
  • If WHOIS returns no ASN, a fallback query is made to Team Cymru's IP-to-ASN DNS service.
  • GeoIP data is sourced from locally stored databases - no external request is made for country lookups.

No data is sold, shared, or transmitted to any other third party.