How the lookup works
Five regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC) hand out IP addresses in blocks and keep a record of who holds each one. The tool asks the registry that holds your address, over RDAP, for the block, the organisation and the country it is registered in, and the abuse contact.
Separately, it asks RIPEstat, the RIPE NCC's public data service, which network announces the address on the internet: the autonomous system (AS) number and the routed prefix that BGP routers see. The registered owner and the network routing the address are often the same company, but not always: a hosting provider may route addresses its customer holds.
Reverse DNS is the name the network's operator set for the address (its PTR record), asked of Cloudflare's resolver. For a server it is often the provider's default name or the name the customer set; for a home connection it usually names the internet provider.
Example
Your server's log shows repeated SSH logins from 203.0.113.50. The lookup tells you which network routes it, the country it is registered in and the abuse address of its provider. Block the address in your firewall, and send the abuse contact the log lines with times in UTC.
Questions
How accurate is IP location?
This tool shows the country in the registry's record, which is where the organisation registered the block. It is a good guide for most addresses but not proof: one company can use its addresses in several countries, and VPNs and anycast networks answer from many places. Commercial geolocation databases estimate the city as well, and are often wrong at that level.
Can I find someone's home address from their IP?
No. The records show the internet provider the address belongs to, not the customer using it. Only the provider knows which customer had an address at a given time, and it gives that out only on a court order or a police request.
What is an ASN?
An autonomous system number identifies a network that decides its own routing on the internet, such as an internet provider, a hosting company or a large company. AS13335 is Cloudflare, for example. Every public address is announced by at least one AS, which you can look up here.
How do I report abuse from an IP address?
Send an email to the abuse contact shown above. Include the address, the exact times with time zone and the log lines that show what happened. Providers act on clear reports; a bare complaint without logs is usually ignored.
What is reverse DNS?
The opposite of a normal DNS lookup: a name for an address rather than an address for a name, stored as a PTR record. Mail servers check it before they accept mail, so a server that sends email needs a reverse DNS name that matches its hostname; the provider's control panel usually lets you set it.