ipkitten.com/about

What you get

Your public IP address, who routes it, and a kitten. From a terminal you get the address on its own line so it can go straight into a variable.

How the address is determined

It is simply the source address of your connection, as seen by the Cloudflare edge node that answered you. Nothing is inferred and nothing is looked up elsewhere.

How the carrier is determined

Two sources, both compiled into this site rather than queried at request time:

• iptoasn.com maps address ranges to autonomous system numbers.
• PeeringDB supplies the operator's own description of their network, so "Comcast is consumer broadband" is something Comcast stated rather than something we guessed.

Where an operator has not registered, the type is inferred from the network name and labelled likely. Roughly 86% of routed address space is classified; the rest is reported as unknown instead of guessed at.

The routed range

The same dataset that names the carrier also says which block of addresses your address sits in, so the page reports it. One caveat worth stating: the source aggregates adjacent ranges that share an origin AS, so what you see is the routed block as the dataset describes it, and it may cover more than one BGP announcement. Where a range is not a single aligned prefix, it is printed as a first-last pair rather than rounded to a prefix length that would be wrong.

Route origin

Every route on the internet is announced by some network, and there is no inherent reason to believe the one announcing yours is entitled to. The RPKI is the attempt to fix that: address holders publish signed statements — ROAs — naming the networks allowed to originate their prefixes. About a million of them exist. They are compiled into this site the same way the carrier data is, so the check costs no network call.

The page reports one of three things. Authorized origin means a ROA covering your address names the network we observe routing it. No ROA published means nobody has signed anything about that address, which is still true of about a third of routed IPv4 space. Origin not authorized means ROAs do cover your address and none of them mentions that network — worth looking into, though it is as often a ROA nobody updated after a renumbering as it is a hijack.

One limit, stated plainly: this is not full RFC 6811 route origin validation, and you will not see the word invalid anywhere. That verdict is about a specific BGP announcement and needs the length of the prefix as announced, to compare against each ROA's maximum. We never see an announcement — the range data is aggregated by origin AS — so inventing a prefix length to validate would produce confident nonsense. It did, when we tried: it called Amazon, Microsoft, Comcast and Verizon hijackers, and put an eighth of the internet in the invalid bucket against a real-world rate near a tenth of a percent. What is reported instead is only what the data supports: whether a ROA covers your address, and whether one of them names your network.

The one live lookup

Reverse DNS has to be asked in real time, because a PTR record is whatever the address owner publishes right now. That query goes to Cloudflare's resolver, is capped at 400 ms, and is dropped silently if it is slow. Everything else on the page is answered from memory.

The links off this page

The AS number, the routed prefix, and the row under the table link out to places that hold the live view: bgp.tools for what a network announces, rdap.org for the registry record — it follows the IANA bootstrap, so an ARIN address lands at ARIN and an APNIC one at APNIC — RIPEstat for routing history, and PeeringDB for an operator's own description of itself. What is on this page is a snapshot compiled when the site was last deployed; those are current to the minute.

They are links and nothing more. Nothing is fetched, preloaded, or pre-connected, so the promise above still holds exactly as written: no request leaves this page until you decide to make one. And when you do, this site sends Referrer-Policy: no-referrer and every link carries rel="noreferrer", so wherever you land is not told where you came from — which matters, because on a lookup page the address you were curious about is in the URL.

What this site does not do

• No third-party requests. No fonts, analytics, ad networks, or image APIs.
• No cookies and no local storage. That is also why the light/dark switch in the corner forgets your choice when you reload — remembering it would mean storing something about you, so it does not. It is three radio buttons and one CSS rule, and auto follows whatever your system already asks for.
• No logging of addresses. Responses are marked no-store so no cache holds one visitor's answer and shows it to another.
• No HSTS, on purpose — so http://ipkitten.com keeps working on port 80 in plaintext, which is the whole party trick.

Why port 80 matters

A plaintext response means curl ipkitten.com works with no redirect, no TLS handshake, and no flags — on a busybox shell, a router, or a rescue image that has no CA bundle. HTTPS still works and is still what browsers get; it is simply not forced.