Who is behind an IP address?

Enter any IPv4 or IPv6 address. In milliseconds, Bafir shows the organisation, ASN, country and network type: home broadband, mobile operator, data centre, CDN, education or government.

Examples:

Source data, refreshed every night

Every night the database is rebuilt automatically from all five Regional Internet Registries and the global BGP routing table, then swapped in with zero downtime.

10.3 MIPv4 and IPv6 ranges

5regional registries

580kBGP prefixes

~1 msquery time

Last database update: 21 Oct 2026, 03:13 UTC

Who Bafir is for

Every online service sees a visitor's IP address, but not who is behind it. The network type reveals the difference between a real user and automated traffic.

E-commerce and payments

Spot risky orders: a customer on home or mobile internet, or someone coming through a rented server.

Advertising and analytics

Filter out bot clicks from data centres and see which organisations visit your website.

Security and IT

Automatically enrich logs and alerts with network ownership data instead of manual whois lookups.

Network types

Every range carries one of these standard labels.

ISPFixed-line ISP

MOBMobile operator

ISP/MOBFixed and mobile operator

DCHData centre / hosting

CDNContent delivery network

COMCommercial network

UNKUnknown network

EDUEducation and research

GOVGovernment

MILMilitary

SESSearch engine / crawler

AICAI crawler

ORGNon-profit organisation

RSVReserved range

Simple API

One HTTP request, a JSON response. Suited to online shops, payment systems, SIEM and your own applications.

# Request
curl "https://bafir.lukahorvatic.com/api.php?ip=93.136.10.1&lang=en"

# With an API key (higher limits, usage tracking)
curl -H "X-API-Key: bfr_…" "https://bafir.lukahorvatic.com/api.php?ip=93.136.10.1"

# Response (shortened)
{
  "ip": "93.136.10.1",
  "organizacija": "Hrvatski Telekom d.d.",
  "asn": 5391,
  "drzava": { "kod": "HR", "naziv": "Croatia" },
  "tip": { "kod": "ISP", "naziv": "Fixed-line ISP", "procjena_rizika": "nizak" },
  "izvor_tipa": { "vrsta": "registar", "pruzatelj": null },
  "anonimizator": null,
  "poslovni_korisnik": false,
  "trajanje_ms": 1.3
}

Without a key, the demo allows 60 requests per minute and 1000 per day per IP address.