Security analysts & SOC teams
Investigate an unfamiliar IP or request in your logs, before deciding what to do about it
AdminKit's free lookups let a security analyst turn an unfamiliar IP address into a hostname and a registration record, and a suspicious request into a parsed User-Agent string, today, since an address or request on its own is just numbers and characters until something explains what it claims to be, with no account, paid threat-intel seat, or bulk API needed for a single lookup.
Updated October 30, 2026
At a glance
The problem
A security analyst or SOC team triaging server, firewall, or access logs runs into the same small problem constantly: an IP address, or a User-Agent string on a request, is just a sequence of numbers or characters with no inherent meaning until something explains what it actually is. Pulling that context one address at a time from a paid threat-intel platform, or by hand with command-line tools not everyone on a team has set up consistently, slows down triage that’s often time-sensitive.
The deeper issue is that no single lookup is conclusive on its own. A reverse DNS (PTR) record is set by whoever controls the address block and isn’t verified against anything, so a hostname that looks official is a claim, not a certified fact. A WHOIS/RDAP registration answers a different question (who the address block belongs to) than reverse DNS does (what hostname its operator chose to publish), and a User-Agent string can be set to anything the client wants it to say. Treating any one of these as a verdict, rather than one input to weigh against the others, is a common way triage goes wrong.
None of this requires a paid seat to get started: each of these is a public lookup, and the practical skill is mostly in knowing which two or three to pair together and what weight to give each one, not in having exclusive access to the data.
Talk to an expert
Huy Nguyen (David), Founder & CEO, Netbase JSC
Ask how AdminKit fits security analysts & soc teams — setup, timeline, or pricing.
What you can do for free today
- Resolve an IP to its PTR hostname — often the fastest first clue about an unfamiliar address in a log; see how to read a reverse DNS (PTR) lookup result.
- Look up registration details for an IP or domain — see which organization and network it’s actually registered to, via RDAP; see how to read a WHOIS/RDAP lookup result and finding the right abuse contact in a WHOIS/RDAP result.
- Look up a hostname’s own DNS records — use this to confirm forward-confirmed reverse DNS (FCrDNS): does the hostname a PTR lookup returned resolve back to the same IP?
- Check and parse a request’s User-Agent string — see what a client’s browser, engine, OS and device type claim to be, parsed in your own browser; see what a User-Agent string actually reveals.
For the full triage sequence these four fit into, see using reverse DNS to investigate an unfamiliar IP in your logs, which walks through pairing a PTR lookup, FCrDNS, and a WHOIS/RDAP lookup before weighing them against what the traffic is actually doing. See also how AdminKit’s lookups compare to other IP lookup tools.
What AdminKit will add
There’s no dedicated roadmap item today for running these lookups in bulk across a log file. AdminKit’s Check API is in early access and development, but as planned it covers DNS, mail authentication, DNSBL, TLS, port, MQTT and Modbus checks — not WHOIS/RDAP or reverse DNS. That means even once the Check API ships, the lookups on this page are likely to stay one-at-a-time through the website rather than something you can script across many log lines at once.
The honest, practical path today is the same one security teams already use: run reverse DNS and WHOIS/RDAP on an address as the first two steps of triage, add a User-Agent check if the investigation involves a web request, and weigh all of it against what the traffic is actually doing — none of these lookups, alone or combined, is a verdict on their own.
This page is general guidance, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.
Frequently asked questions
I see an unfamiliar IP repeatedly hitting a server — what should I check first?
A reverse DNS (PTR) lookup, to see if it resolves to a hostname and what that hostname claims to be. Follow it with a WHOIS/RDAP lookup on the same address to see which organization and network it's actually registered to, since the two answer different questions and can disagree.
Can I trust a hostname that claims to belong to a well-known company?
Not from the PTR record alone — anyone who controls an address block can set its PTR record to any hostname. Forward-confirmed reverse DNS (look up that hostname with the DNS lookup tool and check its own record resolves back to the same IP) adds confidence; it isn't proof the way a signed certificate is, but it catches a claimed hostname that doesn't check out.
Does a missing PTR record mean the IP is suspicious?
No. A missing reverse DNS record is extremely common, especially on residential and some cloud ranges, and tells you very little by itself. It's a reason to move to a WHOIS/RDAP lookup on the same address, not a signal of malicious intent on its own.
Can I trust a request's User-Agent string?
No — any client can send an arbitrary User-Agent value, so it's a hint, not a verified fact. The user-agent tool parses the string into browser, engine, OS and device fields entirely in your own browser, which is useful for understanding what a client claims to be, not for proving it.
Can AdminKit look up many IPs from a log file at once?
No, not today. Each lookup runs one at a time through the website. AdminKit's planned Check API covers DNS, mail, TLS, port and a few other checks, but it doesn't cover WHOIS/RDAP or reverse DNS, so even once that API ships, these particular lookups are likely to stay one-at-a-time through the website rather than scriptable in bulk.
Related
- Reverse DNS (PTR)
- Whois / RDAP
- DNS lookup
- User agent
- /guides/using-reverse-dns-to-investigate-an-unfamiliar-ip-in-your-logs/
- /guides/reading-a-whois-rdap-result-to-find-an-abuse-contact/
- /guides/how-to-read-a-reverse-dns-ptr-lookup-result/
- /guides/how-to-read-a-whois-rdap-lookup-result/
- /guides/what-a-user-agent-string-reveals/
- /glossary/forward-confirmed-reverse-dns/
- /compare/vs-ip-lookup-tools/
Want AdminKit set up for you?
Tell us about your setup — we will follow up about early access and, if you need it, expert help.
How AdminKit works with you
- Delivered remotely — Netbase JSC, the company behind AdminKit, has worked with clients in 80 countries.
- Contracts and invoices are issued by Netbase JSC; payment goes to the company by bank transfer to Netbase JSC's company account or PayPal Business.
- Talk to the CEO, Huy Nguyen (David), directly on WhatsApp or by email at [email protected].