An IPinfo lookup will occasionally return a response with no enrichment fields. This is intentional, and it reflects how we determine whether an IP address is currently in use.
How we determine current ownership
Two signals work together to tell us whether an address is in active use and who is operating it.
Company data extracted from the WHOIS records tells us whether an address space has been assigned at the registry level and to which organization it is registered. This is the primary signal for whether an IP is allocated at all.
BGP tells us which network is currently routing traffic for a prefix. It is observed in real time and links an IP to an ASN.
When the response is empty
A lookup will return no enrichment data in two situations:
1. The IP address is unallocated
The address has not been assigned to any organization at the registry level. With no company data and no active routing to draw from, the response is empty.
2. The IP address is allocated but not currently routed
The address sits inside a valid allocation, but the covering prefix is not being announced in BGP at the time of the lookup. Without an active announcement, we do not have a current operator to attribute the address to, and the response is empty.
In both cases, an empty response is a deliberate signal that there is nothing reliable to enrich at this moment. We prefer this over returning stale or inferred data.
If you are investigating a historical event and an IP returns nothing today, it is possible the address was active at the time of the observation and has since gone dark. Routing and allocation state can change.