Does “Not checked” mean safe?
No. It means the standard lookup has no observation for that measurement. A failed provider request also does not establish either safety or abuse.
9.9.9.9 — Quad9
9.9.9.9 is the main address of Quad9, a public DNS resolver run by a non-profit foundation based in Switzerland. It blocks domains that its threat-intelligence partners identify as malicious. The secondary address is 149.112.112.112.
Look up network ownership
Live lookup results require JavaScript. The notes below are available without running a lookup.
About 9.9.9.9
9.9.9.9 is the main address of Quad9, a public DNS resolver run by a non-profit foundation based in Switzerland. It blocks domains that its threat-intelligence partners identify as malicious. The secondary address is 149.112.112.112.
- Why a site may “disappear” on Quad9
- When a domain is on Quad9’s block list, the resolver returns NXDOMAIN as if the domain did not exist. If a site loads on another resolver but not on 9.9.9.9, check the domain on quad9.net before assuming an IP or network problem.
- Filtering and ECS variants
- 9.9.9.10 provides resolution without blocking. 9.9.9.11 keeps blocking and also sends EDNS Client Subnet, which can help CDNs choose a nearby server.
- Why the location looks wrong
- Quad9 is anycast from many sites around the world, so the single city in a geolocation database does not describe where your query was answered.
- How to verify which resolver answered
- Run dig CH TXT id.server @9.9.9.9. The answer names the Quad9 site that handled your query.
Side-by-side lookup of six resolvers
Other well-known public resolvers
What TrustIP adds beyond a raw IP lookup
The report separates returned facts, missing evidence and next steps. A successful lookup does not mean every security check ran. Each result names its data source and lookup time; unsupported checks stay visible as “Not checked”, without an invented score.
- Network organization and ASN
- Use these to identify the network associated with the address. The operator of a network is not necessarily the individual or business currently using it.
- Estimated city and country
- Use these to investigate regional mismatches. They are database estimates, not a precise device location or proof of a home address.
- Unavailable checks
- A missing reputation score is not zero risk. No proxy observations means no conclusion about whether a VPN, Tor or residential proxy is in use.
Why a single “clean IP” label is misleading
An address may be shared by many customers, assigned dynamically, or reused after previous activity. Different services also make different decisions. Successful browsing does not establish email deliverability or acceptance by a subscription platform. TrustIP does not combine missing measurements into a reassuring overall score.
Match the next check to the actual symptom
Keep the destination, error message, time and network used together. Change one variable at a time so you can tell what affected the result.
- The location looks wrong
- Confirm the queried public egress address. Compare the reported organization with your provider, identify which location database the affected website uses, and request a correction from that provider. A VPN exit or mobile gateway may be in another region.
- A website requests extra verification
- Record the exact challenge or error. Check account notifications and browser settings, then compare another network you are authorized to use. An IP lookup alone cannot identify the cause of a login failure.
- Email is rejected
- Read the SMTP rejection and identify the sending server IP. Follow the named blocklist operator’s lookup and removal process. The browser’s IP may not be the mail server’s address.
- A streaming or AI service fails
- Test from the affected connection and record the service’s error. Account region, subscription, DNS and service status need separate checks. Querying a remote IP does not send a connection through it.
Questions about interpreting the result
Can I look up an IP other than my own?
Yes, where you are authorized to do so. Network ownership can be queried remotely, but that does not test connectivity from the remote address.
Why can the result change?
Addresses can be reassigned and provider databases can update. Save the source and lookup time when comparing results. The lookup time is not the date the provider last updated its record.
Practical troubleshooting guides
Verify the technical background
These references explain the underlying concepts. They do not endorse TrustIP or verify an individual lookup.