dnslytics.com Paid content

IPv6 is the 128-bit successor to IPv4, designed because IPv4's roughly 4.3 billion addresses ran out. It applies to anyone who needs to address devices on the internet — network operators, ISPs, enterprises, and members of a Regional Internet Registry (RIR) like AFRINIC, which allocates and manages IPv4, IPv6, and ASNs across Africa. If you are planning new network growth, requesting address space, or simply trying to understand why a device shows a long hexadecimal address, IPv6 is the relevant protocol.

Why IPv6 Exists

IPv4 uses 32-bit addresses. That yields about 4.3 billion unique addresses — a number that seemed vast in the 1980s but was exhausted as internet use spread to phones, servers, sensors, and cloud infrastructure. Workarounds such as NAT (Network Address Translation) let many devices share one public IPv4 address, but they add complexity and break some end-to-end connectivity.

IPv6 solves the core problem by widening the address field to 128 bits. The result is an address space large enough that running out is not a practical concern for the foreseeable future.

IPv4 vs IPv6 at a Practical Level

The notation difference matters in daily work. An IPv6 address is written as eight groups of four hexadecimal digits, and consecutive zero groups can be compressed with ::. For example, 2001:0db8:0000:0000:0000:0000:0000:0001 is normally written 2001:db8::1.

Key Operational Differences

• NAT reduction. Because IPv6 provides so many addresses, networks can give devices globally routable addresses without translation. This simplifies some architectures but changes how you think about firewalling and exposure.
• Autoconfiguration. IPv6 hosts can configure themselves using stateless address autoconfiguration, reducing dependence on a DHCP server for basic connectivity.
• Dual-stack coexistence. Most networks run IPv4 and IPv6 together rather than switching overnight. A device or service may be reachable over either protocol.
• Different security and management habits. Firewall rules, monitoring, and access controls written for IPv4 do not automatically carry over; they need to be reviewed for IPv6.

Who Allocates and Manages IPv6

IPv6 addresses are distributed through the same hierarchy as IPv4:

1. IANA manages the global pool.
2. Regional Internet Registries (RIRs) allocate blocks to organizations in their region. AFRINIC is the RIR for Africa and is responsible for the allocation and management of Internet numbers — IPv4, IPv6, and ASNs — in that region.
3. ISPs and larger members sub-allocate to their customers.
4. End users and enterprises receive addresses through their provider or, where eligible, directly as members.

AFRINIC's services bring registry services, policy participation, learning, and community together in one place, and it provides a dedicated IPv6 resources area for managing number resources. Members and stakeholders can also take part in the Policy Development Process, which shapes how Internet resources are managed in the region.

Where to Get IPv6 Resources or Training

If you are in the AFRINIC service region, the practical entry points are:

• IPv6 Resources — manage your number resources through AFRINIC.
• New Membership Registration Portal — access the member registration portal if you are applying for resources.
• Policy Development Process — learn how policy is proposed and decided, and participate.
• Webinar Series — expert-led online training and capacity-building sessions.
• Upcoming Events & Meetings — including regional meetings such as AFRINIC 38, scheduled for Cape Town, South Africa on 18 November 2026, with registration opening soon.

For readers outside Africa, the equivalent starting point is your own regional registry's IPv6 resource pages and training programs.

How to Tell If IPv6 Applies to You

IPv6 is likely relevant if any of the following is true:

• You are requesting or managing address space and your registry offers IPv6 blocks.
• You are growing a network and want to avoid IPv4 scarcity or heavy NAT.
• You are configuring devices, firewalls, or monitoring and need to support both protocols.
• You are a member or stakeholder who wants a voice in how Internet resources are managed.

If you only need to understand a single address you have seen, the notation and size differences above are usually enough. If you need to obtain or manage resources, go through your RIR or ISP rather than assuming addresses are freely available — allocation follows registry processes and membership conditions.

DNS, WHOIS, and IP lookups turn a single suspicious domain or address into a map of infrastructure: who registered it, where it is hosted, what else shares that hosting, and how it has changed over time. Tools like DNSlytics aggregate these records (A, MX, NS, PTR, registrant data) plus reverse lookups and historical data so an investigator can move from one indicator to a cluster of related domains. This is useful for fraud prevention, brand protection, and takedown documentation — but public records alone rarely prove who is behind an attack, because of privacy protection and shared hosting.

What each record type tells you

Each answers a different question. A records link a domain to hosting; NS and MX link it to operational infrastructure; WHOIS links it to registration. None of them, on their own, identifies a person.

Using reverse lookups to find related infrastructure

The core investigative move is pivoting: take one indicator and search for everything else that shares it.

• Reverse IP — find other domains hosted on the same IP. Shared hosting means many unrelated sites, so treat co-location as a lead, not proof.
• Reverse NS — find domains using the same name servers. This often clusters domains run by the same operator or reseller.
• Reverse MX — find domains routing mail through the same mail server, useful for email-based scams.
• Reverse Analytics / Reverse Adsense — find domains sharing the same tracking or ad IDs, a strong signal of common ownership.
• Reverse PTR / Reverse SPF — map IP-to-hostname and mail-sending relationships.

DNSlytics exposes these as dedicated reverse tools alongside its domain and IP search, so you can start from a domain, IP, or provider and expand outward.

Tracing changes over time

Attackers rotate domains and hosting. Historical records — hosting history, WHOIS changes, and historical events — let you see when a domain moved, when registration details changed, or when it first appeared. DNSlytics states it holds 10+ years of historical data and refreshes IP/DNS data every 14 days, with new domains added daily. Comparing snapshots helps distinguish a long-standing legitimate site from one registered and hosted shortly before an incident.

Documenting findings for fraud prevention or takedown

Collect evidence in a form a registrar, host, or platform can act on:

1. Record the indicator (domain, IP, or email) and the date/time you checked.
2. Capture the raw records — A, MX, NS, PTR, WHOIS — with the source.
3. Note reverse-lookup clusters and shared IDs that link domains.
4. Save historical snapshots showing the timeline.
5. State clearly what the data shows and what it does not prove.

This structure supports brand protection and fraud-prevention reports and gives a takedown request concrete, verifiable anchors.

Limits you must account for

• Privacy protection hides registrant details in many WHOIS records, so attribution from WHOIS alone is often impossible.
• Shared hosting means a reverse-IP match can be coincidental; corroborate with NS, MX, or analytics IDs.
• CDNs and proxies mask the true origin IP, so an A record may point to a provider, not the operator.
• Dynamic records change; always timestamp your lookups.

DNSlytics offers premium website access and a premium API for more page views, monitors, and data, with month and year plans — check the pricing page for current terms, since access levels and limits are not free by default.

An online investigation tool is a web service that queries public internet records — DNS, WHOIS, IP allocations, and historical data — to reveal who is behind a domain, IP address, or hosting provider and how they connect to each other. DNSlytics is one such tool: it lets you look up a domain, IP, or provider, then pivot across shared infrastructure to find related properties. Use it when you need to trace ownership, spot fraud infrastructure, or check whether a brand is being impersonated — not as a substitute for legal process when you need identity behind a privacy-protected registration.

What the tool actually queries

The service pulls from several public record types. Knowing which one answers your question saves time.

DNSlytics states its IP/DNS data is refreshed every 14 days and that it holds 10+ years of historical data, with 330+ million active domains and 20+ billion historical events indexed. That scale is what makes pivoting useful: a single shared name server or analytics ID can surface dozens of related domains.

Starting from a domain

Enter the domain name into the search field. The tool accepts domains, IPv4 addresses, IPv6 addresses, and AS numbers — the site's own examples are verizon, google.com, 188.114.96.3, 2a06:98c1:3120::3, and as40528.

From a domain result, the useful next steps are:

1. WHOIS lookup — confirm registrar and key dates. If the registration is days old and the brand is well known, that is a signal worth noting.
2. DNS records — check where it resolves and which mail servers it uses.
3. Subdomains — enumerate what else is published under the domain; staging or admin hosts often appear here.
4. Hosting history — see whether the domain moved recently. A sudden host change can explain a change in behaviour.
5. Reverse tools — take the name servers, mail servers, or IP and search those to find sibling domains.

Starting from an IP address

An IP-first workflow is common in fraud and abuse work, because the same server often hosts many domains.

• Reverse IP returns other domains on that address. This is the fastest way to find a cluster of related sites.
• Reverse PTR shows the hostname the address resolves back to, which sometimes names the provider or customer.
• AS/BGP report places the IP inside a network block and identifies the operator. This matters when you need to decide whether to report abuse to a hosting company or an upstream network.

A practical pivot: start with one suspicious domain → get its IP → run reverse IP → collect the other domains → run reverse NS or reverse MX on those → group them into a cluster. Domains that share both an IP and a name server are far more likely to be operated together than domains that share only one.

Why reverse lookups matter more than single lookups

A single WHOIS record tells you about one domain. Reverse tools tell you about relationships, which is usually the actual question. Reverse IP, reverse NS, reverse MX, reverse PTR, reverse SPF, reverse Analytics, and reverse Adsense each expose a different shared identifier:

• Shared name servers suggest the same DNS operator or reseller.
• Shared mail servers suggest the same mail infrastructure.
• Shared analytics or AdSense IDs are strong signals, because a publisher ID is tied to one account holder.
• Shared SPF records can link domains that send mail through the same authorised infrastructure.

No single shared attribute proves common ownership — shared hosting alone means little. Treat each as one piece of evidence and look for two or more independent overlaps before drawing a conclusion.

Using historical data

Current records only describe the present. If a domain changed hands, moved hosts, or was cleaned up after an abuse report, the live record will not show it. DNSlytics keeps historical events, which lets you:

• See what a domain pointed to before a recent change.
• Check whether an IP previously hosted known-bad domains.
• Compare a domain's history against the date of an incident.

This is the main reason to prefer a tool with a historical index over a plain live DNS lookup. The site reports 20+ billion historical events and 10+ years of coverage.

A repeatable investigation workflow

1. Define the question. Ownership, infrastructure, or relationship? This decides your starting record.
2. Start with the strongest identifier you have — a domain, an IP, or an AS number.
3. Run the direct lookups (WHOIS, DNS) to establish the baseline.
4. Pivot on shared infrastructure using reverse IP, NS, MX, and analytics/AdSense.
5. Check history for each candidate to see whether the relationship is current or stale.
6. Verify before concluding. Confirm a shared attribute on a second, independent record. Note dates, because a shared IP today may be coincidental hosting.

Practical limits to keep in mind

• WHOIS registrant details are frequently redacted for privacy; the tool cannot reveal what the registry does not publish.
• Shared hosting means many unrelated sites share an IP, so reverse IP results need filtering.
• Historical data shows what was recorded, not necessarily everything that existed.
• Data is refreshed on a cycle (the site states every 14 days for IP/DNS), so very recent changes may not yet appear.

DNSlytics offers a free toolset plus premium website access and a premium API for higher page views, more monitors, and additional data — check the pricing page for current plan details rather than assuming limits. For a one-off lookup, the free tools cover the core records; for repeated monitoring or programmatic access, the API is the relevant option.

An Autonomous System Number (ASN) is a globally unique number assigned to a network that operates under a single, clearly defined routing policy and exchanges routing information with other networks using BGP. You need one when your network must present a consistent identity to the global routing table — most commonly for multi-homing, peering, or running your own address space. You request it from the Regional Internet Registry (RIR) that covers your region; for Africa, that is AFRINIC, which is responsible for the allocation and management of IPv4, IPv6, and ASNs across the continent.

ASN vs. IP address: what each one does

An IP address identifies an interface or a host. An ASN identifies a network — the whole routing domain behind it. The two work together but answer different questions:

A useful way to think about it: the IP prefix tells the world where your addresses are, and the ASN tells the world who is announcing them. When you announce a prefix to a transit provider or an internet exchange, the route carries both your prefix and your origin ASN.

When does a network actually need its own ASN?

Not every organisation needs one. You generally do not need an ASN if you simply connect to a single upstream provider and use addresses that provider assigns to you — your provider's ASN covers your traffic.

You do need your own ASN when:

• You multi-home. You connect to two or more upstream providers or exchanges and want traffic to fail over between them. Without your own ASN, you cannot announce a consistent prefix from multiple paths.
• You peer. You want to exchange traffic directly with other networks at an internet exchange point, which requires a BGP session identified by your ASN.
• You run your own address space. If you hold provider-independent addresses and want to announce them yourself, you need an ASN as the origin.
• You want a stable routing identity. Your ASN stays with you if you change transit providers, so your routing presence does not depend on any single carrier.

How the request process works

The exact forms and portal differ by registry, but the logic is the same everywhere. The general sequence is:

1. Confirm you are in the right region. AFRINIC serves the African region. If your network is elsewhere, you apply to the RIR covering that area instead.
2. Check eligibility. Registries expect you to be an organisation operating a network, not an individual reselling connectivity. You will typically need to show that you are multi-homed or have a concrete plan to become multi-homed.
3. Prepare justification. You explain why you need the ASN: your upstream providers, your peering plans, and the routing policy you intend to run. This is the part most first-time applicants underestimate.
4. Submit the request through the registry's member or resource request process, along with the supporting documentation the registry asks for.
5. Receive the assignment and register it. Once assigned, the ASN is recorded in the registry's public database, and you use it to configure BGP with your neighbours.

AFRINIC's own service pages group this under registry services, alongside IPv6 resource management and the member registration portal, so the ASN request sits within the same membership and resource-management workflow as addresses.

After you get it: what actually matters

Getting the number is the easy part. The ongoing work is what determines whether it is useful:

• Keep your registration data current. Your ASN record, contacts, and associated address objects should reflect reality. Stale records cause failed peering requests and confusion in routing databases.
• Appear in routing databases. Networks commonly list their ASN, prefixes, and peering details in PeeringDB so that potential peers can find them. PeeringDB's own update notes describe ongoing work such as improved ASN comparison and expanded API query export, which reflects how central ASN records are to peering decisions.
• Understand transfer and policy rules. ASNs can be transferred under registry policy, but the conditions are set by the RIR and can change through the policy development process. If you are acquiring or disposing of one, check the current policy rather than assuming.
• Plan for the routing policy you declared. If you told the registry you would multi-home, you should actually do it. Registries can review whether assignments are being used as justified.

Common pitfalls

• Applying without a real multi-homing plan. "I might want it later" is usually not sufficient justification.
• Confusing an ASN with an IP allocation. They are separate resources with separate requests and separate justification.
• Forgetting the public database. Your ASN is visible to the global routing community; inaccurate entries create operational problems for you and your peers.
• Assuming regional rules are identical. Each RIR has its own policies and procedures. AFRINIC's apply to Africa; the same concept elsewhere is handled by a different registry with different requirements.

If you are in the AFRINIC region and want to move forward, the practical starting point is AFRINIC's registry services and membership pages, where the resource request process and the member registration portal are documented.

A domain name is the human-readable address people type to reach a website or online service — like sedo.com. It works by mapping that readable label to a numeric IP address through the Domain Name System (DNS), so you don't have to memorize strings of numbers. You need a domain name if you want a stable, memorable address for a website, email, or brand. You can get one either by registering a new, unclaimed name through a registrar, or by buying an already-registered name on an aftermarket marketplace such as Sedo.

Domain name vs. URL, website, and hosting

These four terms get used interchangeably, but they describe different things:

A useful way to think about it: the domain name is the street address, hosting is the building on that land, the website is what's inside the building, and the URL is the directions to a specific room.

The parts of a domain name

Reading a domain from right to left:

• Top-level domain (TLD) — the ending, such as .com, .org, or a country code like .us. This is the broadest category.
• Second-level domain — the part you choose and that makes the name yours, such as sedo in sedo.com. The combination of second-level name + TLD is what you register.
• Subdomain — an optional prefix you control, such as blog.example.com or shop.example.com. Subdomains don't need separate registration; you create them through your DNS settings.

So in blog.example.com: blog is the subdomain, example is the second-level domain, and .com is the TLD.

How DNS turns a name into an IP address

Computers locate each other by IP addresses, not names. DNS is the system that translates one into the other. When someone types your domain into a browser, roughly this happens:

1. The browser asks a DNS resolver to look up the name.
2. The resolver queries a hierarchy of name servers until it reaches the authoritative name server for your domain.
3. That server returns the IP address (and other records) associated with the name.
4. The browser connects to that IP address and requests the page.

The key practical point: your domain and your hosting are linked through DNS records. You point your domain at a server by setting records such as an A record (maps a name to an IPv4 address) or a CNAME record (points one name to another). Changing hosts usually means updating these records, not moving the domain itself.

How domains are registered, owned, and renewed

Domains aren't bought outright in the way physical property is. They're registered for a fixed term — commonly one year at a time — through an accredited registrar.

• Registration gives you the exclusive right to use that name for the term you paid for.
• Ownership is tracked in a registry database, with your contact details (often privacy-protected) on record as the registrant.
• Renewal is required. If you let a domain lapse, it can expire and eventually become available to others. Most registrars offer auto-renew to prevent accidental loss.
• Transfer lets you move a domain between registrars, usually by unlocking it and using an authorization code.

Because renewal is ongoing, the real cost of a domain is the registration or purchase price plus the recurring renewal fee.

Registering a new domain vs. buying a premium or aftermarket domain

There are two distinct paths, and they differ in price, availability, and process:

Registering a new domain

• You search for a name that no one currently holds and register it through a registrar.
• Typically the lowest-cost route, with standard renewal pricing.
• Best when your preferred name is still unclaimed.

Buying a premium or aftermarket domain

• The name is already registered, and the current owner is offering it for sale — often through a marketplace like Sedo, which lists domains for sale and premium domains.
• Pricing is set by the market or the seller and can be far higher than a standard registration, reflecting the name's perceived value.
• Best when the exact name you want is taken and matters enough to your brand to pay for it.

Sedo operates as a marketplace for buying, selling, and parking domains, so both new registrations and aftermarket purchases can fit into the same workflow depending on what you need.

What this means for your next step

If you just need any available name, start with a registrar search and register it, then point its DNS records at your hosting. If the name you want is already taken and central to your plans, look at aftermarket listings and expect market-based pricing. Either way, plan for renewal from the start — a domain is a recurring commitment, not a one-time purchase.