IP Address Lookup

How the IP address lookup works

An IP address lookup answers one narrow question: which network is this address part of, and where does that network say it is? The tool never contacts the device at the address. Nothing is sent to it, and its owner sees nothing. Instead, four public sources are queried and merged into the result above.

• Registry allocation records. Five regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC) hand out blocks of addresses and publish who received each one. That gives the organisation name and the country the block was registered in.
• Routing announcements. Networks tell the rest of the internet which blocks they carry using BGP. Each announcement carries an autonomous system number, so the ASN identifies the operator that actually moves the packets.
• Geolocation databases. Commercial vendors estimate a city and a set of coordinates by combining registry data, network latency measurements, location hints that ISPs publish for their own equipment, and aggregated observations of where addresses are used.
• Reverse DNS. A PTR query asks the network that holds the address what name it has given it. This is why 8.8.8.8 comes back as dns.google, and why many home connections come back as a long string containing the city and the ISP name.

The first two sources are authoritative records. The third is an estimate, and it is the one that produces the city on the map. Keeping that distinction in mind explains most of the surprises people run into.

What you can find out from an IP address

Every field the tool returns, and what it actually means:

IP version

IPv4 (four numbers, like 8.8.8.8) or IPv6 (hexadecimal groups, like 2001:4860:4860::8888). Both are looked up the same way.

Country and country code

The country the block is registered to and used in. The most reliable field in the result.

Region and city

The state or province and the city the geolocation vendor associates with the address. An estimate, not a record.

Postal code and coordinates

A representative postal code plus latitude and longitude. The coordinates usually point at the centre of a city or at an ISP facility, not at a building.

Time zone

The IANA zone for that location, useful for lining up log timestamps.

ISP

The provider that supplies connectivity for the address: a consumer ISP, a mobile carrier, a hosting company or a corporate network.

Organisation

The entity the block is assigned to. Often the same as the ISP, sometimes a customer of it, such as a university or a bank.

AS number and AS name

The autonomous system that announces the address. AS15169 is Google, AS13335 is Cloudflare, AS16509 is Amazon. The ASN is a routing fact, so it is far harder to get wrong than a city.

Hostname (PTR)

The reverse DNS name, shown when the network publishes one. Many providers encode the exchange, city or connection type in it, which sometimes beats the geolocation guess.

Connection type

Shown when the data source flags the address as mobile, hosted or proxied. When no flag comes back, the row is left out rather than guessed.

How to read the results

Results open in Summary view, which shows the fields most people came for: country, region, city, ISP and ASN. Two other views sit behind the buttons above the table.

• Detailed view adds the postal code, coordinates, time zone and organisation.
• Privacy info reports whether the address is flagged as a proxy, VPN, Tor exit or data-centre host. Treat this as a signal rather than a verdict, and use the VPN checker when the answer matters.

The map pin is drawn from the coordinates in the result, so it inherits their precision. A pin over a city centre means the vendor placed the address in that city, not that anyone is standing there. Below the results you get a permanent link you can paste into a ticket or an email, which reproduces the same lookup for whoever opens it.

Two patterns are worth recognising straight away. If the ISP and organisation name a cloud provider, you are looking at a server rather than a home connection. If the hostname contains a city or airport code that disagrees with the city field, the hostname is usually the better clue, because the operator wrote it themselves.

Accuracy and limits

Geolocation is an estimate that gets weaker as it gets more specific. These are the realistic figures for commercial databases, including the one behind this page:

Field	Typical accuracy	Why it drifts
Country	About 99%	Backed by registry allocation, so it is rarely wrong outside VPN traffic
Region or state	80–90%	Large ISPs reuse address blocks across neighbouring states
City	55–80%	Often resolves to the ISP hub or routing centre rather than the subscriber
Postal code	50–70%	Inherits every error in the city estimate
Coordinates	Approximate	Usually the centre of a city or region, never a street address
ASN and ISP	Above 95%	Derived from routing and registry data rather than estimation

Several situations push the city estimate further off:

• Mobile networks. Carriers route traffic through a handful of gateways, so a phone in a small town can present as the nearest large city or as the carrier's home region.
• VPNs and proxies. The result describes the VPN server. That is the point of a VPN, and it is working as designed.
• Carrier-grade NAT. Many subscribers share one public address, so the result describes a pool rather than a household.
• Corporate and satellite links. Traffic may exit through a head office or a ground station in a different country entirely.
• Recently transferred blocks. When a block changes hands, databases can lag the move by weeks.

What an IP address lookup cannot tell you

Plenty of sites imply otherwise. None of the following is available from an address, here or anywhere else:

• The name of the person or household using it
• A street address, apartment number or GPS position
• A phone number or email address
• Browsing history, messages or account details
• The device, its MAC address, or who is sitting at it
• Whether the person is currently in the city shown

Those details exist, but they sit in the ISP's subscriber records, which are not public. Any service promising a name and a street address from an address alone is selling a guess.

Common uses

Most IP address lookup traffic falls into a few recognisable patterns:

• Checking a login alert. An account warns you about a sign-in from an unfamiliar place. The country and ISP tell you quickly whether it matches a trip, a phone on cellular data, or nothing you recognise.
• Triaging server logs. Repeated failed logins or scan traffic usually trace back to hosting ASNs, which is grounds for blocking the range rather than the single address.
• Screening orders and signups. A billing country that disagrees with the address country, or an address flagged as hosted, is a reason to look closer.
• Confirming a VPN is on. Load this page with your VPN connected and the result should show the VPN provider, not your ISP.
• Planning infrastructure. Knowing where visitors connect from guides server regions, CDN choices and language defaults.
• Diagnosing geo-blocking. When a streaming service or a bank blocks you, the country the address resolves to is usually the reason.

Reporting IP abuse

If an address is attacking you, sending spam or scraping your site, the report goes to the network that operates it, not to us. Take the ASN and organisation from the result, then look up the block's published abuse contact with the IP WHOIS lookup. Registries require every block to carry one. A report gets acted on when it contains the offending address, timestamps with the time zone stated, and a handful of raw log lines. Cloud providers also run their own abuse forms, which move faster than email for addresses inside AWS, Google Cloud, Azure or OVH.

Can you trace an IP address to a person?

Not on your own. An IP address lookup gets you to the network operator. Only that operator knows which subscriber held the address at a given moment, and only they hold the billing name behind it. Those records are released through a legal process such as a subpoena, a court order or a law-enforcement request, and they are kept for a limited time.

There are technical limits on top of the legal ones. With carrier-grade NAT, hundreds of subscribers can share one public address at the same time, so the operator needs the exact timestamp and source port to identify one of them. Home addresses are reassigned frequently, so yesterday's address may belong to a different customer today. If you are dealing with harassment, fraud or a crime, save the raw logs with timestamps and hand them to the platform involved or to the police. They can compel what you cannot request.

How to correct a wrong IP location

If your own address resolves to the wrong city, the fix sits with the geolocation vendor, not with the site that displayed it. Sites use different vendors, so check two or three first to see which databases are actually wrong. Then submit a correction:

• MaxMind GeoIP correction form, which feeds a large share of the web
• ip-api.com data correction, the source behind this page
• IP2Location contact form, used for reporting inaccurate records

Corrections usually need proof that you control the address, and updates take one to several weeks to reach the products that consume the database. If you run the network rather than just using it, publish a geofeed file in the RFC 8805 format and reference it from your WHOIS record. Vendors read geofeeds automatically, which fixes every address you operate at once instead of one report at a time.

Related tools

• Bulk IP lookup: run up to 100 addresses at once
• IP WHOIS lookup: registry record and abuse contact
• Reverse DNS lookup: the PTR record for an address
• IP blacklist checker: test an address against spam blocklists
• Proxy check: spot proxy and anonymiser traffic
• ASN lookup: the networks and prefixes behind an AS number
• What is my ISP: the provider behind your own connection