IP address lookup

How this lookup works

You give us one of three things: an IPv4 address such as 198.51.100.24, an IPv6 address such as 2001:db8::1, or a hostname such as mail.example.com. A hostname is resolved to its first address first, then treated like any other lookup. If you submit nothing, the page shows your own address, so you can use it as a what-is-my-IP page with more detail.

Five lookups then run against data we keep on our own servers, so the result does not depend on any paid API:

The first three are fast and always included; the profile they produce is cached for 30 minutes so repeated lookups of the same address are instant. Reverse DNS is a live query, and the registry record is fetched live when you look up a specific address, so those two take a moment longer. The result page also prints the address in decimal, hexadecimal, binary and octal, its reverse-DNS name, and for IPv4 its IPv6-mapped form, which is useful when you are reading firewall logs or writing rules.

Every lookup result also exists as a permanent page at /ip/ followed by the address, and as JSON from the public API. The HTML page and the JSON share the same underlying profile, so a script and a person see the same answer.

What each field means

IP address and version. The address you asked about, normalized. IPv6 addresses are shown both compressed and expanded. Private and reserved addresses are recognized and the page says so instead of showing a meaningless location.

Location. Country, region and city as estimated by the geolocation database, plus coordinates and the time zone that applies there. The time zone is the value we later compare against a visitor's browser clock in the proxy checker. A missing city means the database only knows the country or region for this block.

Network. The autonomous system number, the registered name of the organization, the country the AS is registered in, and the exact prefix that contains the address, written in CIDR notation. Click the ASN to see the whole network: how many prefixes it announces, how many addresses that covers and what else lives there.

Classification. One label summarizing how an automated filter would read the address: Residential, Mobile carrier, Datacenter / hosting, VPN / proxy provider, Tor exit node, Business, Education, Government or Unclassified. The flags under it show which checks produced the label.

Hostname. The PTR record, if any. Consumer ISPs often encode the city or the connection type in it, for example a pool name that contains "dsl" or "cable". Hosting providers put the server name there. VPN providers sometimes put their own brand there, which is an instant giveaway.

Registry record. The RDAP data for the block: the holder's name, the registry (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC), the registered range, dates and abuse contact where published. This is the authoritative statement of who holds the block, as opposed to who announces it; the two differ when a holder leases addresses to another operator.

How to read your result

The purpose of most lookups is a yes-or-no question: is this address what I think it is? Read the result in this order.

1. Classification first. Residential or mobile carrier means the address is on a network that ordinary people use. Datacenter, VPN provider or Tor means a strict website will treat it as a server, proxy or anonymizer regardless of anything else.
2. Then the network name. A classification of "Unclassified" is neutral, so look at the name yourself. Telecom, broadband and cable companies are consumer networks. Names containing hosting, cloud, server or the name of a well-known cloud provider are not.
3. Then country versus network country. When the location country and the network's registration country differ, the address is being used outside the operator's home market. That is normal for a cloud region and unusual for a consumer line.
4. Then the hostname. Confirms or contradicts the above. A PTR name with the ISP's domain and a pool-style label supports "residential"; a name like vpn-exit or node-12 does not.
5. Then the flags. Tor and Spamhaus DROP are decisive. A datacenter range match means the address is in a published list of hosting networks, which fraud filters also consult.

If you are checking a proxy you plan to use for an account, the result you want is: Residential or Mobile carrier, a consumer ISP name, matching countries, an ISP-style hostname or none, and no flags. The IP checker adds the 8 blocklist queries to that picture and gives one verdict.

What to do with the result

If you looked up your own address and it is classified as hosting or VPN while you expected a home connection, your traffic is leaving through a tunnel you may have forgotten about: a VPN client set to connect on startup, a browser extension, a corporate proxy or a privacy feature in the browser itself. Disable it and reload. If the city is wrong but the country and ISP are right, nothing is broken; see the section on wrong cities below.

If you looked up a proxy or VPN exit before using it for a login and the classification is wrong for your purpose, change the address rather than the browser. No client-side setting turns a hosting address into a residential one. Ask the provider for a residential or mobile pool, or pick a different exit, then look the new address up again and run the anonymity score from the browser profile you will actually use.

If you looked up an address from a server log or an email header and want to report abuse, the registry record shows the abuse contact for the block. Reports go to the network holder, not to the geolocation city. The email header analyzer finds the originating address for you when you paste the raw headers.

If you are a network operator and your own block shows the wrong place, the geolocation provider accepts corrections. Publishing a geofeed for your prefixes is the durable fix; databases that honor geofeeds, including the one we use, pick the change up on their next build.

Limits of this lookup

• City-level accuracy is limited. The database estimates the city from registration records and traffic patterns. It is good for large cities and weak for small towns, mobile networks and recently reassigned blocks. We refresh monthly, so a block moved after the last build will show its old location until the next one.
• Coordinates are the center of the estimated area, not the position of a device. Plotting them on a map shows you a city, not a building.
• Classification is rule based. It combines the network's name, a datacenter list, the Tor exit list and the Spamhaus DROP list. A hosting company with a neutral name can be labeled Unclassified, and an ISP whose name contains a hosting keyword can be labeled hosting. We show the evidence so you can overrule the label.
• Reverse DNS can be stale or decorative. The holder of a block sets its PTR records freely. A hostname is a hint, not proof.
• Registry data describes the holder, not the user. The RDAP record says who was allocated the block. It cannot say who is using an address today, and leased or subleased ranges often show the original holder.
• Blocklists are not part of this page. The lookup shows network flags only; the blacklist check and the IP checker run the 8 DNSBL queries.

Why does my IP location show the wrong city?

An ISP receives a block from its regional registry and deploys it wherever it needs capacity. The registration record often names the company's head office or the city the block was first used in. When the ISP later shifts a subnet to another town, nothing obliges it to update anyone. Geolocation providers correct for this by observing where traffic from each block appears, which works for big cities and fails for small ones. Mobile carriers make it worse by placing a whole region's phones behind a few gateway addresses in a hub city. The upshot is that the country is dependable, the region usually is, and the city is an educated guess. If a specific city matters to you, for example because a proxy was sold as being in one, compare the location with the registry record and the network name on the same result page; together they tell you where the block is really managed.

IP tracker: can you track an IP address in real time?

No, and any page that claims to is reading the same static databases we do. An IP address does not report its position; it is a routing label. What a lookup gives you is the registered location of the block and the identity of the network, both of which change slowly. There is no way to follow a device from one place to another through its IP, and a phone that moves between cell towers keeps the same carrier gateway address anyway. If you need to know where a visitor or a sender is, the lookup result is the ceiling of what is knowable from the address alone.

Can I find out who owns an IP address?

You can find out which organization holds and announces the block, which is usually enough. The registry record names the holder and an abuse contact, and the network field names the operator routing it. For a consumer address that means the ISP; for a server it means the hosting company or the customer the block was reassigned to. The WHOIS lookup shows the same registry data for domains and ASNs as well. What you cannot get is the subscriber behind a consumer address; that information stays with the ISP.

Looking up a hostname instead of an address

When you enter a hostname, we resolve it and look up the first address returned. For a website this is normally the address of its web server or its CDN edge nearest to our server, which may not be the edge nearest to you. If the domain has several addresses, or you need its mail or name servers, the DNS lookup lists every record type. The hostname path is handy for checking where a service is hosted, for confirming that a proxy's hostname resolves to the advertised country, or for finding the address behind a link in an email.

Finding an IP address in an email or a log

Email headers record each server that handled a message in Received lines, read from the bottom up; the lowest one with a public address is usually the sender's mail server or, for webmail, the provider's outbound relay rather than the person's own connection. Web server logs put the client address at the start of each line. Firewall and router logs usually show both source and destination addresses. Copy any one of them into the box above. For bulk work, the JSON endpoint accepts the address in the URL and returns the same fields, with optional blocklist and registry data, so you can enrich a whole log in a loop without scraping the HTML.

IPv4 and IPv6 lookups

Both address families are supported throughout. IPv6 lookups return the same location, network, prefix and registry data; the prefix is typically larger, often a /32 or /48, because IPv6 blocks are allocated in bigger units. Reverse DNS for IPv6 uses the ip6.arpa tree and is less often populated than for IPv4. Blocklist checks are not run for IPv6 because most DNS blocklists do not cover it. If a log shows an IPv4-mapped form such as ::ffff:198.51.100.24, look up the IPv4 part after the last colon; the mapped form is the same IPv4 address as written by a dual-stack socket, and the result page shows that mapped spelling for every IPv4 lookup so you can match them.