IP address lookup

Find out which provider and network an IP address belongs to and roughly where it is. We also show whether it has been reported to AbuseIPDB for attacks or spam.

← Back to all tools

What the lookup shows

Every device talks to the internet through a public IP address. The address alone does not reveal who is behind it, but public databases know which network and provider it belongs to and roughly where the provider uses it. The tool looks up the address in two sources:

Network and location (ip-api.com): the internet service provider (ISP), the organization the address is assigned to, the autonomous system number (ASN) and an estimated location: country, region, city, postal code, coordinates and time zone.
Connection type (ip-api.com): whether the address belongs to a mobile network or to a hosting provider or data center, and whether the database knows it as a proxy, VPN or Tor exit node.
Abuse reports (AbuseIPDB): how many times administrators of other servers reported the address in the last 90 days, for example for password guessing, port scanning or spam, plus an abuse confidence score from 0 to 100.

How to read the result

The network details (ISP, organization and ASN) are the most reliable part of the result. They come from IP address registrations and rarely change. The location is an estimate, and the more detailed it is, the less you can rely on it.

IP address:          8.8.8.8
Country:             United States (US)
Region:              Virginia
City:                Ashburn
ISP:                 Google LLC
Organization:        Google Public DNS
ASN:                 AS15169 Google LLC
Proxy/VPN/Tor:       Yes
Hosting/Datacenter:  Yes
Mobile network:      No

8.8.8.8 is Google's public DNS server. It answers from dozens of places around the world at once (anycast), yet the database lists a single city. An IP address's location is not necessarily where the server you are talking to actually sits.
The ASN identifies the network that announces the address on the internet. AS15169 belongs to Google. The ASN tells you who runs the network even when the Organization field is empty or too generic.
Proxy/VPN/Tor: Yes does not necessarily mean a VPN. When we wrote this guide, ip-api.com flagged 8.8.8.8 as a proxy, even though it is Google's public DNS server, not a VPN. Treat the flag as a hint only and look at the ISP and ASN too.
Hosting/Datacenter: Yes means the address belongs to a cloud or hosting provider. That is normal for websites and servers. For a regular employee's sign-in it is worth a closer look, because traffic through a VPN or from a compromised server looks the same.
AbuseIPDB calculates the abuse confidence score from its users' reports, giving older reports less weight. The higher it is, the more confident the database is that the address is used for attacks or spam. Addresses on the AbuseIPDB whitelist, such as large public DNS servers, score 0 even when some reports exist, and the tool marks them as such. A score of 0 does not mean the address is safe, only that nobody has reported it or that it is whitelisted.

How accurate IP geolocation is

An IP address is not GPS. Databases estimate location from address registrations, provider data and measurements. They never point to a specific house or apartment.

The country is usually right. The city is often wrong: home connections commonly show up at the provider's headquarters or in the nearest large city.
Mobile data: a phone often appears in the capital or wherever the operator has its network gateway, regardless of where the phone actually is.
Shared addresses (CGNAT): many providers, especially mobile ones, share one public address among a large number of customers. The result then describes the provider, not a specific device.
VPN, Tor and proxies: the result shows the server the traffic leaves from, not the real user. Corporate networks and cloud security gateways also often route traffic through another city or even another country.
Coordinates and the map show only an approximate area: the center of the city, region or country the database assigned the address to. That is why we round the coordinates and the map has no pin.
Outdated data: address ranges are sold and moved between providers, and databases pick up the changes with a delay.

What the lookup is useful for

A suspicious sign-in: when a service reports a sign-in from an unfamiliar IP address, look at the provider first. Your own mobile operator with a different city is usually harmless. A hosting provider, a VPN or a foreign ISP you do not use is a reason to change your password, sign out other sessions and turn on multi-factor authentication.
A suspicious email: the address of the server that delivered the message is in the Received lines of its header. The lookup shows whose network it is. Whether that server may send email for the sender's domain is decided by SPF and DMARC, not by location.
Your own public address: the Check my IP button fills in the address your browser used to reach our site. It helps when you need to allow the address in a firewall or admin panel, or when you want to confirm your VPN works: the VPN provider should appear instead of your ISP.
Your mail server's outgoing address: a mail server may send from a different address than the one your browser uses. Find it on the server itself or in the header of a sent message, and only then look it up or add it to SPF as ip4: or ip6:.
Your server's reputation: if someone is blocking your address, the AbuseIPDB reports show what it was reported for. For your own server, reports of password guessing or scanning usually mean it is compromised or misconfigured, or that someone else used the address before you. Email blocklists such as Spamhaus are separate lists, and this tool does not check them.

What the lookup cannot tell you

It does not identify a person or a home address. Only the internet provider knows which customer used an address.
The Proxy/VPN/Tor flag is only the database's estimate. No does not mean the address is not a VPN, because the database knows only some of these services. Yes, on the other hand, can appear for an address that is not a VPN at all, as the 8.8.8.8 example above shows.
Reports come only from AbuseIPDB and only from the last 90 days. If AbuseIPDB does not respond, the result says so. That does not mean the address is clean either.
It does not check open ports, vulnerabilities or whether the device behind the address is compromised.
It looks up only public IPv4 and IPv6 addresses, not domain names. Private addresses such as 192.168.x.x or 10.x.x.x are used only inside local networks and are not in the databases, and neither are reserved ranges such as documentation or multicast addresses. The tool recognizes private addresses and the common reserved ranges itself and does not send such addresses anywhere.
We pass the IP address you enter to ip-api.com and AbuseIPDB, and your browser loads the map from OpenStreetMap. We do not store the result.

Common questions

Can I find out who is behind an IP address or where they live?

No. Public databases know only the provider and a rough area. Only the internet provider knows which customer used the address at a given moment, and it discloses that only to authorized bodies such as the police or a court. If someone is harassing or attacking you, keep the logs with the exact time and time zone and report it to the police. For shared addresses, the source port number is needed too.

Why does the tool show a different city from where I am?

IP location is an estimate from a database, not the location of your device. Home and mobile connections often show up at the provider's headquarters or in the capital. If the provider is right, the result is fine.

My IP address has reports in AbuseIPDB. What should I do?

Home and mobile addresses are shared or change often, so the reports may concern someone else. For your own server or a static address, look at the report categories: brute force, SSH attacks or port scans usually mean a compromised computer, an open proxy or malware on the network. Once you remove the cause, new reports stop arriving and old ones gradually drop out of the 90-day window.

What does Hosting/Datacenter: Yes mean?

The address belongs to a cloud, hosting provider or data center. Websites, mail servers and VPN services normally look like this. But if your company uses neither a VPN nor a cloud security gateway, an employee signing in from such an address is unusual and worth investigating.

Why does Check my IP show an IPv6 address?

If your provider supports IPv6, your browser usually prefers it. Most connections have both an IPv4 and an IPv6 address, and other services may see either one. On computers and phones, the IPv6 address can also change over time. When allowing addresses in a firewall, account for both.

Want to know what an attacker sees on your public addresses?

A lookup tells you who an address belongs to. In a penetration test, we check which services run on your public IP addresses and whether an attacker could use them to get in.

Penetration testing

Suspicious sign-ins often start with a password stolen through phishing. In training, we show employees how to recognize fraudulent messages and fake sign-in pages.

Cybersecurity training