What is an IP lookup?
An IP lookup tells you who an IP address belongs to and roughly where it is. Enter any public IPv4 or IPv6 address and the tool shows its country, region and city, the network (ASN) and organization that operates it, and its reverse DNS name. It is the quickest way to answer questions like "who is hitting my server?", "where did this email come from?" or "is this login suspicious?".
The location comes from a regularly updated geolocation database, and the reverse DNS comes from a live DNS query, so the hostname is always current.
How to use the IP lookup tool
- Paste an IPv4 address (for example
1.1.1.1) or an IPv6 address (for example2606:4700:4700::1111) into the box. Spaces and brackets are removed automatically. - Press Enter or click Look up.
- Read the results. Every value can be copied, and the URL can be shared because it contains the IP you searched.
Want to know your own address? The What Is My IP page detects it automatically.
How to read the results
| Field | What it means |
|---|---|
| Type | IPv4 or IPv6. Private and reserved addresses are rejected because they have no public owner. |
| Country | Where the IP is used or routed. This is the most reliable field (around 99% accurate). |
| Region and city | An estimate of the area served by the network. Expect errors of 25–50 km, more on mobile networks. |
| Coordinates | The centre of the estimated area, not a precise position. Click to see it on a map. |
| ASN | The Autonomous System Number of the network that announces the IP on the internet. |
| Organization | The owner of that network: an ISP, a mobile carrier, a hosting or cloud company, a university or a large business. |
| Reverse DNS (PTR) | The hostname configured for the IP. It often reveals the provider or the purpose of the server. |
What does the ASN and organization tell you?
The organization field is often more useful than the location. It tells you what kind of connection the IP is:
- A residential ISP (for example Comcast, Vodafone, Telefónica): most likely a real person at home.
- A mobile carrier: a phone or a mobile hotspot. Many users share the same IP, so blocking it may block innocent people.
- A hosting or cloud provider (for example Amazon, Google Cloud, Hetzner, OVH, DigitalOcean): a server. Regular users do not browse from data centers, so traffic from these networks is usually bots, scrapers, VPNs or proxies.
- A VPN provider: the real user is hidden behind the VPN.
- A company or university: someone on that organization's network.
What is reverse DNS and why does it matter?
Normal DNS turns names into addresses; reverse DNS does the opposite. The owner of an IP range can publish a
PTR record that turns 8.8.8.8 into dns.google. Reverse DNS is important for:
- Email delivery: mail servers check that the sending IP has a PTR record and that it matches the server's name. Without it, mail often goes to spam or is rejected.
- Identifying servers: hostnames like
crawl-66-249-66-1.googlebot.comorec2-3-90-1-1.compute-1.amazonaws.comreveal who runs the machine. - Log readability: hostnames are easier to recognise than numbers.
Note that anyone who controls an IP range can set any PTR name, so it is a hint, not proof. To verify a bot like Googlebot, look up the PTR name with our DNS Lookup and check that it points back to the same IP.
Private and reserved IP addresses
Some ranges cannot be looked up because they are not used on the public internet. The tool explains why when you enter one:
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16: private networks (home, office, cloud VPC).127.0.0.0/8and::1: loopback, your own machine.100.64.0.0/10: carrier-grade NAT inside an ISP network.169.254.0.0/16andfe80::/10: link-local, assigned automatically when there is no DHCP server.fc00::/7: IPv6 unique local addresses, the IPv6 version of private ranges.192.0.2.0/24,198.51.100.0/24,203.0.113.0/24and2001:db8::/32: reserved for documentation and examples.
Common use cases
Investigating server logs
When you see a burst of requests or failed logins from one IP, look it up. A data center IP hammering your login page is almost certainly a bot and safe to block. A residential IP in your own country might be a real customer who forgot their password.
Checking email headers
Open the full headers of a suspicious email and find the first Received: from line added by your mail
provider. The IP there is the server that delivered the message. If a message "from your bank" was sent from a
random hosting provider abroad, it is phishing. Also check the sender domain with our
SPF Checker and DMARC Checker.
Fraud prevention
Compare the IP country with the billing country of an order. A mismatch is not proof of fraud (people travel and use VPNs), but combined with a hosting-provider ASN it is a strong signal.
Network troubleshooting
If traffic to a service is slow, look up the IPs in your traceroute to see which networks and countries the packets cross.
Limits of IP geolocation
IP databases are built from registry records, routing data and measurements, and they are updated regularly, but no database is perfect. IP ranges are sold and moved between countries, VPNs hide the real user, and mobile carriers route traffic through a few central gateways. Use the location as a strong hint for the country and a rough hint for the city. Never use it to identify a person.
IP geolocation data on this site is provided by DB-IP under the Creative Commons Attribution 4.0 license.