IP address lookup: who owns it, where it is, which network carries it

Paste an IPv4 address like 1.1.1.1 or an IPv6 address like 2001:4860:4860::8888 into the box at the top and press Look up. We check it against our database and open the full result page.

Don't have the IP yet? It travels with almost every connection a remote machine makes to you: the Received: line of an email header, a web server log, a torrent peer list, a forum that logs poster IPs. Take it from whichever side you control. Step-by-step guides are in How to Find an IP Address.

Tracking an IP to a location

An IP tracker and an IP lookup do the same thing: read where the network block is registered and return the country, region and city, with a map pin, the ISP, the ASN and the reverse DNS hostname. The pin is the centre of the city the ISP registered, not anyone's house. Looking up an IP is legal everywhere, because the address is public information carried by every packet.

To follow the path your packets take hop by hop, use the visual traceroute tool. To see how a name resolves around the world, use the DNS propagation checker.

Where an address is from, and how close a lookup gets

Every public IP belongs to a block that an ISP registered with one of five regional registries. The result shows the country and city the ISP put on that block. For consumer ISPs in the US, the EU and Australia that is usually within a city. For mobile carriers it is the regional gateway, for VPNs the exit server. Across our database country accuracy is around 99%, region 92%, city 70% to 80% in North America and Europe, and roughly 55% where ISP geofeeds are sparse. Every tool online reads the same registry data, so the accuracy band is similar everywhere; tools differ in how fresh their data is and how well they curate it.

IP lookup, IP trace, IP tracker, IP checker, IP locator, IP finder: all the same thing. No tool has a secret database, and no tool can hand you a person: the mapping from "IP at time X" to a customer exists only in the ISP's billing system, and police need a warrant for it. What is illegal is using the result to harass someone or break into a network.

How an address reaches your device

IANA hands big blocks to five regional registries: ARIN (North America), RIPE NCC (Europe and the Middle East), APNIC (Asia-Pacific), LACNIC (Latin America) and AFRINIC (Africa). They split the blocks among ISPs, hosts and large enterprises. When you connect, a router on your ISP's network leases you one address from a pool it owns, via DHCP. The registry record stays as it was.

IPv4, IPv6, and why v4 ran out

An IPv4 address is 32 bits written as four decimal groups: 203.0.113.45. Each group is one byte (0 to 255), which gives exactly 4,294,967,296 addresses. The old A, B, C classes were replaced in the 1990s by CIDR, which writes ranges as 203.0.113.0/24: the first 24 bits are fixed, the last 8 are hosts (256 addresses).

IANA's central pool ran dry on 3 February 2011. APNIC ran out in April 2011, RIPE in September 2012, LACNIC in mid-2014, ARIN in September 2015 and AFRINIC in 2017. Since then fresh IPv4 is bought on the transfer market at $30 to $50 per address, which is what finally pushed mobile carriers and CDNs onto IPv6.

IPv6 uses 128 bits, written as eight groups of hex: 2001:0db8:85a3:0000:0000:8a2e:0370:7334. Runs of zeros collapse to ::, so 2001:db8::1 is 2001:0db8:0000:0000:0000:0000:0000:0001. About 340 undecillion addresses, so nobody plans for exhaustion. IPv6 now carries roughly 40% of all Google traffic. A /48 is a typical home allocation, still 1.2 trillion times the whole IPv4 internet.

Private, static, dynamic and NAT

A few ranges never route across the public internet and return nothing in a lookup, because millions of networks use them at once:

• 10.0.0.0/8: 16 million addresses, corporate LANs
• 172.16.0.0/12: about 1 million addresses
• 192.168.0.0/16: 65 thousand addresses, what most home routers hand out
• 127.0.0.0/8: loopback, your machine talking to itself

Most home and mobile users get a dynamic IP that changes when the lease expires or the ISP rotates its pool. Servers pay for a static one because mail, VPN endpoints and certificates are tied to it. At home, ten devices share one public IP through NAT. Mobile carriers go further with Carrier-Grade NAT, thousands of customers behind a small pool, which is a big reason mobile geolocation lands on a regional hub.

CIDR in plain words

CIDR ("cider") writes a range as an IP, a slash and the number of leading bits that stay fixed: /32 is 1 address, /24 is 256 addresses (a typical small office), /16 is 65,536 addresses (a small ISP) and /8 is 16,777,216 addresses, of which only a few legacy ones exist.

ASNs, reverse DNS and WHOIS

Every network in global routing has an Autonomous System Number and announces its blocks over BGP: "to reach 203.0.113.0/24, send packets to AS12345". The ASN in a result is the network carrying the traffic right now, which can differ from the registered organisation. Reverse DNS turns an IP back into a name through PTR records in in-addr.arpa; mail servers distrust an IP without one, and residential PTRs like c-71-198-22-179.hsd1.ca.comcast.net leak the ISP and state, which geolocation mines. WHOIS is the original "who registered this block" protocol; its replacement RDAP returns the same record as JSON. Our result page shows the parsed fields and the raw record.

How geolocation works, and why two tools disagree

Country is solved because registries require ISPs to register it. City is an estimate stacked from rDNS hostnames that encode the POP (fra-pop1.example.net = Frankfurt), latency from probes around the world, operator geofeeds (Comcast, AT&T, Telstra, Deutsche Telekom and dozens more publish a CSV of their ranges), RIPE Atlas anchors and, weakest of all, the WHOIS street address, which is often just the HQ. When the sources agree, accuracy is high; when they don't, we fall back to the largest registered city in the country.

Vendors weigh these sources differently and refresh on different schedules, so two tools disagree when a block was just transferred, is anycast from several POPs, or the ISP reorganised without updating its geofeed. If a range you operate looks wrong here, send the geofeed URL or the correct values through the contact page and we patch the database.

VPN, proxy, hosting and mobile detection

Detection is mostly curated lists. Commercial VPNs (NordVPN, ExpressVPN, Mullvad, ProtonVPN and about 50 others) publish or leak their exit IPs. Cloud prefixes from AWS, GCP, Azure, OVH, Hetzner and DigitalOcean count as hosting because real users almost never connect from them. Tor exits are in the public consensus.

The connection type says a lot at a glance. Residential (Comcast, BT, Deutsche Telekom, Spectrum) is home broadband with real human traffic. Hosting (AWS, Hetzner, OVH, DigitalOcean) is servers: scripts, CDNs, VPN exits, bots. Mobile (T-Mobile, Vodafone, Orange) sits behind heavy CGNAT and lands on the carrier's hub. For fraud screening, an order from a hosting IP deserves more suspicion than one from a residential IP in the customer's city.

Reputation and blacklists

Mail servers and firewalls query DNSBLs before trusting an IP: Spamhaus (ZEN, SBL, XBL, PBL), SORBS, Barracuda, SpamCop and others, each tracking something different, from known spam sources to hijacked machines. One bad neighbour can taint a whole /24 because some lists work at block level. The result page folds the most used lists into one threat score; the Blacklist Checker shows the per-list breakdown.

What your IP reveals, and how to find yours

Your country, rough city, ISP and connection type. Not your name, address, phone, email or browsing history. The bigger privacy risk is the IP combined with cookies, browser fingerprints and account logins, which together identify you across sites even when you change networks. To see your own public address, open the IPWhois.net home page, or run curl ifconfig.me or curl ipwhois.net/ip in a terminal. That is the address your ISP NATs you behind, not the 192.168.x.x one your router gives your laptop.