IP Address Lookup
Looking up address...

What is an IP lookup?

An IP lookup takes an IPv4 or IPv6 address — or a domain name, which it first resolves to an address — and matches it against public routing and geolocation databases. The result tells you which internet service provider or hosting company the address is registered to, which autonomous system (ASN) routes its traffic, and an approximate geographic region. It is not a way to find a person's name, street address, or identity: an IP address identifies a network connection, not an individual.

Where does this data come from?

The information on this page comes from public IP geolocation APIs that combine data from regional internet registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC), ISP-submitted records, and traffic-pattern analysis. DNS records (A, AAAA, MX, TXT, NS, PTR) are read live from public DNS-over-HTTPS resolvers, and the WHOIS-style details come directly from the RDAP service of the registry that manages the address block. Because several independent providers maintain their own databases, results for the same address can vary slightly between tools — none of them has perfect, real-time accuracy.

Why isn't the location exact?

Geolocation databases map IP ranges to the location where an ISP registered them, or to the ISP's own network infrastructure — not to the subscriber's actual address. For mobile networks, VPNs, and large ISPs that route traffic through a handful of regional hubs, this can place you hundreds of kilometers from your real location. The latitude and longitude shown here are usually the center of the ISP's service area for that range, which is why different lookup tools can disagree on your city or even your country.

RDAP vs. WHOIS — what's the difference?

WHOIS is an older, plain-text protocol for looking up who registered a domain or IP block; its output format differs by registry and is hard to parse reliably. RDAP (Registration Data Access Protocol) is its structured, machine-readable replacement, returning standard JSON over HTTPS with consistent field names across all five regional registries. This tool queries RDAP directly and summarizes the fields most people care about — network name, country, address range, and abuse contact — while still letting you inspect the full raw response if you need it.

IP Address Lookup: Geolocation, ISP, ASN, DNS and RDAP

This IP address lookup takes any IPv4 address, IPv6 address or domain name and returns the ISP, organization, ASN, approximate location, DNS records and registry record behind it. Type an address above and press Look up, or press My IP for the address you are connecting from. Every field comes from a public source: geolocation APIs, public DNS resolvers and the registry's own RDAP service.

What the lookup returns

The report opens with the address itself, marked IPv4 or IPv6, with badges for the network type the provider reports: VPN, Proxy, Tor, Datacenter or Mobile. The grid below lists ISP, organization, ASN, reverse-DNS hostname, country, region, city, coordinates, timezone and, for IPv4, the decimal form of the address. Then come the map, the DNS records and the full RDAP record. If you only want your own address, the what is my ip address page shows it with less around it.

Looking up an IPv4 address, an IPv6 address or a domain

The input accepts an IPv4 address such as 8.8.8.8, an IPv6 address such as 2606:4700::1111, or a domain such as example.com; a pasted URL is reduced to its hostname. A domain is resolved first, and every A and AAAA record appears as a chip that switches the report when clicked — big sites answer from several edge addresses, so "the IP of this domain" is usually a set.

Private addresses (10.x.x.x, 192.168.x.x, 127.0.0.1, ::1) return a notice instead: they are not routed on the public internet, so no registry or geolocation database holds them. Each query stays in the URL as ?q=, so results can be shared.

Reading the RDAP registry record

The WHOIS / RDAP block is the authoritative part of an IP address lookup. It is served by the regional internet registry that allocated the block — ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC — and the query is bootstrapped to whichever one holds the address.

The summary shows the handle, network name, registered country, address range, CIDR block, registration and last-changed dates, and the abuse contact: the mailbox the operator published for reports of scanning, spam or attacks from that range. The raw-JSON toggle shows the untouched response.

WHOIS vs RDAP, and why RDAP replaced it

RDAP returns the same registration data WHOIS did, as JSON over HTTPS instead of free-form text over port 43. WHOIS dates from 1982 and never had a response format: every registry printed its own labels in its own layout, so reading it meant maintaining per-registry text parsers. It also had no encryption and no way to vary detail by requester.

RDAP fixes that with defined JSON fields, TLS, internationalized data and tiered access. All five regional registries have run it for years, and ICANN made it the required registration-data service for gTLDs on 28 January 2025. WHOIS survives as a label — hence the section heading — but the data arrives over RDAP.

ASN and netblock ownership

The ASN is the routing identity behind an address: a set of prefixes announced to the internet under one routing policy over BGP, written with an AS prefix — AS15169 is Google, AS13335 is Cloudflare. Keep two facts apart: the organization holding the netblock in the registry, and the autonomous system announcing it. A host can hold a /19 and sublet a /24 to a customer who never appears in RDAP.

The CIDR field shows how large the allocation is: a /29 is a few addresses at one customer, a /16 a whole ISP pool. To turn a prefix into host counts and ranges, use the subnet calculator.

The DNS records this lookup returns

Look up a domain and the DNS block returns A (IPv4), AAAA (IPv6), MX (mail), TXT and NS (nameservers), read live from a public DNS-over-HTTPS resolver rather than your system cache. MX shows who really handles the mail, often a different company from the site host; TXT holds SPF and DMARC policies; NS shows who controls the zone, which answers "where is this domain run from?" better than an A record pointing at a CDN edge.

Look up an IP and there is one row instead: PTR, the reverse DNS name, published by whoever controls the address block rather than by the domain owner — which is why it reads like a machine name from the ISP's own scheme. No PTR record is normal, and a PTR only means something when the forward lookup of that name returns the same address.

How accurate is IP geolocation really?

Country is usually right; city often is not. Vendors put country-level accuracy in the 95–99% band and US city-level accuracy at roughly two-thirds of addresses within 50 km of the correct city, ranging from about 20% to 75% elsewhere — their own numbers about their own products.

The cause is structural: an ISP aggregates subscribers at a few points of presence in larger cities and routes them out from there, so the coordinates are the center of the range's service area, exactly as the map caption says. Mobile is worse, because carrier-grade NAT puts thousands of subscribers behind a handful of regional gateways.

A cloud range registered to a head office in one country can also run on the other side of the world, which is part of why two lookup sites show two cities for one address. When an address is flagged VPN, proxy or datacenter, the location belongs to that infrastructure; the vpn check digs into those signals.

What an IP address lookup cannot tell you

It cannot tell you who someone is, and anyone trying to identify a person from an IP address lookup will get it wrong.

Geolocation is a commercial estimate. City, region and coordinates come from databases built out of registry records, ISP submissions, routing data and inference. They are frequently wrong at city level, lag by weeks when blocks are transferred, and for mobile carriers and CGNAT can be wrong by hundreds of kilometres while still looking confident.

Registry data describes a netblock, not a user. RDAP tells you which organization holds a range today and who to email about abuse from it. It does not record who was using an address at a given minute: addresses rotate through DHCP pools, are shared by hundreds of subscribers behind one NAT gateway, and get reassigned between customers.

Only the ISP can tie an address to a subscriber, from its own logs, and it does so under a court order rather than on request. Anyone claiming to have traced you to your street from your IP has read a database's center point for your ISP's service area. Use the lookup for what it is good at: the network behind an address, a domain's DNS, and the right abuse contact.

Frequently asked questions

My IP address and my actual location don't match up — is that normal?

Yes, and it is the normal case rather than the exception. Your address is assigned from your ISP's pool and geolocates to wherever that pool is registered or routed, which is often a larger city some distance away. A dynamic address that changes also changes the city the databases report, without anything happening on your end. Nothing about a mismatch indicates a compromised account or device.

Why does my IP address show different locations on different sites?

Because each site uses a different geolocation database, and no two are built the same way. Vendors combine registry records, ISP-submitted geofeeds, routing data and inference, then refresh on their own schedules. When a block is transferred or re-routed, one vendor may pick the change up in days and another in months. Country-level answers usually agree; city-level answers routinely differ by tens or hundreds of kilometres.

How can I find out who owns an IP address?

Run the lookup and read the RDAP block: it names the organization that holds the netblock, the registered country, the CIDR range and the abuse contact. That is genuine ownership information, published by ARIN, RIPE, APNIC, LACNIC or AFRINIC. What it does not give you is the person or household using the address — that mapping exists only in the ISP's internal logs and is released under legal process.

How do I find out where someone is based on their IP?

You cannot, beyond a rough region, and the answer is often the wrong city. A lookup returns the ISP and an estimated service area, so at best you learn which provider and which broad area the connection uses. Mobile, satellite and VPN addresses land hundreds of kilometres from the user. Treating the coordinates as someone's location is the single most common mistake made with this tool.

How do I change my IP address back to my state of residence?

You cannot change it yourself — the address comes from your ISP's pool, and the location attached to it lives in third-party databases. Restarting your router may get you a new dynamic address, but it comes from the same pool and usually geolocates the same way. If a service is blocking you over the wrong state, ask your ISP to correct its geofeed, and report the range to the geolocation vendor the service uses.

Why does ARIN show a different location than the geolocation services?

Because they answer different questions. ARIN and the other registries record where the holder of the netblock is registered — often a head office — while geolocation vendors try to estimate where the addresses are actually deployed. A range registered in Redmond can run in Tokyo. Vendors mostly follow the operator's published geofeed rather than the registry, so registry country and geolocation country legitimately disagree.

How do I get the real IP address of a domain?

Look up the domain here and read the A and AAAA records — those are the real addresses the domain publishes, and every one of them appears as a chip you can inspect. If the domain sits behind a CDN or proxy, the published addresses belong to that network, and that is the whole point of it; the origin server is deliberately not in DNS. Check the NS and MX records to see who actually runs the zone and the mail.