IP Look Up Explained

An IP lookup takes an IP address and returns what public records say about it: which organisation owns the address block, which ISP or hosting provider announces it, an approximate location, and the reverse-DNS name if one is set. It does not return a name, a street address, or a phone number — that information is held by the ISP and released only through a legal process.

Where the data comes from

An IP lookup is really three separate queries against three different sources, and it helps to know which one you're relying on:

• Registry WHOIS (RDAP). The five Regional Internet Registries — ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC — publish the organisation each address block is allocated to, an abuse contact, and the allocation date. This is authoritative for ownership.
• Reverse DNS (PTR record). The block's operator can map an address back to a hostname, for example pool-71-x-x-x.nycmny.fios.verizon.net. Useful for spotting the ISP and the rough region, but it's optional and often generic or absent.
• GeoIP databases. Commercial datasets such as MaxMind GeoIP2 and IP2Location infer a city, region, latitude/longitude and connection type from BGP routing, registry data, and observed traffic. They are estimates, refreshed weekly, and licensed — not an official record.

At a glance:

How accurate is it?

Country-level geolocation is right well over 95% of the time. City-level accuracy is far weaker — often tens of kilometres off, and it degrades for mobile carriers (which route large regions through a few gateways), corporate VPNs, and CGNAT. Anyone using a VPN or proxy will geolocate to the exit node, not their real location. Treat GeoIP as a hint, never as proof of where someone is. Private ranges (10/8, 172.16/12, 192.168/16) have no public records at all — they're never announced on the public internet, so a lookup on one returns nothing.

How to run an IP lookup yourself

• Command line: whois 203.0.113.7 for ownership, dig -x 203.0.113.7 +short for the PTR record, mtr or traceroute to see the network path.
• Web tools: paste an address into an online IP lookup for a combined view of WHOIS, rDNS and GeoIP in one page.
• APIs: services such as ipinfo.io, ipapi, and MaxMind offer JSON endpoints for scripting bulk lookups — watch the rate limits and licence terms.

What people use it for

• Abuse handling: finding the right network's abuse contact to report spam, scraping, or attack traffic.
• Security triage: checking whether a login or request came from a residential ISP, a data centre, or a known VPN/Tor range, and enriching alerts with threat-intel reputation.
• Fraud and compliance: flagging a mismatch between the billing country and the connection country, or enforcing licensing and export rules.
• Operations: confirming that CDN and DNS geo-routing is sending users to the nearest region.

If a lookup on the addresses in your own account's login history turns up sessions from countries or providers you don't recognise, treat it as a compromise: change the password to a unique, high-entropy one — our free strong password generator makes one in a click — and revoke active sessions.