Loading…
Geolocation · ASN · WHOIS · VPN/Tor · Blacklists · Reputation
Enter an IP, domain or ASN — or click My IP — to begin.
Look up any IP address, domain, ASN or CIDR block and get live geolocation, network ownership, WHOIS/RDAP registration, reverse DNS, VPN/proxy/Tor detection, blacklist status and a transparent reputation score — from real, keyless public sources. Investigate single addresses, analyse lists in bulk, export professional reports and integrate via a clean API.
Country, region, city, postal code, coordinates, timezone, currency and flag on an interactive map — from live geolocation providers.
Autonomous System number, ISP, organization, CIDR block, network range and connection type, enriched with RDAP.
Real registration data: net name, registry, allocation dates, abuse contact and administrative/technical contacts.
PTR (reverse DNS) plus full forward records — A, AAAA, MX, NS, CNAME and TXT — for any domain.
Flags datacenter/hosting ranges, anonymising proxies and live Tor exit nodes from the official Tor Project list.
Real-time DNSBL lookups across Spamhaus, Barracuda, SpamCop, SORBS and more — see exactly where an IP is listed.
A 0-100 reputation score derived from real signals — Tor/proxy/hosting flags, blacklist hits and geography — with recommendations.
Paste or upload TXT/CSV/JSON and analyse many IPs at once, then export the results table.
Instantly detect your own public IP, ISP, ASN and location — and check whether you appear on any blocklist.
Export a professional report as PDF, JSON, TXT or CSV for investigations and tickets.
A clean POST /api/ip-lookup endpoint with an interactive playground and copy-paste examples in 15 languages.
We only analyse the address you provide. No personal browsing data is collected; history is stored locally in your browser.
Type or paste an IPv4/IPv6 address, CIDR block, ASN, domain or URL — the tool auto-detects the type. Or click “My IP”.
Live data is gathered from geolocation, RDAP, DNS, the Tor exit list and DNS blocklists in parallel.
See geolocation on a map, network/ASN/WHOIS details, VPN/proxy/Tor flags, blacklist status and a reputation score.
Open WHOIS contacts, resolve DNS records, run blacklist checks, or analyse a whole list of IPs in bulk.
Copy results or download a professional report as PDF, JSON, TXT or CSV.
An IP (Internet Protocol) address is a numeric label assigned to every device that communicates on a network. It serves two jobs: identifying the host and providing its location within the network so data can be routed to it. When you visit a website, your device’s public IP is how the server knows where to send the response.
There are two versions in use. IPv4 uses 32 bits, written as four numbers from 0–255 (for example 8.8.8.8), giving about 4.3 billion addresses — long since exhausted. IPv6 uses 128 bits, written as eight groups of hexadecimal (for example 2001:4860:4860::8888), providing an effectively unlimited supply. This tool analyses both.
IPv4’s 4.3 billion addresses ran out years ago, which is why techniques like NAT (sharing one public IP among many devices) and CGNAT are common. IPv6 solves scarcity with a vast 128-bit space, restoring true end-to-end addressing and simplifying routing, with built-in autoconfiguration and improved multicast.
In practice both coexist. Many networks are “dual-stack”, serving content over whichever the client supports. For lookups, IPv4 still has the richest geolocation and blocklist coverage; IPv6 data is improving but some DNSBLs remain IPv4-only, which this tool reflects honestly in its results.
Public IPs are globally unique and routable on the internet; private IPs (ranges like 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16) are reused inside local networks and are not routable publicly. Your router typically has one public IP, while every device behind it uses a private IP, translated via NAT.
Reserved and special-purpose ranges — loopback (127.0.0.0/8), link-local (169.254.0.0/16), CGNAT (100.64.0.0/10) and documentation ranges — are collectively called “bogons”. They should never appear as a public source address, and this tool flags them so you can spot spoofed or misconfigured traffic.
An Autonomous System Number (ASN) uniquely identifies a network operator — an ISP, cloud provider, university or large enterprise — that controls a block of IP addresses and announces routes to them using BGP (Border Gateway Protocol). Every public IP belongs to exactly one originating ASN at a time.
Knowing the ASN is powerful for investigations: it tells you who actually operates the address (e.g. AS15169 Google, AS13335 Cloudflare), groups together all the IPs that organisation announces, and reveals whether an address sits in a consumer ISP or a cloud/hosting network. This tool resolves the ASN and enriches it with RDAP registry data.
IP geolocation is an estimate, not GPS. Providers build location databases by combining several signals: the registry data that says which organisation holds a block and where it is headquartered, the routing path and latency measurements between known points, and crowdsourced data from devices that report both their IP and GPS position.
As a result, country-level accuracy is typically very high (95%+), but city-level accuracy varies and coordinates often point to a region centroid rather than a precise address. Mobile networks, VPNs and large carriers can place a user far from their physical location. Treat city and coordinates as approximate, and never use IP geolocation to identify an individual.
All three hide a user’s real IP, but differently. A VPN encrypts all of a device’s traffic and routes it through a provider’s server, so destinations see the VPN’s IP. A proxy relays specific application traffic (often just web requests) through an intermediary. Tor routes traffic through at least three volunteer relays, so the destination only ever sees the final “exit node”.
For risk scoring, the distinction matters. VPNs are mainstream and used by ordinary privacy-conscious people; proxies and especially Tor exit nodes carry a higher base rate of abuse. This tool detects datacenter/hosting ranges (where most commercial VPNs live), proxy flags from intelligence providers, and live Tor exit nodes from the official Tor Project list — so you can apply proportionate controls rather than blanket blocks.
IP reputation summarises how trustworthy an address is, based on observable signals: whether it is an anonymiser (Tor/proxy/VPN), whether it belongs to a datacenter rather than a residential ISP, whether it appears on DNS blocklists for spam or abuse, and weak geographic signals. This tool combines those real signals into a transparent 0-100 score with the factors that drove it.
Reputation is a probability, not a verdict. A high-risk score means “apply more scrutiny” — step-up authentication, rate limiting, manual review — not necessarily “block”. Conversely a clean score is not a guarantee of safety. Always combine IP reputation with other signals (behaviour, device, account history) for decisions that matter.
Open-Source Intelligence (OSINT) is the practice of gathering information from publicly available sources. For network investigations, an IP is a common starting pivot: from it you can derive the ASN and owner, the hosting provider, the reverse DNS hostname, the registration and abuse contacts, and any blocklist history — building a picture of the infrastructure behind an event without any privileged access.
Threat hunters use these pivots to cluster related infrastructure (same ASN, same hosting provider, adjacent CIDR ranges), to attribute campaigns, and to find an abuse contact for takedown requests. Everything this tool surfaces comes from legitimate public sources, making it suitable for defensive investigation and reporting.
Every connection you make exposes your public IP to the destination server, along with metadata such as your approximate location and ISP. Combined with cookies, browser fingerprinting and account logins, this contributes to your digital footprint. Understanding what your IP reveals — try the “My IP” tab — is the first step to managing it.
To reduce exposure, use a reputable VPN, keep software updated, and be mindful that an IP identifies a connection, not a person. Law enforcement can compel an ISP to map an IP to a subscriber at a point in time, but a third party cannot turn an IP into a name or street address — which is why responsible tools, including this one, present geolocation as approximate and never claim to identify individuals.
Triage a suspicious IP from your logs — is it Tor, a proxy, a datacenter or a residential user, and is it blacklisted?
Pivot from an IP to its ASN, WHOIS owner, hosting provider and reverse DNS to map infrastructure.
Score sign-ups and transactions by IP reputation, flagging VPNs, proxies and blacklisted ranges.
Confirm geolocation, ASN ownership and CIDR allocation when diagnosing routing or peering issues.
Verify which country an address resolves to for geo-restrictions, licensing and data-residency checks.
Wire IP intelligence into your app with a simple JSON API and examples in 15 languages.
City-level IP geolocation is an estimate — country accuracy is high, but city/coordinates can be tens of kilometres off.
A datacenter/hosting IP is not automatically malicious, but it is unusual for a real end user — weight it in fraud scoring.
Tor exit nodes and open proxies hide the true origin; require step-up verification rather than hard-blocking.
Always confirm WHOIS ownership via the ASN and CIDR, not just the geolocation city.
Use the abuse contact from RDAP to report malicious activity to the responsible network operator.
Reverse DNS (PTR) often reveals the hosting provider and even the server role (mail, vpn, cdn).
For investigations, export the JSON report so you have a timestamped, machine-readable record.
Rate-limit and cache lookups — public data sources have fair-use limits.
A numeric label identifying a device on a network — IPv4 (e.g. 8.8.8.8) or IPv6 (e.g. 2001:4860:4860::8888).
The 32-bit address scheme with ~4.3 billion addresses, written as four dotted decimals.
The 128-bit successor with a practically unlimited address space, written as eight hex groups.
Autonomous System Number — a unique ID for a network operator that announces routes on the internet via BGP.
Classless Inter-Domain Routing notation (e.g. 8.8.8.0/24) describing an IP range by prefix length.
Registration data for IPs/domains. RDAP is the modern JSON replacement for legacy WHOIS.
A record mapping an IP back to a hostname — the opposite of a normal A record.
Estimating the physical location of an IP from registry, routing and measurement data.
Virtual Private Network — routes traffic through an intermediary server, masking the user’s real IP.
A server that relays requests on a client’s behalf, hiding the original IP.
The Onion Router — an anonymity network; the final “exit node” IP is what destinations see.
A DNS-based blocklist of IPs reported for spam or abuse (e.g. Spamhaus, SpamCop).
A score summarising how risky an IP is, based on anonymity, hosting type and blocklist history.
A private, reserved or unallocated address that should never appear as a public source.