IP Geolocation Lookup

IP geolocation lookup: find the country, network and ISP behind an address

Paste an IPv4 or IPv6 address into the box and press lookup. You get back the country, region, city, postal code, latitude and longitude, timezone with the current local time, currency, and — usually the more useful half — the ISP, the organisation name and the ASN that announces the address. There is a map, buttons to export the result as JSON or CSV, and a history of your last ten lookups kept in your browser.

This page is about looking up somebody else’s address: an IP out of a firewall log, a failed login alert, an email header, a comment-spam record. If you only want to know your own public address, our what-is-my-ip tool answers that directly. The button marked “Use my IP” here exists only as a shortcut for filling the field.

The honest answer on accuracy, before you rely on a result

Geolocation from an IP address is an inference, not a measurement. Nothing in the IP protocol carries a location. There is no GPS involved, no cell tower, no signal from the device. What a geolocation database holds is a set of guesses about where the network that owns an address range tends to put its customers, and the quality of those guesses varies enormously between one range and the next.

The practical split is this: country is usually right, city is often badly wrong. Country-level attribution rests on registry allocation records, which are administrative facts rather than estimates — a block delegated to an ISP operating in one country is generally used there. City-level attribution rests on much softer evidence, and it can be wrong by hundreds of miles without anything in the result flagging that it is wrong. A city name and a pair of coordinates always look equally confident whether they came from a precise ISP-published record or from a fallback guess.

The single most misleading behaviour to know about is the fallback centroid. When a provider knows an address is in a given country but has no finer information, it does not return “unknown”. It returns a coordinate pair — typically a point chosen to represent the country as a whole. Those default points accumulate huge numbers of unrelated addresses, and they are the reason people occasionally find that an entire nation’s worth of anonymous IP traffic appears to originate from one unlucky address, farm or field. If a result puts a residential ISP customer at the exact geographic middle of a large country, treat that as “no city data” rather than as a location.

How the databases are actually built

Note what is absent from that list: any input from the device itself. A browser can ask for real device location through the geolocation permission prompt, and that is a completely different mechanism with completely different accuracy. IP geolocation never touches it.

The chain also has a lag problem. Address blocks are transferred, subleased and re-pointed constantly, and a database that refreshed last month may still describe last year’s customer. That is the ordinary case, not an edge case.

What routinely breaks the answer

• VPNs and proxies. You get the exit node’s location, which is the entire point of the product. The result will often be a hosting provider in a datacentre city.
• Mobile carriers. Carriers aggregate subscribers behind large gateways. A phone in one city can present an address that geolocates to the carrier’s core network several regions away, and the answer can change as the handset moves between gateway pools rather than between places.
• Carrier-grade NAT. Under CGNAT (the shared address space is 100.64.0.0/10, reserved by RFC 6598) many thousands of subscribers share one public address. There is no per-subscriber location to find, and there is no way to distinguish them from outside.
• Corporate egress. A company that backhauls all internet traffic through one or two breakout points makes every employee appear to sit at those points, regardless of which office or country they are in.
• Cloud and hosting ranges. These geolocate to the region a datacentre is in, which tells you where a server lives and nothing about the person driving it.
• Satellite and roaming. Both can present addresses anchored to a ground station or home network far from the user.
• IPv6 sparsity. IPv6 blocks are newer and less thoroughly mapped than IPv4. Country-level attribution is normally fine; finer detail is frequently missing or inherited from a very large parent allocation.

Every one of those cases produces a confident-looking city. None of them produce a warning.

Running a lookup

Type or paste the address and press the lookup button, or click one of the sample addresses (8.8.8.8, 1.1.1.1, 142.250.80.46) to see the output shape. Both IPv4 and IPv6 are accepted — 2606:4700:4700::1111 is a valid input.

Input is validated in your browser before anything is sent. A malformed address is rejected with a format error. A private or local address is recognised and refused with an explanation rather than being sent off to fail somewhere else, which covers these ranges:

This is the single most common surprise for people new to the task. 192.168.1.14 has no location because it is not a globally routable address — it exists identically inside millions of separate networks. If a log line shows you a private address, the location you actually want is inside that network’s own DHCP or switch records, not out on the internet.

Be clear about the privacy model here, because it differs from most tools on this site: the lookup is not done entirely in your browser. The address you enter is sent to our server, which queries an external geolocation provider on your behalf and returns a normalised result. It works this way because the upstream providers do not permit direct browser calls. Validation, history and exports are local; the lookup itself is a network request. If the first provider is unavailable the request falls through to a second and then a third, which is why an occasional lookup returns slightly different field detail than the one before it — different providers populate different fields.

Reading the result

The output is grouped into three blocks plus a map. Every field has a copy button, and the whole record can be copied as JSON or downloaded as JSON or CSV for pasting into a ticket or a spreadsheet.

• Location — country, region or state, city, postal code, latitude and longitude. Treat with the scepticism described above.
• Network — ISP, organisation, ASN. This is the part you can usually trust. The ASN and organisation name tell you whether you are looking at a residential broadband customer, a mobile carrier, a hosting company or a corporate network, and that classification is far more actionable than a city name.
• Time and locale — timezone, the current local time in it, and currency where the provider supplies it.
• Map — an embedded OpenStreetMap view centred on the coordinates, with links out to Google Maps and OpenStreetMap. The map marker is exactly as accurate as the coordinates behind it, and no more.

Two cross-links appear next to the address in the result header: one to the BGP/AS tool for the routing view of the same address, and one to the risk checker for hosting, proxy and reputation indicators. Both carry the address across for you.

History and shareable links

Your last ten lookups are stored in your browser’s local storage so you can jump back to an address without retyping it. Clicking one re-runs it. The clear button wipes the list. Nothing is stored server-side against you, and the list never leaves your machine.

A successful lookup writes the address into the page URL. Copy that URL and it becomes a link that re-runs the same lookup automatically for whoever opens it — convenient for handing an address to a colleague inside a ticket, and worth remembering if you would rather not put an address into a shared document.

Where this is legitimately useful

• Log triage. Not to place a person, but to classify a source. An authentication attempt from a hosting ASN against an account that has only ever signed in from residential broadband is a real signal; the city attached to it is not.
• Fraud scoring as one input. A country mismatch against a billing address is worth a point in a wider model. It is not evidence on its own, and it should never be the only reason an account is blocked, because travellers and VPN users are ordinary people.
• Content licensing and regional routing. Country-level accuracy is generally adequate for choosing a catalogue, a currency or a nearby endpoint. This is the use case IP geolocation is genuinely good at.
• Abuse reporting. The organisation and ASN give you the network to contact. That is what an abuse report needs; a city does not appear in it.
• Compliance and access geofencing. Workable at country granularity, with the explicit understanding that VPN users pass straight through it.

The uses that do not work are equally worth stating. An IP address does not identify a person, a household or a street. It identifies a network interface, sometimes shared by thousands of people, sometimes reassigned within the hour. Law enforcement resolves an address to a subscriber by asking the ISP with legal authority, using the ISP’s own timestamped assignment records — a route that exists precisely because public geolocation cannot do it.

Common questions

Why does it say the wrong city for my own address? Most often because your ISP has not published fine-grained data for the block you were assigned, so the database fell back to a regional or national default. It can also mean your traffic egresses somewhere other than where you sit.

Can I stop my address from being geolocated? Not directly, since the data is compiled about the network rather than about you. A VPN substitutes a different address; that is the practical option. Some database vendors accept correction requests for a specific address, but the correction has to propagate to every provider separately.

Why do two lookup sites disagree? Because they compile different evidence, refresh on different schedules, and fall back differently when data is missing. Disagreement between providers is normal and is itself a useful signal that the finer detail is unreliable.

Does the person whose address I look up find out? No. The query goes to a geolocation database, not to the address. No packet is sent to the host you are researching.