You check your server logs and see 847 failed SSH login attempts from 185.220.101.34. Or a customer disputes a charge, claiming they never placed the order, but your fraud system flagged their IP as originating from a different country than their billing address. Or you receive a threatening email and want to know where it came from before deciding whether to involve law enforcement.
In all three scenarios, the first move is the same: look up the IP address. But what that lookup actually returns — and, critically, what it doesn't return — is widely misunderstood. Television shows depict IP lookups producing street addresses and suspect photos. The reality is both more useful and more limited than that.
This guide covers what an IP address lookup actually tells you, how the underlying databases generate that data, where lookups reliably fail, and how to perform one correctly using our IP lookup tool. If you want background on the geolocation technology itself, see our explainer on how IP geolocation works.
In this article
What an IP Address Lookup Actually Returns
An IP address lookup queries one or more geolocation databases and returns a set of fields about that address. Here's what each field means and how reliable it is.
ISP / Organization
The Internet Service Provider or organization that controls the IP block. This is one of the most reliable fields in any lookup — it comes directly from Regional Internet Registry (RIR) records, which are authoritative. If a lookup says an IP belongs to Comcast, AT&T, or Amazon Web Services, that's almost certainly correct. The ISP field tells you whether you're dealing with a residential connection, a business line, a cloud hosting provider, or a mobile carrier. That distinction alone is often more useful than the city.
ASN (Autonomous System Number)
Every network on the internet is assigned an ASN — a unique identifier used in BGP routing. AS15169 is Google. AS13335 is Cloudflare. AS7922 is Comcast. The ASN is authoritative data pulled from routing tables, not estimated. It tells you which network the IP belongs to at the routing level. Security analysts use ASNs extensively: if you see attack traffic from AS213371, you can look up that ASN and identify the hosting provider, then file an abuse report directly. The ASN is also useful for identifying whether an IP belongs to a known VPN provider, hosting company, or residential ISP.
Approximate city and country
This is the field most people care about and the field most often misunderstood. The city returned by an IP lookup is an estimate based on where the ISP's infrastructure is located for that IP block, not where the user physically sits. Country-level accuracy is excellent: 95–99.8% across major providers. City-level accuracy drops to 55–70% globally, with enormous variation by country and connection type. We covered the exact numbers in our IP geolocation accuracy data breakdown.
Coordinates and accuracy radius
Most lookup tools return latitude and longitude, which creates a false impression of precision. Those coordinates represent the estimated center of the area where the IP is likely located, not the user's position. The accuracy radius — which many tools display but users often ignore — is the critical context. A 5 km radius means high confidence in a dense metro area. A 200 km radius means the database essentially placed the pin somewhere in the right state and called it a day.
Connection type
Whether the IP is residential broadband, cellular/mobile, business, hosting/datacenter, or satellite. This field is derived from a combination of ASN classification and ISP metadata. It matters because connection type directly predicts geolocation accuracy: broadband IPs geolocate reliably, cellular IPs often don't, and satellite IPs (Starlink) are frequently wrong by hundreds of kilometers.
Proxy / VPN / Tor flags
Many lookup services flag whether an IP is associated with a known VPN service, proxy network, or Tor exit node. These flags are generated by maintaining databases of known VPN server IP ranges, scanning for open proxy signatures, and monitoring Tor's published exit node list. Detection rates for commercial VPNs range from 60% to 95% depending on the provider and how frequently the VPN rotates its IP addresses. For more detail, see our guide on VPN detection methods.
Hostname (reverse DNS)
If the IP has a PTR record configured, the lookup returns a hostname like pool-72-83-123-45.washdc.fios.verizon.net. This is genuinely useful — the hostname often encodes the ISP name, the city or region abbreviation, and the connection type right in the string. Not all IPs have reverse DNS configured, but when they do, the hostname can confirm or add context to the other fields.
How IP Lookup Databases Work
When you enter an IP into a lookup tool, you're not querying the internet in real time. You're querying a pre-built database that maps IP address ranges to locations and metadata. Understanding how these databases are assembled explains both their strengths and their failure modes.
WHOIS and Regional Internet Registries
The foundation of every IP lookup is the RIR system. Five Regional Internet Registries — ARIN (North America), RIPE NCC (Europe/Middle East), APNIC (Asia-Pacific), LACNIC (Latin America), and AFRINIC (Africa) — allocate IP blocks to ISPs and organizations. Each allocation record includes the organization name, country, and contact information. This is authoritative data: when an IP is allocated to Comcast in the US, that's a fact, not an estimate. The ISP, organization, and country fields in most lookups trace back to RIR data.
Geolocation databases: MaxMind, IP2Location, DB-IP
City-level mapping is where the estimation begins. Providers like MaxMind, IP2Location, and DB-IP build their databases by combining multiple data sources:
- RIR allocation data — the starting point for country and organization
- BGP route announcements — how IP blocks are actually routed across networks, which can differ from registry records
- Active latency probing — sending pings from known locations and using round-trip times to triangulate approximate position
- ISP self-reported data — RFC 8805 geofeeds allow ISPs to publish CSV files mapping their IP prefixes to locations
- User-submitted corrections — MaxMind and others accept correction requests when users report incorrect mappings
- GPS ground truth from mobile apps — providers like Digital Element collect GPS coordinates from 1.5 billion mobile devices per 30-day window, generating 60–70 million validation data points daily
The result is a massive lookup table: given an IP address, return the best-guess location and metadata. MaxMind's GeoIP2 City database, for example, covers every allocated IPv4 and IPv6 address and updates every weekday for paid subscribers.
BGP route data and ASN mapping
The Border Gateway Protocol is how the internet's routers decide where to send traffic. BGP announcements are public and observable: services like RIPE RIS and RouteViews collect them continuously. By monitoring which ASN announces which IP prefix, lookup providers maintain an authoritative mapping of IPs to networks. This is how the ASN field stays accurate even when geolocation lags behind — BGP data reflects the current state of routing, not historical registry filings.
What IP Lookups Can't Tell You
The gap between what people expect from an IP lookup and what it actually delivers is enormous. Here are the specific limitations, with numbers.
No exact address — ever
IP geolocation's engineering floor is approximately 5 km. MaxMind's GeoIP2 database uses 5 km as its minimum accuracy radius even in the best case. In practice, for most residential IPs, you're looking at a 10–50 km radius. The lookup gives you "somewhere in the Denver metro area," not a street address. The only entity that can map an IP to a physical address is the ISP, and they require a court order or law enforcement subpoena to release subscriber information.
No identity information
An IP lookup tells you which ISP controls the address, not who is using it at any given moment. A residential IP might be shared by a family of four. A coffee shop's IP is shared by dozens of strangers. A corporate IP is shared by hundreds of employees behind a NAT gateway. The lookup shows "Comcast, Chicago area" — it does not and cannot show "John Smith, 45, accountant."
Mobile accuracy is poor
IEEE research found that only 3% of cellular IPs geolocate within 1 km accuracy, compared to 17% for WiFi/broadband connections. Mobile carriers route traffic through regional switching centers that can be in entirely different cities or states from the subscriber. A T-Mobile customer in rural Kansas might exit through a gateway in Kansas City — or Omaha. The lookup faithfully reports the gateway's location, which is technically correct (it's where the traffic enters the public internet) but geographically misleading.
VPN and proxy masking
An estimated 1.75 billion people use VPNs globally (APNIC, December 2025). When a user connects through a VPN, the IP lookup returns the VPN server's location, not the user's. A user in Moscow connecting through a NordVPN server in Amsterdam will look up as "Netherlands, Amsterdam, datacenter IP." Our VPN detection guide covers how detection works and its limitations — but even when a VPN is detected, the user's real location remains hidden.
CGNAT shared IPs
Carrier-Grade NAT means hundreds or thousands of users share a single public IP address. Over 100 million users worldwide are behind CGNAT. When you look up a CGNAT IP, you get the location of the carrier's NAT gateway, which might serve an area spanning 100+ km. The IP alone cannot distinguish between any of those users. This is increasingly common as IPv4 exhaustion forces more ISPs into address sharing.
How to Look Up an IP Address
The process is straightforward. Here's how to do it using our IP address lookup tool, with notes on interpreting the results.
Step-by-step IP lookup process
Step 1: Get the IP address. You need the IP you want to investigate. Common sources: server access logs, email headers (use our email header analyzer to extract the originating IP), firewall or IDS alerts, web analytics platforms, a tracking link that captures a visitor's IP when they click, or the IP displayed on the IPTrackerOnline homepage (which shows your own IP).
Step 2: Enter it into the lookup tool. Go to iptrackeronline.com/ip-lookup/ and enter the IP address. Both IPv4 (e.g., 185.220.101.34) and IPv6 (e.g., 2001:0db8:85a3::8a2e:0370:7334) addresses work. If you leave the field empty, the tool looks up your own IP.
Step 3: Review the structured results. The tool returns: ISP/organization, ASN, country, region/state, city, coordinates with accuracy radius, timezone, connection type, hostname (if available), and proxy/VPN/Tor detection flags.
Step 4: Interpret with context. Check the accuracy radius first — if it says 200 km, the city is a rough estimate. Look at connection type: if it's cellular or satellite, the location data is less reliable. Check the proxy/VPN flags: if flagged, the location represents the proxy server, not the actual user. Cross-reference the hostname with the ISP field for confirmation.
Looking up IPs from email headers
Email headers contain a chain of "Received:" fields showing each server that handled the message. The originating IP is typically in the first (bottom-most) "Received:" header. However, this can be spoofed in some configurations, and many email services (Gmail, Outlook.com) strip the sender's IP for privacy, replacing it with their own server IPs. Our email header analyzer parses these headers automatically and flags which IPs are from mail servers versus potentially from the sender.
Bulk lookups via API
If you need to look up hundreds or thousands of IPs (common in log analysis and fraud screening), a web tool isn't practical. Our IP lookup API returns the same data in structured JSON, supporting batch queries. Most security teams integrate IP lookup APIs into their SIEM or fraud detection pipelines, automatically enriching incoming events with geolocation and threat intelligence data.
Free vs Paid IP Lookup Services
There's a widespread assumption that paid IP geolocation services are significantly more accurate than free ones. The data doesn't fully support that assumption.
Here's what you actually get at each tier:
| Feature | Free Tier | Paid Tier |
|---|---|---|
| Country accuracy | 95–99% | 95–99.8% |
| City accuracy (50 km) | 50–65% | 55–70% |
| Update frequency | Monthly or bimonthly | Weekly to daily |
| ISP / ASN data | Basic (ISP name only) | Detailed (connection type, user count estimates) |
| Proxy / VPN detection | Usually not included | Included with threat scores |
| API rate limits | 1,000–50,000/month | 100,000–unlimited/month |
| IPv6 coverage | Partial | More comprehensive |
The practical takeaway: if you're performing occasional lookups on individual IPs, free tools (including ours) give you everything you need. If you're processing millions of queries, need VPN detection, or require fresher data for fraud prevention, a paid tier is worth it — but for the metadata and update frequency, not for fundamentally better coordinates.
Common Use Cases
IP lookups serve different purposes depending on what you're trying to accomplish. Here are the most common use cases with practical notes on how reliable the data is for each.
Fraud detection and prevention
The most valuable IP lookup signal for fraud isn't the city — it's the country mismatch. When a credit card with a US billing address is used from an IP geolocating to Romania, that's a strong fraud indicator even with city-level uncertainty. Payment processors and e-commerce platforms use IP lookups as one signal in multi-factor fraud scoring. The connection type matters too: a purchase from a datacenter IP or a known VPN exit node is more suspicious than one from a residential broadband connection.
Website analytics and audience insights
Google Analytics and similar platforms use IP geolocation to report where your visitors come from. At the country and region level, this data is reliable enough for business decisions. At the city level, treat it as directional rather than precise. If your analytics show 30% of traffic from "New York," some of that is from the broader metro area or even New Jersey users whose ISPs route through New York infrastructure.
Security incident investigation
When you see 847 failed SSH attempts from a single IP, a lookup tells you the ISP, the country, and whether it's a known hosting provider or VPN. That's enough to decide whether to block the IP, report the abuse, or escalate to law enforcement. For incident response teams, the ASN is often more actionable than the city: "this is a Hetzner server in AS24940" tells you exactly where to send the abuse report. For deeper investigation, see our guide on tracking an IP address.
Email header tracing
Phishing emails, spam, and threatening messages all pass through mail servers that log IP addresses in headers. Looking up the IPs in those headers helps identify the sending infrastructure. Be cautious: sophisticated attackers route through compromised servers, so the IP in the header might belong to an innocent third-party machine that was hacked. Our email header analyzer walks through the full chain and highlights which hops are potentially from the actual sender.
Compliance and geo-blocking
Content licensing (Netflix restricting titles by country), regulatory compliance (GDPR applicability based on user location), and sanctions enforcement (blocking access from embargoed countries) all rely on IP geolocation. For country-level decisions, the 95–99% accuracy rate makes IP lookup a standard industry practice. The gap is VPN users — someone in a sanctioned country using a VPN in Switzerland will bypass country-only checks, which is why compliance teams layer VPN detection on top of geolocation.
When IP Lookups Fail
There are specific, predictable scenarios where IP lookups produce misleading or useless results. Knowing these failure modes lets you recognize when to trust a result and when to discount it.
Starlink and satellite internet
With over 4 million subscribers and growing rapidly, Starlink is the fastest-growing failure case for IP geolocation. Starlink routes traffic through ground stations that can serve areas spanning hundreds of miles. A subscriber in rural Wyoming might have their traffic exit through a ground station in Oregon. Inter-satellite laser links can route traffic to a ground station on a different continent entirely. APNIC has documented cases where Starlink IPs geolocate to the wrong country. The lookup correctly identifies SpaceX/Starlink as the ISP, but the location data is unreliable.
CGNAT (Carrier-Grade NAT)
Over 100 million internet users share IP addresses through CGNAT. When a mobile carrier or budget ISP assigns one public IP to hundreds of subscribers, a lookup on that IP returns the NAT gateway's location, which might cover a 100+ km service area. You can't distinguish between users behind the same CGNAT IP. This is increasingly common: as IPv4 addresses become scarce, more ISPs deploy CGNAT rather than purchasing expensive address blocks on the transfer market.
Mobile carriers
Even without CGNAT, cellular networks route traffic through regional hubs that are often far from the subscriber. IEEE research across multiple countries found that 33–80% of mobile IP samples were assigned to the wrong administrative region. A lookup on a cellular IP reliably identifies the carrier (AT&T, Vodafone, etc.) but the city is frequently wrong. This is structural, not a database deficiency — the IP genuinely routes through a distant gateway.
VPN and Tor
VPN traffic geolocates to the exit server by design. If a user in Tokyo connects through a VPN server in Frankfurt, every IP lookup will say "Frankfurt." Tor is similar but more extreme — traffic exits through volunteer-run nodes scattered worldwide, and the exit node changes with every circuit. Tor exit nodes are published in a public list, so they're detectable, but the user's real location behind Tor is effectively hidden. The lookup works perfectly (it correctly identifies the exit node's location); it's just that the exit node location has no relationship to the user's location.
IPv6 transition
IPv6 now carries over 40% of global internet traffic (Google IPv6 statistics). Geolocation databases have less historical data for IPv6 addresses because the protocol is newer and address blocks are allocated in much larger prefixes. Radboud University research found IPv4 geolocation achieves approximately 90% country-level accuracy while IPv6 drops to 40–60%. As IPv6 adoption continues growing, a significant share of lookups will hit the less mature part of the database.
IPv4 address market transfers
IPv4 addresses are now routinely bought and sold between organizations, sometimes across continents. An IP block registered to a company in Virginia might be sold to one in Singapore. Until every geolocation database processes the transfer — which can take weeks to months — lookups on those addresses return the old location. IP2Location reports that 5–10% of their records change monthly, and they estimate 1–5% accuracy loss per month without updates. A database that's six months stale could be 10–30% less accurate at the city level than a current one.
Try It Yourself
Look Up Any IP Address
Enter an IP to see its ISP, location, ASN, connection type, and proxy/VPN detection flags. No registration required.
Open the IP Lookup ToolA few things to try: look up your own IP and compare the city against your actual location. If you're on home broadband, it should be within 25–50 km. If you're on cellular, it might be off by a city or more. If you have a VPN, connect to it and look up your IP again — you'll see the VPN server's location instead of yours. Then check the same IP on multiple lookup tools to see if they agree on the city. When they disagree, you're seeing the 620 km average discrepancy between databases that IEEE documented across 6.3 million IPs.
For developers and security teams who need programmatic access, our IP lookup API returns the same data in structured JSON, suitable for integration into SIEM systems, fraud detection pipelines, and analytics platforms.
Frequently Asked Questions
What does an IP address lookup actually tell you?
An IP lookup returns the ISP or hosting provider, the Autonomous System Number (ASN), an approximate city and country (typically within 5–50 km for broadband), the organization that registered the IP block, connection type (broadband, cellular, satellite), hostname if reverse DNS is configured, and proxy/VPN/Tor detection flags. It does NOT reveal a street address, the name of the person using the connection, or any browsing history.
Can I find someone's exact location from their IP address?
No. IP geolocation has a minimum accuracy radius of approximately 5 km (MaxMind's engineering floor). For most residential IPs, accuracy is within 25–50 km. For cellular connections, the error can be hundreds of kilometers. Only the ISP can map an IP to a specific subscriber address, and they require a valid court order or law enforcement subpoena to disclose that information.
Why does an IP lookup show the wrong city?
Common causes include: cellular carriers routing traffic through regional hubs in different cities, CGNAT (Carrier-Grade NAT) sharing one IP across hundreds of users in different locations, VPN or proxy servers masking the real location, Starlink mapping to ground stations rather than subscriber locations, and ISPs transferring IP blocks between regions without updating geolocation databases. The lookup correctly identifies where the traffic exits the network — that just isn't always where the user is.
Is IP lookup legal?
Yes. Looking up publicly available information about an IP address — ISP, approximate location, ASN — is legal in all jurisdictions. IP addresses are part of the public routing infrastructure of the internet. What you do with the information may be subject to privacy laws (GDPR, CCPA), but the act of performing a lookup against publicly available geolocation databases is not restricted.
What is the difference between IP lookup and IP tracking?
An IP lookup is a single point-in-time query: you enter an IP and get back its current geolocation and network data. IP tracking implies ongoing monitoring — logging an IP's activity over time, correlating it with other data points, or following a user across sessions. A lookup tells you where an IP is registered right now. Tracking builds a behavioral profile over time. Most free tools, including IPTrackerOnline, perform lookups, not tracking.
Do free IP lookup tools give accurate results?
For most purposes, yes. University of Chicago research found that paid geolocation databases are not significantly more accurate than free versions for residential broadband IPs. Country-level accuracy is 95–99.8% across both free and paid providers. City-level accuracy averages 55–70% regardless of tier. The main advantages of paid services are faster database updates, additional metadata fields (connection type, proxy detection), and higher API query limits — not fundamentally better location coordinates.
Sources: Data and claims in this article are sourced from MaxMind GeoIP2 City Accuracy Comparison, University of Chicago GPS-Based Geolocation Study, IEEE BalkanCom 2023 (6.3M IP comparison), IEEE Transactions on Mobile Computing (cellular vs broadband study), Radboud University IPv4/IPv6 Accuracy Study, IP2Location Data Accuracy, RFC 8805 (Geofeeds), APNIC Starlink Geolocation Analysis, and Google IPv6 Adoption Statistics.