What can you learn from an IP address?
An IP address tells you which organisation owns it, which network carries it, where to report abuse, and roughly which city or region it is used in. It never tells you who is using it or their street address; only the internet provider knows that.
Type an address and the page first works out locally what kind it is: a public address, or a private, shared (carrier-grade NAT), loopback, link-local or documentation one that only means something inside a network. Only public addresses are looked up. A hostname is turned into its addresses first, and you can look up each one.
You can paste an address with a port or brackets ([2001:db8::1]:443), a whole URL, a range (8.8.8.0/24), or the decimal or hex form some logs use (134744072, 0x08080808).
How accurate is the location on the map?
The pin is where a location database guesses the address is used, and the shaded circle is how sure it is. The country is almost always right. The city is often the provider's nearest exchange or data center, and mobile and satellite addresses can land hundreds of kilometres away. A VPN or proxy shows the server's location, not the person's.
When the database only knows the country, the circle covers the whole country and the pin sits in the middle of it: that is not a place, just a centre.
Who is asked when you look up an address?
This page uses no webdave server and keeps nothing. Nothing is sent until you press Look up; then your browser asks these services directly:
- GeoJS: the city, coordinates and time zone of the address.
- Cloudflare DNS (DNS over HTTPS): the hostname (reverse DNS), the addresses of a hostname you type, and the network that announces the address, from Team Cymru's public IP-to-ASN data.
- The address's registry (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC, over RDAP): the owner, the registered range and the abuse contact.
- OpenFreeMap, only while the Map switch is on: the map tiles around the location, which tell it the area you are looking at. Map data © OpenStreetMap contributors.
- Cloudflare, only if you press My address: it says back the address your browser connects from.
Private and other special addresses are never sent anywhere. The kind of address and its other forms are worked out on your device.
What each line means
| Network | The autonomous system (ASN) that announces the address on the internet, and the announced prefix, from Team Cymru's routing data |
|---|---|
| Registered to | The organisation the regional internet registry lists for the address block. Large providers often register customer blocks to themselves |
| Abuse contact | Where the network owner reads reports of spam, attacks and scanning from its addresses |
| Hostname | The reverse DNS (PTR) name the owner gave the address, if any. It often names the provider and the town |
| Time zone | The time zone of the location guess, with the time there now |
| Range | The first and last address of the registered block, and the same as CIDR prefixes |
| Other forms | The same address as one number (decimal, hex, binary), inside IPv6 (mapped, NAT64, 6to4), and as the name a reverse DNS query asks for. For IPv6: the /64 network, the interface ID, an IPv4 address carried inside (6to4, Teredo) and the network card's MAC address when the address was made from it |
Questions
No. The location is a guess from registration data, usually the provider's nearest hub, and is often tens of kilometres off. Only the internet provider can link an address to a customer, and it only tells the police, with a court order.
Look the address up and write to the abuse contact under Registry. That is where its network owner reads reports. Include the address, the exact time with time zone, and what happened, with log lines if you have them.
192.168.x.x, 10.x.x.x and 172.16.x.x to 172.31.x.x are private ranges. Every home and office network reuses them, so they belong to no one and say nothing about where a device is. The same goes for 100.64.x.x, which providers use behind shared (carrier-grade NAT) addresses.
Not by webdave: this page uses no webdave server. Your browser asks the services listed above directly and shows their answers. The address stays in the page's link (?q=) so you can share or bookmark a lookup.