myip
🇬🇧 EN

IP address lookup

Country, autonomous system, operator and reverse DNS for any public address.

What an address lookup can actually answer

An IP address is not a name, a location or a person. It is a routing label: a number that tells every router between here and there which direction to send the next packet. Everything a lookup tells you is derived from that one fact — from the paperwork of who was allocated the number, and from what the network does with it in practice.

That sounds like a limitation, and it is, but the useful part is larger than people expect. Five pieces of information come out of an address, and they come from four completely different places:

Country
From the registry allocation and from measurement. Reliable at the level of "which country", and no further — see below for why we deliberately stop there.
Autonomous system (AS)
The network that announces this address to the rest of the internet. This is the single most trustworthy field in the whole result, because it is not a database claim — it is what the global routing table is doing right now.
Organisation
Who holds the AS: an internet provider, a mobile operator, a hosting company, a university, a government network.
Reverse DNS (PTR)
The name the address holder chose to publish for this address. Often the most informative line on the page, and often empty.
Network type
Whether this looks like a home connection, a mobile network, or a machine in a data centre. An inference, not a fact — the reasoning is spelled out below.

Where the country actually comes from, and why we do not show a city

There is no field in the internet that stores "this address is in Warsaw". Geolocation is assembled from several sources of varying quality: the country a block is registered under at its regional registry, the routing announcements that show where it is connected, latency measurements between known points, hostname conventions in reverse DNS, and data that operators publish about their own ranges.

Assembled that way, country-level answers are right the overwhelming majority of the time. City-level answers are not, and the gap between the two is far wider than the industry likes to advertise. Three ordinary situations break city geolocation completely:

So we publish the country and stop. A page that prints a street-level map next to an address is showing you the centre of a region with a confidence it does not have, and the well-known consequence is real people receiving visits at a farm in Kansas because an unlocatable address defaulted to the geographic centre of the United States. The honest answer is the coarse one.

The autonomous system is the field to trust

An autonomous system is a network with its own routing policy — a provider, a large hosting company, a bank, a content network. Each has a number, and that number is what other networks use to decide how to reach it. Numbers were originally 16-bit; that space ran out, and 32-bit AS numbers were standardised in 2012, which is why you now see values far above 65535.

What makes the AS worth more than the geolocation is its source. Country data is a claim in a database. The AS is observable: the address is inside a prefix that some network announces to its neighbours, right now, and if it stopped announcing it the address would become unreachable. There is nothing to be out of date about.

Practically, the AS answers questions the country never will. Traffic from a residential provider's AS at three in the morning behaves differently from traffic out of a hosting company's AS, and "this visitor came from a cloud provider" is a far more actionable statement than "this visitor is in Germany". If you want the registry paperwork behind the AS — who holds it, which ranges it covers, where to send a complaint — that is what the whois and RDAP record is for.

Reverse DNS: the line people skip

Reverse DNS maps an address back to a name, using the special in-addr.arpa zone for IPv4 and ip6.arpa for IPv6. The crucial detail is who controls it: the PTR record is published by whoever holds the address block, not by whoever owns the website running on it. That is why the reverse name of a shared hosting server is the hosting company's, not the site's, and why anybody can publish a forward record claiming to be mail.big-bank.example while the reverse name gives away the truth.

Operator naming conventions make PTR unusually informative. Names in the shape of host-89-64-12-7.dynamic.example-isp.net or 93-115-3-2.static.customer.example.net quietly tell you whether the address is handed out dynamically or assigned to one customer, and often which city or exchange it hangs off. An empty PTR is a signal too: on a mail server it is close to fatal, because a large share of receiving systems refuse or heavily penalise mail from an address with no reverse name.

The verification step worth knowing is forward-confirmed reverse DNS: take the PTR name, resolve it forward, and check that it comes back to the address you started with. Anyone can claim a name in reverse; only the name's real owner can make the forward record agree. This is exactly how search-engine crawlers should be verified, and it is a check you can run yourself with a DNS lookup on the name the PTR gave you.

Network type, and the honest limits of it

We label an address as residential, mobile, hosting or unknown by combining the kind of organisation that holds the range, the reverse-DNS naming, and how the block is used. This is an inference. It is usually right, and it is wrong often enough that it should never be the sole basis for blocking anybody.

The specific traps: a company's office traffic may leave through a data-centre link and look like hosting; a VPN or a corporate proxy makes a home user appear to be a machine in a rack; and carrier-grade NAT puts thousands of unrelated households behind a single public address. That last one matters more every year. Because IPv4 space ran out — the central pool was exhausted in 2011, and the European registry stopped issuing new blocks in 2019 — providers now place many customers behind one shared address, with 100.64.0.0/10 reserved for the private side of that arrangement. If you block a single address on a mobile network, you may be blocking a town.

Using this in practice

An unfamiliar address in your server log
Look at the AS first. A scan from a hosting provider's range needs a different response from a login attempt out of a residential network in the country where your staff live.
Checking whether a service is where it claims to be
Resolve the domain, look up the resulting address, and compare the organisation with the one the site claims. A "local" service whose servers sit in a single low-cost hosting AS is not a scandal, but it is worth knowing.
Mail that will not deliver
Check the reverse name exists and matches, then check the address against the blocklists that receiving systems consult. These two account for most rejected mail from a correctly configured server.
Diagnosing "the site is slow for me"
Knowing the network is only half of it; measure the path with real ICMP packets before concluding anything about distance.

What this page will never tell you

It will not tell you a name, a household, a street or a device. It will not prove that an address belongs to a VPN, only that its network is the kind of network VPNs run on. And it cannot tell you what an address was doing last week: allocations change hands, dynamic addresses are reassigned nightly, and today's answer is a statement about today.

Treat the result as the beginning of an investigation rather than a verdict. The registry record explains who is accountable, the DNS explains what a name currently points at, and a live check explains what the host actually does when you talk to it. This page tells you which network you are dealing with — which, most of the time, is the question you actually had.

Frequently asked questions

How accurate is IP geolocation?

At the level of the country it is right the large majority of the time. At the level of the city it is far less reliable, and on mobile networks it is frequently wrong by hundreds of kilometres, because a phone's traffic leaves the operator through a gateway that has nothing to do with where the phone is. That is why this page shows a country and not a map: printing a street with a precision nobody has is worse than saying less.

Can I find out who a person is from their IP address?

No. The public record identifies the network that holds the address, which is normally a provider or a hosting company, and nothing below that. Only the provider can connect an address to a subscriber at a given moment, and in most jurisdictions it may do so only for law enforcement acting on a legal order.

Why does the lookup show a different city from where I am?

Usually because your provider hands out addresses from a pool that covers a whole region, or because your traffic leaves its network somewhere other than where you are. Mobile networks, corporate VPNs and carrier-grade NAT all produce this. Nothing is broken on your side, and there is nothing you can change about it.

What is an autonomous system number, and why does it matter more than the country?

An autonomous system is a network with its own routing policy — a provider, a hosting company, a mobile operator — and its number is how other networks refer to it. It matters more because it is observed rather than claimed: the address sits inside a prefix that some network is announcing to the internet at this moment. A country field in a database can be years out of date; a routing announcement cannot.

The reverse DNS field is empty. Is that a problem?

For an ordinary home or mobile connection, no — many providers publish nothing. For a server it depends on the job: for a web server it is cosmetic, for a mail server it is close to fatal, because a large share of receiving systems refuse or penalise mail from an address with no reverse name. Reverse records are published by whoever holds the address block, so on rented infrastructure it is the hosting provider who sets it, at your request.

Does this tell me whether an address is a VPN or a proxy?

Only indirectly, and we do not claim otherwise. If the range belongs to a hosting provider rather than a consumer network, that is consistent with a VPN, a proxy, a scraper or an ordinary rented server — the network cannot tell them apart, and neither can any service that says it can with certainty. Treat it as one signal among several, never as a verdict.

Several people here share the same address. How?

That is carrier-grade NAT, and it is now normal. IPv4 space ran out — the central pool in 2011, the European registry in 2019 — so providers put many customers behind one public address, with the range 100.64.0.0/10 reserved for the private side of the arrangement. The practical consequence is that blocking one address can block a large number of unrelated people, and that a single address is not an identifier.

Can I look up a domain name here instead of an address?

Yes. The name is resolved first and the lookup then describes the address behind it. Note that a domain may resolve to several addresses, and behind a content delivery network the address you get is the nearest edge server rather than the site's own machine, so the organisation shown will be the delivery network.

Related checks