IP Address Lookup
Find the approximate location, provider, network and reverse DNS behind any public IP address or hostname.
Works with any public IPv4 or IPv6 address, or a hostname. Location is approximate (usually city level) and comes from the provider's registration data, not GPS.
What an IP lookup tells you
Type any public IP address or hostname and the tool returns the country and city the address is registered to, the internet provider or hosting company that owns it, the autonomous system it belongs to, and its reverse DNS name if one is set. Several geolocation sources are combined so a gap in one is filled by another.
The most useful field is often the provider. An address belonging to a residential ISP, a cloud hosting company, a VPN provider or a Microsoft datacentre each tells a different story about what the traffic is likely to be.
Reading a security alert with it
Microsoft 365 sign-in logs and Defender alerts show the address a login came from. Looking it up answers the first triage question: is this plausibly the user? A sign-in from a UK residential provider at 9am is probably them at home. The same account from a hosting provider in another country ten minutes later is impossible travel, and the account should be contained.
Firewall logs work the same way. Repeated connection attempts from a cloud hosting range are usually automated scanning. Attempts from an address that reverse-resolves to a known security scanner are noise. Attempts from a range with an abuse contact you can write to are worth reporting.
IP Address Lookup: common questions
How accurate is IP geolocation?
Reliable at country level, usually right at city level for fixed-line connections, and often wrong at street level. Mobile and VPN addresses can show the networkās hub rather than the user. Treat it as context, not proof.
What is an ASN?
An autonomous system number identifies the network an address is routed through, such as an ISP, a cloud provider or a large enterprise. It is more stable than city data and is what security tools use to group addresses by owner.
Why does a hostname return a different address than expected?
Many services sit behind load balancers or content delivery networks, so the address you see is the edge nearest you rather than the origin server. Names proxied through Cloudflare will resolve to Cloudflare addresses.
Is the address I look up stored anywhere?
Successful results are cached at our edge for an hour so repeat lookups are fast and we stay within the public providersā limits. The lookup is forwarded to those geolocation and registry services to be answered. We do not log who looked up what.
More free tools
Need help making sense of what you found?
Unknown addresses in your logs, on your firewall or in a security alert are worth a second look. Our cyber security team investigates, contains and reports on threats for businesses across Scotland and the UK.