IP Lookup

Every public IP address is allocated by one of five Regional Internet Registries: ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America, AFRINIC for Africa. Each one publishes which organisation holds which block. That registration is the foundation, and it is authoritative, because it genuinely records who was assigned the addresses.

It is also very coarse. One registry entry might cover several million addresses assigned to a national ISP, listing a head office that tells you nothing about the customer using one of them. Commercial providers refine it from there. They correlate BGP routing announcements, the naming conventions ISPs use in reverse DNS (many bury a city or exchange code in the hostname), latency measurements from probes around the world, and location data that networks hand over themselves. This tool uses IP2Location for that layer.

All of that is inference rather than record-keeping. It is why two geolocation services will happily disagree about the same address without either of them being wrong. They have simply weighted the signals differently.

The ASN, or Autonomous System Number, identifies the network operator that announces the address block to the rest of the internet. Every ISP, cloud platform, university and large enterprise running its own routing has one. It is the most stable field in a result, because changing it means changing who carries your traffic.

It is also the field that tells you most about intent. Addresses announced by a consumer broadband ASN behave like people. Addresses announced by a hosting or cloud ASN behave like machines. A request from an AWS or Hetzner range landing on a consumer login form is far more likely to be automation than a customer on holiday. That is not proof on its own, but it is usually the useful part of the answer.

Reverse DNS (a PTR record) maps the address back to a hostname, assuming the operator bothered to set one. Consumer ISPs tend to generate these mechanically, so you get hostnames with the address and a regional code baked into them. Mail servers check PTR records as a basic legitimacy signal, which is why a mail server without one struggles to deliver.

Country-level accuracy is high. Vendors commonly quote over 95%, and in practice most of the failures are cases where the honest answer is ambiguous rather than wrong. City-level is a different story. Claims sit somewhere between 50% and 80% within a 50km radius, and the real figure depends entirely on which country and which network you are asking about. Dense urban broadband sits at the top of that range. Not much else does.

Four things wreck it. Mobile carriers route traffic through a handful of regional gateways, so a phone in one city routinely shows up in another one hundreds of kilometres away. VPNs and proxies report the exit server's location, which is the whole point of them. Corporate networks backhaul remote offices to a central breakout, so a branch in one country can surface in another. Satellite and rural fixed-wireless providers often have no useful city mapping at all.

None of this identifies a household or a person. A lookup narrows things to a network and a rough area. Connecting that to a subscriber needs records only the ISP holds, and getting those needs legal process. Any service claiming it can find someone's street address from an IP is selling you a guess.

Checking whether a login came from the country you expected, when the alternative is no signal at all. Spotting that traffic hitting your site comes from a datacentre range rather than consumer broadband. Confirming which provider hosts a service before you contact anyone about it. Working out where to send an abuse report. Sanity-checking a CDN or geo-routing setup from outside your own network.

It is poor at anything needing precision, or any certainty about a particular person. A city-level result is worth one more check before you act on it. On its own it is not a finding.