What an IP address lookup shows

An IP lookup returns two kinds of data. Registry data (the owner organization, IP range, ASN and abuse contact) comes from the regional internet registry that assigned the block. Location data (country, city, timezone) comes from GeoIP databases that estimate where the address is used. The hostname comes from reverse DNS.

If you need a refresher on what an IP address is and how it gets assigned, start there. Each field in the result means something specific:

  • The ISP is the company that provides the internet connection, such as a broadband carrier, a mobile network or a cloud host.
  • The organization is the registrant named in the whois record. It differs from the ISP when a business gets a block of addresses through its provider.
  • The ASN (autonomous system number) identifies the network that announces the route for the address on the internet.
  • The hostname is the name returned by reverse DNS, if the owner has set one.
  • The IP range is the whole block the address belongs to, shown as a start and end address or in CIDR notation.
  • Country and city are GeoIP estimates, and the timezone is derived from that estimated location.

Example: looking up 8.8.8.8 and 1.1.1.1

Two well-known public DNS addresses show how the fields fit together. Google documents 8.8.8.8 and 8.8.4.4 as the IPv4 addresses of Google Public DNS. The ARIN record for 8.8.8.8 places it in the range 8.8.8.0 to 8.8.8.255, network name GOGL, registered to Google LLC in Mountain View, California. Reverse DNS for 8.8.8.8 returns dns.google.

The result for 1.1.1.1 is more interesting. The block 1.1.1.0 to 1.1.1.255 is registered at APNIC under the name APNIC-LABS, and the record describes it as the "APNIC and Cloudflare DNS Resolver project," routed globally by AS13335 (Cloudflare). Its hostname is one.one.one.one. So the registered holder (APNIC) and the operator (Cloudflare) are different organizations. Cloudflare explained in its 2018 launch post that APNIC's research group let it run the resolver on these addresses in exchange for studying the junk traffic they attract.

How accurate is IP location?

IP location is usually right at the country level and less reliable at the city level. A city result can be off by tens of kilometers, and mobile network addresses often show the city where the carrier's gateway sits rather than where the phone is. No GeoIP database knows a street address, because registries never record one for end users. Our guide on how close IP location really gets compares measured accuracy by country.

GeoIP providers build their maps from registry data, routing information and corrections from network operators, each in its own way, so one address can land in two different cities. Mobile carriers make it harder: many phones share one public address through carrier-grade NAT.

VPNs, proxies and CDNs change the picture completely. When traffic passes through a VPN server or a Cloudflare edge location, the address you see belongs to that server, so the lookup shows the server's city and the provider's network. A visitor in Hanoi using a VPN exit in Singapore appears as a Singapore address. When one source looks wrong, compare location from six GeoIP databases (IPInfo.io, MaxMind, IP2Location, IPGeolocation.io, DB-IP and Cloudflare) on one page and look for the city most of them agree on.

Whois IP lookup: who owns this IP address?

A whois IP lookup asks the regional internet registry that assigned an address which organization holds it. IANA hands out address pools to five registries, and each one keeps the records for its region. The answer names the holder, the range, registration dates and an abuse contact.

According to IANA's list of regional internet registries, the five RIRs are:

  • ARIN: Canada, the USA and some Caribbean islands
  • RIPE NCC: Europe, the Middle East and Central Asia
  • APNIC: the Asia/Pacific region
  • LACNIC: Latin America and some Caribbean islands
  • AFRINIC: the Africa region

Vietnam is in the APNIC region. VNNIC is the national internet registry that manages address allocations for Vietnamese networks under APNIC. An address registered in one region can be used anywhere, so the whois country and the GeoIP country sometimes differ.

WHOIS vs RDAP

Classic WHOIS is a plain-text protocol on port 43, and each registry formats its replies in its own way. RDAP (Registration Data Access Protocol) is the newer standard. It runs over HTTPS and returns structured JSON, with the query format defined in RFC 9082 and the JSON responses in RFC 9083. CheckIP shows the raw ip whois data in a collapsed panel under the main result so you can read every field the registry returned.

Reverse IP lookup: IP to hostname

A reverse IP lookup turns an IP address into a hostname by reading its PTR record in DNS. IPv4 PTR records live under the in-addr.arpa zone and IPv6 records under ip6.arpa. The holder of the address block controls them, so a hostname is only present when the ISP or server owner has published one.

Hostnames often reveal more than the whois record. A name like dns.google tells you the address runs Google's DNS service. ISP hostnames for home connections often contain words such as "dynamic," "dsl" or "pool," or a city code, which marks the address as a residential line. Mail servers check this field too: many reject mail from an address whose PTR record is missing or does not resolve back to the same IP.

Some sites use "reverse IP lookup" for a different task, listing every domain hosted on one shared server. CheckIP's lookup returns the PTR hostname only.

When to look up an IP address

Run an IP search whenever an unfamiliar address shows up somewhere it matters: a login alert, a server log, an email header or a firewall report. The lookup tells you whether the address belongs to a home ISP, a mobile carrier, a cloud host or a VPN provider, and that usually decides what to do next.

  • Account security: a login from an ISP and country you never use is a reason to change your password and end other sessions. If you haven't already, turn on two-factor authentication too.
  • Phishing email: the Received lines in the full email header contain the sending server's IP. A message that claims to come from your bank but was sent from a cheap VPS is a fake.
  • Attack traffic: repeated hits on wp-login.php or SSH from one ASN often point to a single hosting provider whose abuse team can act.
  • Firewall rules: check before you block. Blocking a Cloudflare or Google address range can cut off many legitimate sites and services at once.

For mail servers and suspicious visitors, also check if an IP is on a spam blacklist to see whether other networks have already flagged it.

Can you track a person by IP address?

No IP tracker or IP locator can name the person behind an address from public data. The lookup stops at the ISP and an approximate area. Only the ISP can match an address and timestamp to a customer account, and it releases that link to police or a court under the legal process of its country.

Shared addresses make it even less precise. One home IP covers every device on that Wi-Fi network, and a mobile carrier's public address can be shared by many subscribers at once.

Frequently asked questions

Is IP lookup legal?

Yes. Registry records are published so that network operators can contact each other, and GeoIP data is sold openly for fraud checks and content licensing. Looking up an address from your own logs or inbox is routine network work. Using the result for harassment or unauthorized access is a separate matter and is illegal.

Why does the lookup show a different city from where I am?

The GeoIP database may place your address at your ISP's regional hub, or it may hold an outdated entry from before your provider moved that block to another area. A VPN, iCloud Private Relay or corporate proxy also replaces your address with one in another city. Providers such as MaxMind accept correction requests from users and ISPs.

What is an ASN?

An ASN is the number assigned to an autonomous system, a network that sets its own routing policy and announces its address blocks to the rest of the internet using BGP. An ASN lookup tells you which network actually carries traffic for an address, for example AS13335 for Cloudflare.

Can I look up an IPv6 address?

Yes. Paste the full or shortened IPv6 form into the box above, for example 2001:4860:4860::8888, one of the IPv6 addresses Google lists for its public DNS. The registries assign IPv6 blocks the same way they assign IPv4 blocks, so you get the same owner, ASN, range and location fields.

How do I report an abusive IP address?

Find the abuse contact in the whois record, usually a field or remark labeled "abuse." The 1.1.1.1 record, for instance, sends reports to [email protected]. Send that address the IP, exact timestamps with timezone and the relevant log lines.