logo
GeekFormat

IP Lookup

IP Address Lookup

Enter IPv4 / IPv6 to view location, ASN and network info.

In log auditing, attack investigation and risk control analysis, the first step is often to confirm "who, where, and whom does an IP address belong to". This tool queries IP geolocation databases in real-time through the backend, supports both IPv4 and IPv6, returns location (country/region/city), ASN autonomous system number, ISP organization, timezone and address classification information, with built-in popular preset IPs and historical query records, helping you quickly complete IP source identification and preliminary risk assessment.

Related

What Is My IP?

DNS Lookup

IPv4 Converter

Subnet Calculator

DNS Propagation Checker

IPv6 Toolbox

Use Cases

  • When unfamiliar IPs appear in server logs, first query their geolocation and ASN before deciding whether to add them to firewall ban lists or security alerts
  • In e-commerce/financial risk control scenarios, determine whether request sources are abnormal through IP country/region and ASN information, assisting in identifying proxy IPs and datacenter IPs
  • When websites suffer CC attacks or crawler traffic, batch query the attribution and ISP of attack source IPs, submit complaints to ISPs or configure firewall rules
  • Before configuring IP whitelists/blacklists, confirm the actual attribution and type (public/private/loopback) of target IPs to avoid mistakenly blocking normal users
  • When troubleshooting CDN or reverse proxy configurations, confirm the real client IP geolocation in X-Forwarded-For headers to verify whether the proxy chain is correct

Features

  • Dual-stack support: Supports both IPv4 and IPv6 address lookups, automatically identifies address type and provides immediate feedback on invalid formats
  • Multi-dimensional information: Returns country/region/city, ASN number, ISP organization, timezone and IP classification (public/private) all at once
  • Backend real-time queries: Queries IP geolocation database through the server, avoiding inaccurate data caused by outdated browser-side IP databases
  • Preset popular IPs: Built-in 8.8.8.8 (Google), 1.1.1.1 (Cloudflare) and IPv6 test addresses, one-click fill for quick queries
  • Recent query history: Automatically saves the last 8 query history entries for easy comparison and review across multiple IPs
  • Diagnostic summary copy: One-click copy of formatted IP diagnostic summary, can be pasted directly into tickets, security reports or ban records

How to Use

  1. In the input box, enter the IPv4 or IPv6 address to query, or click preset IP buttons (8.8.8.8/1.1.1.1/IPv6 address) for quick filling
  2. The tool automatically identifies the address format, invalid inputs will be prompted in real-time, click the "Lookup IP" button after confirming the format is correct
  3. View the result area: top status badge shows IP classification (public/private etc.) and protocol version (IPv4/IPv6)
  4. View detailed information including country, region, city, ASN/ISP, timezone etc.
  5. Click "Copy Diagnostic Summary" to copy formatted IP information to clipboard for security reports or ticket records

FAQ

Can IP lookup results accurately locate to a street address?

<p>No. IP geolocation accuracy is limited - country-level accuracy is approximately 95–99%, city-level approximately 60–85%, but cannot locate to specific streets, neighborhoods or house numbers. City-level positioning has higher accuracy in Europe and America, while in some regions it may only locate to province or country. For legal forensics and other scenarios, other evidence should be combined.</p>

Why does the same IP show different locations on different tools?

<p>Because different tools use different GeoIP databases with different update frequencies. IP addresses may be reallocated (especially dynamic IPs), and database update delays cause result differences. ASN and ISP information is usually more stable and reliable, which is the core basis for judging IP attribution.</p>

How to determine if an IP is public or private?

<p>The tool automatically identifies and displays the classification field in results: public indicates public IP, private indicates private IP (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Private IPs are not routed on the public Internet; if private IPs appear in your logs, it means requests have passed through proxy or NAT devices.</p>

Does it support IPv6 address lookup?

<p>Yes. The tool supports both IPv4 and IPv6 address lookups, automatically identifying the address type upon input. With the popularization of IPv6, more and more users access websites through IPv6, and IPv6 geolocation queries are equally important.</p>

Will queried IPs be recorded?

<p>Query requests execute IP database lookups through backend services, but query results are only returned to the current user for display, and your query IPs will not be used for other purposes or stored in traceable logs. Recent query records are only saved in your browser's localStorage.</p>

What is the use of ASN information in risk control?

<p>ASN directly identifies the network organization an IP belongs to. Through ASN you can determine whether an IP is a residential user (ISP's ASN) or a datacenter/server (cloud provider's ASN). IP access to user interfaces from cloud provider ASNs (such as AWS AS16509, Alibaba Cloud AS37963) usually has higher risk and may be crawlers or automated attacks.</p>

Will dynamic IP and static IP query results differ?

<p>They may. Home broadband users typically use dynamic IPs, temporarily assigned by ISPs from address pools; the same IP may be assigned to different users in different cities at different times. Therefore, for dynamic IPs, query results only reflect the current allocation status, and historical attribution may differ.</p>

术语表

ASN (Autonomous System Number)
A globally unique 16-bit or 32-bit number identifying an independently managed network unit (such as ISP, cloud service provider, large enterprise), the most reliable dimension in IP attribution judgment.
ISP (Internet Service Provider)
Companies providing Internet access services to users, such as China Telecom, China Unicom, AT&T, Comcast etc.
GeoIP (IP Geolocation)
Technology to infer physical location through IP address, building databases based on BGP routing, WHOIS registration information and ISP address allocation records.
Public IP
IP addresses that can be globally routed on the Internet, uniformly allocated by IANA to RIRs, then hierarchically allocated to ISPs and end users.
Private IP
IP addresses used only within private networks, not routed on the public Internet, including three ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
BGP (Border Gateway Protocol)
The core Internet routing protocol for exchanging routing information between different autonomous systems; IP attribution data mainly comes from BGP routing tables.
RIR (Regional Internet Registry)
Five regional organizations responsible for global IP address and ASN allocation: ARIN (North America), RIPE (Europe), APNIC (Asia Pacific), LACNIC (Latin America), AFRINIC (Africa).
IPv4/IPv6 Dual Stack
Network environment deploying both IPv4 and IPv6 protocols simultaneously. With IPv4 address exhaustion, more and more services support both protocols.
Datacenter IP
IP ranges belonging to cloud service providers or data centers, typically used for servers rather than ordinary home users, often marked as high-risk sources in risk control.
Residential IP
IP addresses allocated to home broadband users, typically dynamically assigned by ISPs, with higher credibility than datacenter IPs in risk control.

Common Well-known DNS/Cloud Provider IPs and ASN Comparison

8.8.8.8AS15169Google LLCDNS/CloudGoogle Public DNS primary node
8.8.4.4AS15169Google LLCDNS/CloudGoogle Public DNS secondary node
1.1.1.1AS13335CloudflareDNS/CDNCloudflare Public DNS primary node
1.0.0.1AS13335CloudflareDNS/CDNCloudflare Public DNS secondary node
114.114.114.114AS12873114DNSDNSDomestic 114 Public DNS
223.5.5.5AS37963AlibabaDNS/CloudAlibaba Cloud Public DNS (Alidns)
119.29.29.29AS132203TencentDNS/CloudTencent Cloud Public DNS (DNSPod)
180.76.76.76AS23724BaiduDNSBaidu Public DNS

IP Classification and Risk Control Reference

Public Residential IPOrdinary user segments dynamically allocated by ISPsLow RiskHome broadband/mobile network users, behavior traceable to individuals
Datacenter/Cloud IPAWS/Azure/GCP/Alibaba Cloud and other cloud provider segmentsMedium-High RiskServer IPs, often used for crawlers, proxies and attacks, require additional verification
Tor Exit NodesTor public exit node listsHigh RiskAnonymous network exits, often used for malicious access, recommend strict verification or blocking
VPN/Proxy IPKnown VPN service provider IP segmentsMedium-High RiskUsers may be hiding their real location, need to judge with other risk control dimensions
Private/Internal IP10/8, 172.16/12, 192.168/16No Risk (No Internet Egress)Internal addresses, should not appear in public network requests; if they appear, proxy headers may be forged
Loopback Address127.0.0.0/8, ::1No RiskLocal loopback, if appearing in logs it means the request is from the local machine

Authoritative References

  • Reference
  • Reference
  • Reference