IP Lookup (IP Location & ISP)

What is an IP lookup and what does this tool show?

An IP lookup reads registration databases to find the country, the provider and the network (ASN) behind an IP address. I check it first whenever I need the source of an ad click, a form submission or a log request. In one query, this tool shows:

• Location: country, region, city and approximate coordinates.
• Network: ISP, organization and ASN.
• Time: time zone and the current local time there.
• Type: whether the address is public, internal or part of a reserved range.

Your browser runs the query, not our server. The tool asks ipwho.is about a public address first; if it gets no answer, ipapi.co and then ipinfo.io step in. As a result, the address you look up never reaches our server. To see the details of your own connection, leave the field empty or open the What is my IP tool.

How accurate is an IP lookup location?

In short: very good at country level, variable at city level. MaxMind, a geolocation database provider, puts country-level accuracy generally above 99 percent and city-level accuracy between 20 and 75 percent. In other words, the city in the result is an estimate, not the place where a person sits.

These are the most common reasons for a drift:

• Registration hub: an operator can register an IP block in the city of its head office.
• Mobile networks: according to MaxMind, mobile IPs often resolve to a broad region, and one address can move between users hundreds of kilometres apart.
• VPN and proxy: the result shows the VPN server's location, not the person's.
• Anycast: addresses like 8.8.8.8 answer from many places at once, so the location only reflects the registration.

That is also why services disagree on the city for the same IP. For example, one service may say San Jose for 8.8.8.8 while another says Mountain View; country and ASN still match. Therefore, for ad targeting or fraud checks I base decisions on country and network, never on the city.

What is the difference between a private and a public IP?

Every address that routes on the internet is unique and belongs to an operator; we call it a public IP. Your router at home, however, hands out private addresses such as 192.168.1.x to your devices. RFC 1918 sets aside three blocks for this: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Millions of homes reuse the same addresses, so they mean nothing on the internet. The router uses NAT to put them all behind one public IP.

Carriers add one more layer because IPv4 addresses ran short. The 100.64.0.0/10 block from RFC 6598 lets a carrier place many subscribers behind the same public IP, a setup known as CGNAT. If your router shows a WAN address between 100.64 and 100.127, you sit behind CGNAT too. In other words, you share your public IP with other subscribers.

The tool recognises these ranges in your browser and never sends them to an outside service. Instead, it shows the block, its standard, the first and last address and the block size. On the IPv6 side, fc00::/7 (ULA) and fe80::/10 (link-local) play the same role. If you want to know whether your connection supports IPv6, try the IPv6 test as well.

What do ASN and ISP data reveal about ad traffic?

An ASN is a network's ID number on the internet. Five regional internet registries, such as RIPE NCC and ARIN, hand out both IP blocks and ASNs. That is why an IP's ASN often shows at a glance whether traffic comes from a home or a data center.

My order for a wave of suspicious clicks in Google Ads:

1. I collect the IPs from logs or form records.
2. I look each one up here and check ASN and ISP. A series of clicks from one hosting network is the first red flag.
3. I check Google's own filter. According to Google Ads Help, Google removes invalid clicks it detects before month end from your bill. You can see them in the Invalid clicks column of your campaign table.
4. If the pattern holds, I build an IP exclusion list. You can exclude up to 500 IP addresses per campaign. An account-level list also covers Performance Max and every other campaign type.

Blocking IPs alone rarely solves the problem; measurement and campaign structure do the real work. You can read how my team and I run this analysis on the Google Ads management page.

How do you find the real visitor IP in server logs?

Behind a CDN such as Cloudflare or a load balancer, the IP in your log usually belongs to that server. When you look it up, the ASN points to the CDN's network, which is your first hint. The real address travels in a header the proxy adds:

• X-Forwarded-For: a comma-separated list. The leftmost value is the client; the rightmost is the most recent proxy.
• CF-Connecting-IP: the visitor address that Cloudflare passes as a single value.
• Forwarded: the standardized header for the same job; less common in practice.

Be careful here: MDN warns that any value your trusted proxy did not add may be spoofed. For security decisions such as rate limits or IP blocks, use only the value your own proxy writes. Addresses with a port (203.0.113.7:51234) or IPv6 in brackets from a log line are fine; the tool cleans them up.

If you have a domain instead of an address, find its IP with the DNS lookup first. I also describe the tools I use to read logs in my article on website traffic analysis tools.

IP lookup and GDPR: is an IP address personal data?

In most cases yes, or at least you should treat it that way. The GDPR defines personal data as any information relating to an identified or identifiable natural person. Recital 30 explicitly lists internet protocol addresses among online identifiers. An IP alone does not name anyone. However, combined with carrier records or user accounts on your site, it can make a person identifiable.

In practice that has two consequences:

• Logs and form records: mention collected IPs in your privacy notice. Define a retention period and delete them once it ends.
• Analytics: Google Analytics 4 does not log or store IP addresses. So GA4 no longer needs the IP masking setting of Universal Analytics.

This tool does not process any IP on our server. However, the public address you look up goes to the outside service that answers. Internal addresses never leave your browser at all. If you plan to analyse customer IPs in bulk, do it on your own legal basis and check current legislation for critical decisions. I collected the technical side of a compliant site in my guide on building a GDPR compliant website.

What changes between an IPv4 and an IPv6 lookup?

An IPv4 address consists of four numbers separated by dots, each between 0 and 255. IPv6, on the other hand, uses eight 16-bit groups separated by colons. You may shorten consecutive zero groups once with ::. The tool accepts both formats and displays IPv6 results in the short form that RFC 5952 recommends. For example, if you type 2001:0db8:0000:0000:0000:0000:0000:0001, the result reads 2001:db8::1.

It is also normal to see an IPv6 address when you look up your own IP. If your connection supports both protocols, the browser usually prefers IPv6. Moreover, many devices create temporary IPv6 addresses for privacy and rotate them regularly, so the address you see today may differ tomorrow.

This has a practical consequence for ads. Carriers often give a home connection not a single IPv6 address but a large block such as a /56 or a /48. Consequently, blocking one IPv6 address may not stop the next click from the same household. That is why I recommend looking at the network and the ASN, not the single address, when traffic looks suspicious.