IP lookup: 216.73.216.156

Type or paste an address and press Look up. We accept IPv4 (203.0.113.42), IPv6 (2001:db8::1) and the bracketed or zone-suffixed forms copied from logs. Private and reserved addresses are recognized instantly and explained instead of looked up — there is nothing on the public internet to find for 192.168.1.1.

A lookup pulls together four different kinds of data, each from a different authority, and labels them accordingly. Geolocation comes from databases that infer a place from routing and registration patterns; the network data comes from the live BGP table; registry data comes from the regional registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) over RDAP; the risk flags come from published lists. We show them side by side rather than merging them into one confident-looking answer.

The consensus of the geolocation sources we query, with a confidence value and the distance between the sources' answers. When they disagree we say so. City-level is the best case; for mobile networks and VPN servers the city is often the provider's hub, not the user's. See IP location finder.

The organization that holds the address block (from the registry) and the operator that announces it (from BGP). They differ when a company rents addresses from a provider, which is common for hosting.

The autonomous system number announcing the address, the exact prefix (for example 203.0.113.0/24), the registry it was allocated by and the allocation date. ASN lookup shows every prefix of the same operator.

The reverse DNS name, if the operator set one. Hosting providers and ISPs often encode the data center or city in it; a missing PTR is normal for mobile and many home connections.

Whether the address is a Tor exit (Tor Project list, refreshed hourly), inside a known commercial VPN or data center range (X4BNet lists, the official AWS, Google, Oracle, DigitalOcean, Linode, Vultr, Cloudflare and Fastly feeds), an iCloud Private Relay egress (Apple's list) or listed on a DNS blocklist as an open proxy. Each flag shows its source and when that list was fetched. Run the proxy and VPN checker for the full picture.

The abuse mailbox published by the registry or by the network operator, for reporting spam or attacks from the address. We show it exactly as published; personal names and phone numbers from registry records are never displayed.

Country is right in the vast majority of cases for fixed-line addresses. City is right often enough to be useful and wrong often enough that you should never rely on it: databases lag behind reassignments, mobile carriers route traffic through a few hubs, VPN and cloud addresses show the server's location, and anycast prefixes are announced from many places at once. That is why every result on this page shows the database build date and, where sources disagree, the spread between them. The methodology page explains how the consensus is calculated and what the confidence value means.

Consensus country/city is the value most sources agree on; the confidence drops when sources disagree or when only one source has data. Registry country is where the address block was allocated — it is not geolocation and is shown for comparison only. Type is residential, mobile, business or data center, derived from the ASN and the range lists; it carries its own confidence. Risk level (low, moderate, high, severe) summarizes the flags with a published scoring formula; the reasons are listed one by one so you can judge them yourself.

Once you know the address, the next questions are usually: is it on a blocklist (IP blacklist check), who registered the block (WHOIS lookup), what name points to it (reverse DNS lookup), what else the operator announces (ASN lookup) and where it sits on a map (IP location finder). Each result card links to the matching tool with the address pre-filled.