How to trace an IP address

An IP address is a routing label, not an identity. It is assigned to a connection by an internet provider, shared by every device behind one router, handed to someone else when the lease expires, and hidden entirely behind a VPN or carrier-grade NAT. What you can reliably learn from it is who operates the network and roughly where that network serves customers.

With those limits in mind, the process is quick: get the address, look it up, identify the owner, and if something was done to you, report it to the people who can act.

Before anything can be traced, you need the address itself, and it has to come from somewhere that actually recorded it.

From an email

Every email carries a chain of Received: headers added by each mail server it passed through. The lowest one in the list is the oldest and names the server that first accepted the message. To see them:

• Gmail (web): open the message, click the three-dot More menu next to Reply, then Show original.
• Outlook on the web and the new Outlook: open the message, click the three dots in the message toolbar, choose View, then View message details.
• Classic Outlook for Windows: open the message in its own window, then File > Properties; the headers are in the Internet headers box.
• Apple Mail on a Mac: select the message, then View > Message > All Headers.

Paste the whole block into the email header analyzer, which reads the chain for you and flags the originating server. One warning before you get your hopes up: Gmail and Outlook.com do not include the sender's own IP address in mail written in their web or mobile apps. The first address you find is their outbound server, which tells you only that the sender used Gmail. Mail sent from a desktop client, a company mail server or a marketing platform usually does carry the originating address.

From a website or server

Web servers log every request with the client's address: in nginx and Apache it is the first field of each line in the access log, and most hosting control panels show it under a Visitors or Raw Access Logs page. Comment systems, forum software and online shops store the IP with each submission. If the site sits behind a CDN such as Cloudflare, the logged address may be the CDN's; the visitor's real address is then in the X-Forwarded-For or CF-Connecting-IP header, which the HTTP headers tool shows for your own connection.

Home routers log blocked inbound connections too; look for System Log or Security Log in the admin interface.

Where you will not get one

Messaging apps and social networks route everything through their own servers, so nothing in WhatsApp, Instagram, Discord or Telegram exposes another user's address. Game consoles do not show other players' IPs either. Anyone offering a tool that "gets an IP from a username" is selling guesswork.

Paste the address into the IP address lookup. The result has four parts worth reading:

• Network and ISP: the organization the address is registered to and the autonomous system that announces it. A home provider's name here means a residential connection; a cloud company's name means a server, a VPN or a bot.
• Location: the country, region and city that geolocation databases associate with the block. Country is reliable. City is a best guess: MaxMind's own published figures put only about 60% of US addresses within 50 km of the right spot, and a mobile address often maps to wherever the carrier's gateway is rather than where the phone is.
• Connection type: residential, mobile, business, datacenter. This single field answers most "who is this?" questions.
• Risk signals: whether the address is a known VPN endpoint, open proxy, Tor exit or has recent abuse reports. The proxy and VPN check goes deeper on this. If the address is a VPN, the trace ends at the VPN company.

An address that comes back as a datacenter block in another country is usually a VPN, a hosting server or a scanner. One that comes back as a residential ISP in your own city is more interesting, but still identifies a household or a shared connection, not a person.

Every public address block is registered with one of five regional registries, and the registration is public. The WHOIS lookup queries the registry's RDAP service and returns the organization that holds the block, the block's size, when it was allocated and, most usefully, its abuse contact: the mailbox the provider has committed to reading for complaints about that range.

The ASN lookup works at the network level: given the autonomous system number from step 2, it shows the operator, every prefix the network announces and the registry data behind it. Two addresses that look unrelated often turn out to sit in the same network, which is how you tell that a run of spam or login attempts came from one hosting company rather than from forty different people.

Do not expect a person's name here. Registry records describe organizations; the subscriber who used the address at a given minute is known only to the provider, which logs assignments for a limited time and discloses them only under legal process.

A traceroute lists the routers a packet crosses on the way to the address, with the delay at each hop. It adds two things a lookup cannot: where the address really is, judging by the last few hops, and whether the path is healthy. Run the traceroute tool from our server, or on your own machine open a terminal and type tracert 203.0.113.42 on Windows or traceroute 203.0.113.42 on macOS and Linux.

Hop names are the useful part. Carriers embed city codes and airport codes in router hostnames, so a path that ends in routers named for Frankfurt tells you the server is in Frankfurt whatever the geolocation database guessed. Rows of asterisks near the end are normal: many networks drop traceroute probes at the edge, and a firewall in front of the target does the same.

Traceroute never reaches past the address you give it: for a VPN server, the trace ends at the VPN server.

Because email is the most common reason people want to trace an address, it is worth seeing how the headers actually read. Here is a shortened chain, top to bottom, from a message that passed through two servers:

Received: from mail-out.example.net (mail-out.example.net [198.51.100.8]) by mx.yourprovider.example with ESMTPS; Mon, 20 Oct 2026 09:14:02 +0000 Received: from DESKTOP-7Q2 (unknown [203.0.113.42]) by mail-out.example.net with ESMTPA; Mon, 20 Oct 2026 09:14:01 +0000 Authentication-Results: mx.yourprovider.example; spf=pass smtp.mailfrom=example.net

Read it from the bottom up. The lower Received: line is the first server that accepted the message, and the address in brackets next to it, 203.0.113.42, is the connection it came from; the ESMTPA tag means the sender logged in with a password, so this was a real mail client, not a relay. The upper line is the hop to your own provider. Headers above the lowest trustworthy hop can be forged by the sender, which is why the Authentication-Results line matters: an SPF or DKIM pass means the sending domain really authorized that server.

If the lowest hop shows a webmail provider's own server and no client address, the sender used webmail and the trail stops there. In that case the realistic next step is to report the message to that provider, which does know who sent it.

Tracing tells you whom to tell. If an address is attacking your server, harassing you, or sending fraud, the effective moves are these, in order:

1. Report to the platform. Threats on a social network, a scam on a marketplace, a phishing mail through a webmail provider: the platform holds the account records and can act without an IP at all.
2. Report to the abuse contact. Email the address from the WHOIS record with the exact timestamps (with time zone), the IP, and the log lines. Providers act on clear reports; a VPN or hosting company will often terminate a customer who breaks its terms.
3. Report to the police for anything criminal: threats, extortion, stalking, fraud. Give them the headers and logs. Only law enforcement can compel a provider to say which subscriber held an address at a given time, and only through a court order, subpoena or warrant depending on the country.

Courts treat the IP as a lead, not as proof. In 2018 a US federal appeals court, in Cobbler Nevada v. Gonzales, ruled that being the subscriber behind an IP address is not by itself enough to hold someone responsible for what was done with it, precisely because connections are shared. Civil cases for your own damages follow the same path: a lawyer asks the court to order the provider to identify the subscriber, which takes weeks and a documented claim.

What does not work: confronting whoever lives at a geolocated spot, or paying a service that promises a name for an IP. The first targets the wrong people most of the time; the second sells public registry data dressed up as something more.