Free IP address lookup: location, ISP and risk in one report
What is an IP address lookup?
An IP address lookup takes a single IP and returns what is publicly known about it: the approximate location, the network operator that announces it, and the risk signals attached to it. You get a city, region, postal code and timezone, the ISP and ASN behind the address, and flags for VPN, proxy, Tor, hosting and prior abuse.
An IP address identifies a network endpoint, not a person. Treat the location as the network's registered area, usually accurate to city level and sometimes only to country. It is a strong signal for routing, pricing and fraud scoring, and a weak one for anything that needs a street address.
How an IP address lookup works
Every public IP is allocated to an organization through a regional internet registry, then announced to the internet by an autonomous system. A lookup reads those records, joins them to geolocation and infrastructure datasets, and adds behavioral signals such as whether the address currently serves VPN traffic. Three layers make up the answer:
- Registry data: Which organization holds the address block and which ASN announces it. This comes from the regional internet registries, is authoritative, and changes rarely.
- Geolocation data: The city, region, postal code and timezone mapped to that block. Accuracy drops for mobile carriers and satellite providers, which route large areas through a small number of addresses.
- Risk signals: Whether the address belongs to a VPN provider, an open proxy, the Tor network or a hosting provider, and whether it has appeared in abuse reports. All of it returns in one request.
Registry data says which organization holds the block and which ASN announces it, and it changes rarely. Geolocation data maps the city, region, postal code and timezone to that block, and accuracy drops for mobile carriers and satellite providers that route large areas through few addresses. Risk signals say whether the address belongs to a VPN provider, an open proxy, the Tor network or a hosting provider, and whether it has appeared in abuse reports. The lookup on this page runs the same request as the IP Intelligence API and returns all of it in one response, so you do not need to combine three services to answer one question.
IP address lookup vs. geolocation vs. reverse IP lookup
These three get used interchangeably and answer different questions. Picking the right one saves you a wasted request.
IP address lookup (what this tool does) starts with an IP and returns everything known about it: location, network and risk. It is the general-purpose answer, and the right choice when you want the full record rather than one field.
IP geolocation is the location subset only: city, region, country, coordinates and timezone. Use it when placement is all you need and the network and risk fields would go unread.
Reverse IP lookup goes the other direction and returns the domains hosted on an address, which is what you want when investigating a server rather than a visitor. If you only need the risk verdict instead of the full record, the IP reputation check leads with the flags.
Use cases for an IP address lookup
Fraud and abuse screening: Check whether a signup or checkout comes from a data center or an address with abuse history before you approve it. Combine the flags with your own signals rather than blocking on any one of them.
Regional routing and pricing: Set currency, language and tax defaults from the country and region without asking the user, and fall back to a chooser when the country looks implausible.
Account security: Compare the location and network of a login against the account's history. A move from a residential ISP to a hosting provider inside one session is worth a second factor.
Support and debugging: When a customer reports a problem, the ASN and the hosting flag tell you whether you are looking at a corporate proxy, a VPN or an ordinary residential connection, which usually explains the behavior faster than another round of questions.
What an IP address lookup tells you
The report groups into three questions you are usually trying to answer: where is this address, who runs it, and should you trust it. Location covers country, region, city, postal code and timezone. The ISP or ASN name tells you whether you are looking at residential broadband, a mobile carrier or a cloud provider. Then five flags cover VPN, proxy, Tor, hosting or data center, and abuse history.
| Flag | What it means | Why it matters |
|---|---|---|
| is_abuse | The IP appears in aggregated abuse and blocklist sources. | Reported for spam, brute force, scanning, or fraud. The strongest negative signal. |
| is_vpn | The IP belongs to a known VPN service. | Hides the real network. Common in evasion, though many real users use VPNs. |
| is_proxy | The IP is a known or anonymizing proxy. | Often masks origin. Higher risk for abuse and scraping. |
| is_tor | The IP is a Tor exit node. | Strong anonymity. Rare for normal users, common in probing and abuse. |
| is_hosting | The IP runs in a hosting or datacenter range. | Real users rarely browse from datacenters. Typical of bots and automation. |
| is_relay | The IP is a private relay such as iCloud Private Relay. | A legitimate privacy feature. Low risk on its own. |
| is_mobile | The IP is on a mobile carrier network. | Shared and dynamic. Usually lower risk, but shared across many users. |
No single flag is a verdict. A data center address on a high-value checkout, or a VPN paired with a reported abuse history, is worth a closer look, while a residential mobile address with a clean record usually is not. See how IP reputation works, or score addresses in your own signup, login, and checkout flows with the IP Intelligence API.
See what the API returns
Response parameters
ip_address
security.is_vpn
security.is_proxy
security.is_tor
security.is_hosting
security.is_relay
security.is_mobile
security.is_abuse
asn.asn
asn.name
asn.domain
asn.type
company.name
company.domain
company.type
domains.domains
location.city
location.city_geoname_id
location.region
location.region_iso_code
location.region_geoname_id
location.postal_code
location.country
location.country_code
location.country_geoname_id
location.is_country_eu
location.continent
location.continent_code
location.continent_geoname_id
location.longitude
location.latitude
timezone.name
timezone.abbreviation
timezone.utc_offset
timezone.local_time
timezone.is_dst
flag.emoji
flag.unicode
flag.png
flag.svg
currency.name
currency.code
currency.symbol
API Endpoint
curl --request GET \
--url https://ip-intelligence.abstractapi.com/v1API Response
{
"ip_address": "185.197.192.65",
"security": {
"is_vpn": true,
"is_proxy": true,
"is_tor": false,
"is_hosting": false,
"is_relay": false,
"is_mobile": false,
"is_abuse": false,
},
"asn": {
"asn": 136787,
"name": "PacketHub S.A.",
"domain": "packethub.tech",
"type": "isp",
},
"company": {
"name": "PacketHub S.A.",
"domain": "packethub.tech",
"type": "isp",
},
"domains": {
"domains": []
},
"location": {
"city": "Miami",
"city_geoname_id": 4164138,
"region": "Florida",
"region_iso_code": "FL",
"region_geoname_id": 4155751,
"postal_code": "33197",
"country": "United States",
"country_code": "US",
"country_geoname_id": 6252001,
"is_country_eu": false,
"continent": "North America",
"continent_code": "NA",
"continent_geoname_id": 6255149,
"longitude": -80.1946,
"latitude": 25.7689,
},
"timezone": {
"name": "America/New_York",
"abbreviation": "EST",
"utc_offset": -5,
"local_time": "12:07:51",
"is_dst": false,
},
"flag": {
"emoji": "🇺🇸",
"unicode": "U+1F1FA U+1F1F8",
"png": "https://static.abstractapi.com/country-flags/US_flag.png",
"svg": "https://static.abstractapi.com/country-flags/US_flag.svg",
},
"currency": {
"name": "US Dollar",
"code": "USD",
"symbol": "$"
}
}IP address lookup FAQ
What is my IP address versus an IP address lookup?
"What is my IP" returns the address your own connection is using right now. An IP address lookup takes any address you give it, including your own, and returns the location, network and risk data attached to it. Use the lookup when you want to investigate an address rather than identify yourself.
Is this IP address lookup free?
Yes. The lookup on this page runs without an account. If you want to run it in your own code or at higher volume, create a free account and you get 1,000 requests / month on IP Intelligence with no card required.
Can I look up IPv6 addresses?
Yes. The lookup accepts both IPv4 and IPv6, including shortened IPv6 notation. IPv6 geolocation data is thinner than IPv4 on some networks, so expect country to be reliable and city to be less so.
Does an IP address lookup show a name or street address?
No. An IP identifies a network endpoint, and the registry records name the organization holding the block rather than the person using it. Anyone offering a name and street address from an IP alone is guessing. For a name attached to a phone number, use the reverse phone lookup instead.
Can someone find my location from my IP address?
They can find the area your ISP routes your traffic through, which is usually your city and sometimes only your country. They cannot get your street address from the IP alone. A VPN replaces that with the provider's address, which is why the VPN flag exists.
An address is flagged as a VPN. Should I block it?
No. Plenty of people use a VPN for ordinary privacy reasons, and blocking every VPN address will reject real customers. Treat the flag as a reason to add friction, such as email verification or a second factor, and weigh it against the abuse history and hosting flags.
How many addresses can I check at once?
This page checks one address at a time. For lists, the bulk IP lookup tool takes a batch and returns a CSV, and IP Intelligence handles it from your own code with 1,000 requests / month on the free tier.
How accurate is IP geolocation?
Country accuracy is high, typically above 99%. City accuracy is lower and varies by network: fixed residential broadband usually resolves to the right metro area, while mobile carriers can route a whole region through one gateway. Use country for anything that must be right, treat city as a hint, and never use an IP location as proof of a physical address.
Where IP address lookup fits
An IP address is the first thing you learn about a visitor and often the cheapest signal you have.
Detect bots at signup and loginCut ad fraud and fake clicksMore IP intelligence tools
