Advanced IP Address Lookup — Risk Score, Reverse DNS & ISP Class

An IP lookup tells you: • Geographic location: country (near 100% accurate), region/state (~80%), city (~60-70%), and approximate coordinates • Network: the Internet Service Provider, organisation name, Autonomous System Number (ASN) and CIDR range • Connection context: timezone, whether the IP is residential, business, mobile, datacenter or VPN • Hostname: reverse DNS (PTR record) often reveals the server or ISP infrastructure name What an IP lookup CANNOT reveal: • Your real name, home address, email or phone number • Precise street-level location — city is the finest reliable grain • Identity behind a VPN or proxy — it shows the exit node, not you • What you did online or which sites you visited Only your ISP can link an IP to a specific subscriber, and they only do so under a court order or law enforcement request. IP geolocation databases are maintained by companies like MaxMind and are updated continuously, but accuracy varies by region and ISP.

Several legitimate reasons explain a location mismatch: 1. ISP routing hub: Your ISP assigns your IP from a regional pool registered to a city that may be hundreds of kilometres from you. This is the most common reason — your IP is "from" the ISP's nearest data centre, not your physical location. 2. Mobile networks: Carriers like Verizon, T-Mobile and AT&T route all mobile traffic through centralised gateways, so your IP appears to originate from the gateway city. 3. Corporate VPN or proxy: If your device connects through a company network, the IP shown is your company's egress IP, not your local connection. 4. Stale database: Geolocation databases are updated regularly but not in real time. A recently reassigned IP block may still show old location data for days or weeks. Can you fix it? If you're a business and your IP shows wrong location data, you can submit a correction request to MaxMind, IP2Location and ipinfo.io — they maintain the major databases used by most tools. Home users generally cannot influence their IP's registered location, as that's controlled by the ISP.

Reverse DNS (rDNS) is the process of mapping an IP address back to a hostname, using PTR records in the Domain Name System. While regular DNS maps hostname → IP, reverse DNS maps IP → hostname. Why it matters in practice: • Server identification: A reverse DNS lookup on a mail server IP often returns the server's hostname (e.g. mail.example.com), which is critical for email deliverability. Many mail servers reject messages from IPs without a valid PTR record. • Network investigation: When you see an unfamiliar IP in access logs, rDNS often reveals whether it belongs to a search engine bot (crawl.googlebot.com), a CDN node (cloudflare.com), or an ISP's infrastructure. • Security research: Reverse DNS names can reveal VPN providers, hosting companies and suspicious infrastructure patterns. • ISP verification: ISPs configure rDNS for their customer IP ranges. A residential Comcast IP might resolve to c-67-165-1-1.hsd1.pa.comcast.net — confirming the ISP assignment. Our tool uses Google's DNS-over-HTTPS API (dns.google) to perform PTR lookups, which is reliable, fast and works without any API key.

Our tool classifies every IP address into one of five ISP types based on the organisation name and ASN: 🏠 Residential ISP — A standard home internet connection (Comcast, BT, Deutsche Telekom, etc.). Low risk score. Most e-commerce customers come from this category. 🏢 Business ISP — A corporate leased line or business broadband. Slightly elevated risk as bots and scrapers may use business IPs, but most are legitimate. 📱 Mobile Network — A cellular carrier's IP pool (Verizon Wireless, Vodafone Mobile, etc.). Low risk. IP location accuracy is lower because mobile IPs are pooled nationally. ☁️ Cloud Hosting — A datacenter or cloud provider IP (AWS, Google Cloud, Azure, DigitalOcean, Hetzner, OVH, etc.). Medium-high risk. Real users rarely have datacenter IPs — this category is common for bots, scrapers, and server-based automation. 🔴 VPN Provider — An IP belonging to a known VPN service (NordVPN, ExpressVPN, etc.). High risk. The actual user's location and identity are concealed. This classification is more actionable than a raw ISP name — it tells you what kind of entity is behind the connection, which is what fraud prevention, marketing and security teams actually need to know.

The comparison mode lets you analyse two IP addresses simultaneously and see their attributes displayed side by side. This is useful in several scenarios: Before/after VPN: Look up your IP without and with a VPN to confirm the VPN is masking your real location and ISP correctly. Suspicious logins: A user logs in from IP A (their usual location) and 10 minutes later from IP B (different country). Comparing both IPs shows whether this is physically possible — the "impossible travel" fraud detection technique. Server vs client debugging: Compare your own IP with a server IP to understand the routing context between them. CDN verification: Check whether traffic is being served from the expected CDN PoP for a given region. Traffic analysis: In web analytics, compare the ISP types of two audience segments to understand whether one is disproportionately bot or datacenter traffic. To use it: switch to the Compare tab, enter two IPs (or click "Use My IP" for either field), and click Compare. Differences between the two results are highlighted in the output.