IP Address Lookup: Find Location, ISP & More for Any IP

Here's a myth that persists in developer circles: “An IP address reveals exactly where someone is.” It doesn't. What it reveals is where your ISP's routing equipment is — which could be a data center hundreds of miles from you. A 2024 accuracy report from BigDataCloud found city-level IP geolocation is correct only 70–85% of the time for fixed-line residential connections, and as low as 40% for mobile. That distinction matters enormously for fraud detection, content licensing, and compliance.

This guide covers how IP address lookup actually works under the hood, which data sources are used, where accuracy breaks down, and how to query IP geolocation programmatically in Node.js, Python, and Go.

The IPv4 Address Space Crisis (and What It Means for Lookups)

IPv4 uses a 32-bit address space: 2³² = 4,294,967,296 total addresses. On paper that sounds like a lot. In practice, the Regional Internet Registries (RIRs) exhausted their free pool years ago:

Exhaustion has a direct effect on geolocation accuracy. ISPs now trade IPv4 blocks on a secondary market (prices stabilized around $35–$50 per IP in early 2025 per IPXO), which means an IP block registered to one organization in a geolocation database may have changed hands recently. The typical lag between a block being reassigned and geolocation databases reflecting the change is 1–4 weeks for major providers.

IPv6 solves scarcity: its 128-bit space holds 3.4 × 10³⁸ addresses — effectively unlimited. Per Google's ongoing traffic measurements, IPv6 adoption reached 47% globally by 2024, with the United States crossing 50% in February 2025. France leads at ~80%, Germany at 74.85%. China sits below 5%. Many geolocation providers still have weaker IPv6 coverage than IPv4, which affects lookup reliability for dual-stack users.

How IP Geolocation Actually Works

IP geolocation isn't magic — it's a combination of three technical data sources cross-referenced and updated continuously.

1. WHOIS / RIR Registry Data

The five RIRs (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) maintain public WHOIS databases that map IP ranges to the organization that registered them, including a postal address. This is the baseline layer. The fundamental problem: ISPs register entire /8 or /16 blocks at their HQ address, then deploy those IPs to end users in different cities or countries. The WHOIS record says “New York”; the actual user is in Dallas.

A newer IETF standard called GeoFeed (RFC 8805) lets ISPs publish machine-readable subnet-to-location mappings directly in their WHOIS records, dramatically improving accuracy. Google and MaxMind actively consume GeoFeed data; adoption is still growing.

2. BGP Routing Tables

Border Gateway Protocol (BGP) governs how IP ranges are announced across Autonomous Systems (ASes). Public BGP data from Route Views and RIPE RIS lets providers infer location by peering point: if an IP block is announced by a router in Frankfurt with low latency to nearby infrastructure, it's probably in Frankfurt. Each AS has an ASN (Autonomous System Number) tied to a registered organization — this is why IP lookup tools show the ISP name alongside location.

# Query BGP data for an IP using whois
$ whois -h whois.radb.net 8.8.8.8
route:         8.8.8.0/24
descr:         Google LLC
origin:        AS15169
mnt-by:        MAINT-AS15169

# Or use the Team Cymru IP-to-ASN mapping
$ dig +short 8.8.8.8.origin.asn.cymru.com TXT
"15169 | 8.8.8.0/24 | US | arin | 1992-12-01"

3. ISP Cooperation and Signal Fusion

The most accurate providers combine registry data with active signals: ISPs voluntarily submit subnet-to-location mappings; GPS-confirmed app location data is correlated to concurrent IP addresses at scale; and latency measurements from known Points of Presence (PoPs) triangulate proximity. NetAcuity (Digital Element) claims 99.99% country-level accuracy and 97% city-level accuracy using this fusion approach — the highest vendor claims on record.

IP Geolocation Accuracy: What the Numbers Actually Mean

According to GlobalWebIndex (now GWI), approximately 22.9% of internet users worldwide used a VPN in 2024, with ~42% of Americans reporting VPN usage. That's a significant portion of your traffic that geolocation will get wrong at the city level — a factor to bake into any system that makes hard decisions based on IP location.

The Leading IP Geolocation Providers

Querying IP Geolocation in Code

Here are production-ready patterns for the three most common server languages. MaxMind's MMDB format is preferred over HTTP APIs for latency-sensitive paths — lookups are typically under 1ms from memory.

Node.js (maxmind npm)

import maxmind, { CityResponse } from 'maxmind'

// Load the MMDB database once at startup (not on each request)
const dbPath = '/data/GeoLite2-City.mmdb'
const lookup = await maxmind.open<CityResponse>(dbPath)

function getIPInfo(ip: string) {
  const result = lookup.get(ip)
  if (!result) return null

  return {
    country: result.country?.iso_code,           // 'US'
    countryName: result.country?.names?.en,      // 'United States'
    region: result.subdivisions?.[0]?.iso_code,  // 'CA'
    city: result.city?.names?.en,                // 'Mountain View'
    latitude: result.location?.latitude,          // 37.386
    longitude: result.location?.longitude,        // -122.0838
    timezone: result.location?.time_zone,         // 'America/Los_Angeles'
    accuracyRadius: result.location?.accuracy_radius, // radius in km
    isp: result.traits?.isp,
    asn: result.traits?.autonomous_system_number,
  }
}

// Usage — sub-millisecond in-process lookup
const info = getIPInfo('8.8.8.8')
// { country: 'US', city: 'Mountain View', asn: 15169, ... }

Python (geoip2)

import geoip2.database
import geoip2.errors

# Open reader once, reuse across requests
reader = geoip2.database.Reader('/data/GeoLite2-City.mmdb')

def lookup_ip(ip_address: str) -> dict | None:
    try:
        response = reader.city(ip_address)
        return {
            'country_code': response.country.iso_code,
            'country_name': response.country.name,
            'city': response.city.name,
            'latitude': response.location.latitude,
            'longitude': response.location.longitude,
            'timezone': response.location.time_zone,
            'accuracy_km': response.location.accuracy_radius,
            'asn': response.traits.autonomous_system_number,
        }
    except geoip2.errors.AddressNotFoundError:
        return None  # Private IP or unrecognized range
    finally:
        pass  # Do NOT close reader here — it's meant to persist

result = lookup_ip('1.1.1.1')
# {'country_code': 'AU', 'city': 'Sydney', 'asn': 13335}

Go (oschwald/geoip2-golang)

package main

import (
    "fmt"
    "net"
    "github.com/oschwald/geoip2-golang"
)

func main() {
    db, err := geoip2.Open("GeoLite2-City.mmdb")
    if err != nil {
        panic(err)
    }
    defer db.Close()

    ip := net.ParseIP("81.2.69.142")
    record, err := db.City(ip)
    if err != nil {
        panic(err)
    }

    fmt.Printf("Country: %s
", record.Country.IsoCode)
    fmt.Printf("City: %s
", record.City.Names["en"])
    fmt.Printf("Lat/Lon: %f, %f
",
        record.Location.Latitude,
        record.Location.Longitude)
    fmt.Printf("Accuracy: %d km
", record.Location.AccuracyRadius)
    fmt.Printf("Timezone: %s
", record.Location.TimeZone)
}

If you need to validate and format IP addresses before lookup, our URL encoder handles percent-encoded IP literals in URLs (IPv6 addresses in URLs must be wrapped in brackets and the colons may be encoded). You can also use our regex tester to validate IPv4 and IPv6 format before querying — see the regex patterns cheat sheet for production-ready IP validation patterns.

What IP Lookup Reveals: Field by Field

Modern IP lookup responses include far more than just city and country. Here's what each field means and when it matters:

• ASN (Autonomous System Number): Identifies the network operator. AWS IPs (AS16509), Cloudflare (AS13335), and Google (AS15169) are recognizable by ASN. Many security systems block traffic from hosting ASNs to prevent scraping and fraud.
• Connection type: Residential vs. business vs. hosting. A “residential” IP from a known hosting ASN is a strong bot signal.
• Proxy/VPN/Tor flags: MaxMind GeoIP2 Insights and IPinfo include boolean flags for known proxy IPs, datacenter IPs, and Tor exit nodes.
• Accuracy radius: The MMDB record includes an accuracy radius in kilometers. A radius of 500km on a “city-level” result means the city field is essentially noise. Check this field before making decisions based on location.
• Timezone: Derived from geolocation, not from the IP itself. Use it for display purposes (showing the user their local time), not for security decisions.

Real-World Use Cases for IP Lookup

Fraud Detection

Payment processors compare the IP geolocation against the billing address. A billing address in London with an IP geolocating to Lagos is a strong fraud signal — not definitive proof, but worth triggering additional verification. Cloudflare launched a dedicated Fraud Detection product in 2023 specifically for this pattern: fake account creation, card fraud, and account takeover attempts all have IP geolocation anomalies as a key signal.

Use our hash generator to fingerprint IP + User-Agent + Accept-Language combinations for bot detection heuristics without storing PII directly.

CDN Routing and GeoDNS

CDNs like Cloudflare, Akamai, and Fastly use IP geolocation to route every HTTP request to the nearest Point of Presence (PoP). This is called anycast routing: the same IP address is announced from multiple data centers, and BGP routing directs each user's traffic to the closest one. GeoDNS does the same at the DNS resolution layer — returning different A records based on the requester's IP region. Both depend on accurate IP geolocation to work.

Content Licensing and Compliance

Streaming services are legally required to enforce regional content licenses. If a movie has UK rights but not US rights, the platform must geo-block US viewers. IP geolocation is the primary enforcement mechanism. This is also why streaming VPN usage is so widespread — users intentionally defeat the system.

GDPR compliance uses IP lookup to determine which privacy notice to serve: EU visitors get the full GDPR notice, California users get the CCPA notice, others get a generic one. The irony is that GDPR simultaneously requires geolocation (to serve the right notice) and restricts IP data collection (since IP is personal data under Article 4(1)).

For more on networking concepts like DNS-based routing, see our DNS records deep dive. If you want to check your own current IP address and its geolocation details, use our What Is My IP tool.

Privacy and Legal Considerations

The GDPR is explicit: IP addresses are personal data under Article 4(1) as “online identifiers.” Processing IP addresses requires a legal basis — typically legitimate interest (for security logging), consent (for analytics), or contract (for fraud prevention). Static IPs are unambiguously PII. Even dynamic IPs are treated as personal data in EU courts, because when combined with a timestamp, they can identify a specific user to the ISP.

Practical implications for developers:

• Log IP addresses only as long as operationally necessary; document your retention period
• Consider IP masking (storing only the first two octets: 192.168.x.x) for analytics use cases where precise IP isn't needed
• Google Analytics 4 anonymizes the last octet of EU user IPs by default
• Under CCPA, IP-derived location data is “personal information” subject to deletion rights
• Do not share raw IP logs with third-party analytics without a Data Processing Agreement

IPv4 vs IPv6: Lookup Differences

IPv6 addresses present distinct lookup challenges. The address format is radically different (eight groups of four hexadecimal digits: 2001:0db8:85a3:0000:0000:8a2e:0370:7334), and the database coverage is weaker because IPv6 deployment is still maturing in many regions. Additionally, privacy extensions (RFC 4941) generate random interface identifiers that change frequently, making device tracking harder — by design. For lookups, most providers handle IPv6 the same way: the /48 or /64 prefix identifies the ISP network, and geolocation resolves to that network's PoP.

Validate IPv6 addresses before lookup — the format is complex. See our regex patterns reference for tested IPv6 validation patterns.

Frequently Asked Questions

Related Articles

• What Is My IP Address? Public & Local IP Finder
• DNS Records Explained: A, AAAA, CNAME, MX, TXT & More
• Essential Regex Patterns Cheat Sheet: IP, Email, URL & More
• SSH Keys Explained: Generation, Management & Best Practices
• Hash Functions Explained: MD5, SHA-256, bcrypt & More