IP Address Lookup

An IP address identifies a network interface, not a person and not a building. Everything downstream of that is inference: registries record who holds a block, BGP records who announces it, and geolocation vendors map blocks to places using registry data, ISP-published mappings and latency measurement. That is why country accuracy sits near 95-99% while city accuracy is closer to 50-80%. The coordinates here are a city or allocation centroid, formatted to four decimal places for machine consumption, not measured from a device. If a lookup places you fifty kilometres away at your carrier's regional gateway, nothing is broken: it is describing where your traffic surfaces onto the public internet, which is the only thing an IP can describe. Read the network fields when the location fields look wrong.

The ISP & Network section is the part worth trusting when the city looks wrong. Registry and routing data changes slowly and is authoritative in a way a city guess never is: an allocation is a recorded fact, a city is an estimate. If you are correlating server logs, deciding whether a signup came from a cloud region, or writing an abuse rule, key on the ASN and the organisation rather than the city string, which drifts between database refreshes while the underlying network stays put. Each value here carries its own copy button, so you can lift one without retyping it. Read all four together before concluding anything about where a request came from.

Three booleans sit in the Connection Details row: Mobile, Proxy/VPN and Hosting/DC, each rendering a plain Yes or No, with the two risk flags turning amber when set. Proxy means the address appears in known proxy, VPN or Tor exit ranges. Hosting means the block belongs to a datacenter or cloud provider rather than a consumer ISP. Mobile means a cellular carrier network. These are classification lookups, not behavioural scoring, and the limits follow from that. Commercial VPNs on rented cloud capacity almost always trip hosting. Residential proxy networks reselling consumer connections frequently trip nothing, because the addresses genuinely are consumer addresses. Use the flags to triage — a signup from a hosting range deserves more scrutiny than one from a residential ASN — but never as a single-factor block, since corporate VPNs and tunnel brokers land in the same bucket as abuse.

Most IP lookup pages are built for a visitor who wants to read a city name once. This one assumes you need the value somewhere else. The JSON view renders the complete record at two-space indentation with camelCase keys, and Copy as JSON puts it on the clipboard in one press, ready for a test fixture, a geoblocking rule, a support ticket or a seed file. Every card in the Location, Time & Currency and ISP & Network sections carries its own clipboard button as well, so you can lift just the ASN or just the timezone identifier without editing a blob afterwards. Copy All Information produces the same data as labelled plain text for trackers that mangle code blocks. Nothing is truncated and no field is held back behind a signup.

Be sceptical of any IP lookup claiming to be fully offline, because geolocation needs a database no browser ships. Here is the honest boundary. Validation, private-range rejection, version detection, coordinate formatting, currency and calling-code lookup, the flag emoji, the ticking timezone clock and every copy action run entirely in your browser. The geolocation query itself goes from your browser straight to ip-api.com; it is not proxied through, logged by or stored on any DevDrills server. There is no account, no cookie wall, no email capture and no quota form. What that does not mean: ip-api.com sees the request, and it sees your own address whenever auto-detect runs. If you need lookups no third party observes, run a local MaxMind GeoLite2 or DB-IP database server-side instead.

One lookup returns up to 31 top-level fields. From the provider: IP, continent and continent code, country and its ISO 3166-1 alpha-2 code, region name and region code, city, district, ZIP, latitude, longitude, IANA timezone, raw UTC offset in seconds, currency code, ISP, organisation, AS number, AS name, and the mobile, proxy and hosting booleans. Derived in your browser: IPv4 or IPv6 version, formatted UTC offset, local time, international calling code, currency symbol and name, and a country flag emoji built from Unicode regional indicator code points, so any ISO country code renders a flag even when it is not in the built-in table.

No. There is no DevDrills backend in this path. The page is a client component and the lookup is a fetch from your browser straight to ip-api.com, so nothing is proxied through, logged by or stored on a DevDrills server. No account, no API key, no email capture, no quota form. Be clear about what that does not mean: ip-api.com receives the request, and looking up your own IP necessarily reveals it to them. Validation, private-range rejection, version detection, coordinate formatting, the ticking timezone clock and every copy action run entirely in your browser.

Country-level accuracy is typically 95-99%. City-level is roughly 50-80% and degrades sharply outside dense urban areas, on mobile carrier networks that route through regional gateways, and on IPv6 ranges with sparse registry data. The coordinates are not your device's position: they are a centroid for the city or for the ISP's allocation. The Coordinates card formats them to four decimal places, about 11 metres of nominal precision, because that is the format mapping URLs expect, not because the underlying data resolves to 11 metres. Never treat an IP coordinate as a street address.

Private and reserved addresses have no public routing and no geolocation record, so typed input is rejected in the browser before any request goes out. Blocked IPv4 prefixes: 10.x, 172.16-172.31.x and 192.168.x (RFC 1918 private use), 127.x loopback (RFC 1122), 169.254.x link-local (RFC 3927) and 0.x. On IPv6 it blocks ::1 loopback and any address beginning fc00:, fd00: or fe80: — those are literal prefix matches, not full coverage of fc00::/7 and fe80::/10. You get a warning instead of a wasted request and a meaningless result.

Yes. Input is checked against an IPv4 dotted-quad pattern and an IPv6 pattern covering the full eight-group form plus compressed forms using a single ::, including trailing ones such as 2001:db8::. IPv4-mapped syntax like ::ffff:192.0.2.1 and zone suffixes like %eth0 are rejected. Version is decided by the presence of a colon, so 2001:0db8:85a3:0000:0000:8a2e:0370:7334 reports IPv6 and 8.8.8.8 reports IPv4. IPv4 is a 32-bit space of about 4.3 billion addresses; IPv6 is 128-bit. Expect thinner geolocation on IPv6: country confidence holds, city often does not.

An Autonomous System Number identifies the network announcing the prefix that contains the IP in BGP. The card shows the number plus the operator name, for example AS15169 Google LLC, with AS name repeated underneath as a separate value. ASNs were originally 16-bit (0-65535) and were extended to 32 bits by RFC 6793, which is why modern allocations run to six and seven digits. The ASN is the most stable identifier in the record: cities and ZIPs drift between database refreshes, but the announcing network rarely changes. Use it to correlate logs, filter abusive traffic or confirm which cloud provider a request came from.

It reports three booleans in the Connection Details row: proxy (the address appears in known proxy, VPN or Tor exit ranges), hosting (a datacenter or cloud allocation rather than a consumer ISP), and mobile (a cellular carrier network). These come from range classification and registry data, not traffic analysis or behavioural scoring. The practical consequence: a commercial VPN running on rented cloud capacity will usually trip hosting, while a residential-proxy network reselling consumer connections often trips neither. Treat the flags as a strong signal for fraud triage or geoblocking decisions, never as proof on their own.

Switch the toggle from Cards to JSON, or press Copy as JSON in the header from either view. The page runs JSON.stringify on the whole record at two-space indentation, with nothing trimmed for display. Keys are camelCase apart from asname: ip, version, continent, continentCode, country, countryCode, region, regionCode, city, district, zip, latitude, longitude, timezone, timezoneOffset, currency, currencySymbol, currencyName, isp, org, as, asname, mobile, proxy, hosting, query, localTime, utcOffset, callingCode, plus nested flag and security objects. It pastes straight into a test fixture, a bug report or a seed file.

Because it is computed in your browser, not fetched. The lookup returns an IANA timezone identifier such as Asia/Kolkata or America/Los_Angeles, and the page feeds it to toLocaleTimeString and toLocaleDateString with the timeZone option on a one-second interval, so daylight saving is handled by your browser's own ICU data rather than a stale server offset. Nothing is polled after the initial lookup, so the clock costs no further requests. One caveat: the UTC offset badge beside it is rounded to whole hours, so trust the IANA identifier over the badge in half-hour zones like Asia/Kolkata.

ISP is the network operator carrying the traffic, taken from registry and routing data. Organization is the entity the address block is allocated to. For home broadband the two are usually identical. They diverge in exactly the cases developers care about: a company bringing its own IP space onto a transit provider, a cloud tenant with assigned addresses, or a business line where the ISP is the carrier and the org is the customer. AS name is a third value, the label attached to the announcing autonomous system, and it can differ from both. All three have their own copy buttons.

No, and that is the point: it shows the exit node your traffic leaves from. That makes it a fast way to verify a tunnel is actually engaged. Press the refresh icon after connecting and check that the country, ISP and ASN changed and that the hosting or proxy badge turned amber. If the ISP still reads as your home broadband provider, your VPN is not carrying browser traffic. WebRTC leaks and DNS leaks are separate failure modes that no IP lookup can detect, so a changed exit node is necessary but not sufficient.

There is no DevDrills-side limit, no account and no API key. The underlying free endpoint, ip-api.com, allows 45 requests per minute per source IP; past that it rejects the call and the page shows a failure message rather than stale data. Nothing is queued or retried. For bulk work such as enriching a log file or scoring thousands of signups, do not drive any browser tool in a loop: run a local MaxMind GeoLite2 or DB-IP database server-side, where you get deterministic results, no rate limit and no third party watching your query volume.