IP address lookup
See what an IP address actually is: the network it belongs to, the registry that allocated it and when, the operator behind it, and whether it is a datacenter range, a Tor exit, a named VPN exit, relay egress or a verifiable crawler. Free, no signup — and it answers about a network, never about a person.
Live demo
POST /demo/ip · no key needed
Response
Look up any address to see the full API response, straight from the live service.
What gets checked
Every lookup runs the same pipeline as the Spaw API, entirely against data held on this server. Continent, country, region and city come from the free DB-IP Lite database; the registry that allocated the block, the country it was registered to and the allocation date come from the five regional registries' own delegation statistics; the ASN and the operator name come from the same database. Compiled range files settle the flags: the Tor Project's exit list, the ranges the large clouds publish alongside the open datacenter lists, the server lists three VPN operators publish, Apple's iCloud Private Relay egress list, the public blocklists Spamhaus DROP and ASN-DROP and abuse.ch's Feodo Tracker, and the ranges Google, Microsoft, OpenAI, Perplexity, DuckDuckGo and Ahrefs publish so their crawlers can be verified. Where a network operator publishes its own location in an RFC 8805 geofeed, that declaration beats the database and location_source says operator.
What an IP address cannot tell you
An address identifies a network interface for the length of a connection. It does not identify a person, a household or a device, and nothing on this page claims otherwise.
The country is the network's country. On an ordinary consumer connection that is a good proxy for where somebody is; on an address belonging to a hosting company, a VPN operator or a relay it is where the operator put the exit, and nothing more. When is_datacenter, is_vpn, is_relay or is_anonymous comes back true, read the location as the operator's — the API's cross-signal endpoint withholds its country comparisons on exactly that condition rather than counting a VPN as a disagreement.
City-level precision from free data is approximate everywhere and varies by region, which is why the response carries location_confidence and this page says so instead of selling street-level certainty. A datacenter or VPN flag describes the connection, not the person behind it. And residential proxies are not detectable from open data by anyone, so the lookup does not pretend to see them.
Reading the answer
The flags are tri-state. false is a checked negative; null means no installed list covers that address, so the question was never asked — a flag whose feeds hold no ranges for an address family answers null rather than a fabricated false. Which flags that applies to depends on which feeds this deployment has installed, and /status lists them.
risk_score is arithmetic you can recompute from the flags in the same response: unallocated 100, blocklist 80, Tor 70, your own abuse reports 60, datacenter 40, reports from three or more accounts 40, VPN 30, relay 10 — summed and capped at 100, with one exception: relay egress and a verified crawler never carry the datacenter weight, because both sit on infrastructure by design and their operator is known. risk_signals lists every signal that contributed and the dataset behind it, so a score you disagree with can be taken apart. A private, loopback or documentation address answers reason reserved_range and stops there: there is no network to look up.
Frequently asked questions
Does this tell me where the person is?
No. It tells you where the network is registered and where its operator says the address sits. For an ordinary consumer connection that is a dependable country and an approximate city; for a hosting, VPN or relay address it is the wrong question, because the address belongs to the operator rather than to whoever is using it. Country is the level that holds — city-level precision from free data is approximate everywhere and should never carry a compliance or identity decision on its own.
Why is the country not the country I am in?
Because you are probably not connecting from your own network. On a VPN exit, a corporate proxy, a mobile carrier gateway or iCloud Private Relay, the address is the operator’s and the answer is the operator’s location. That is exactly what is_vpn, is_relay, is_datacenter and location_source are for: they tell you when the country belongs to a network operator and not to a visitor.
Is a datacenter or VPN address a bad address?
No. It is a fact about the connection, not a judgement about the person. Plenty of ordinary people browse through a VPN or a relay, and blocking them blocks customers. Treat the flags as one input to a policy you write, not a verdict — the score is a transparent sum you can recompute from the same response and disagree with.
Can you detect residential proxies?
No, and neither can anyone else working only from open data. The open and first-party lists cover datacenter ranges, commercial VPN egress, relay egress and Tor exits. Residential-proxy detection needs proprietary network telemetry; if it ever ships here it will be a separately labelled premium signal, never folded quietly into the score.
Do you keep the address I look up?
There is no key, no signup and no account on this page, so there is nothing to record a history against. The lookup runs against databases and compiled range files held on this server — no third party is asked — and the answer is cached for an hour under a hash of the address so a repeat is not recomputed.
Is there a limit on this free lookup?
Ten lookups a minute per visitor. For volume there are batch and bulk endpoints, monitored lists and webhooks behind a free API key, with 10 lookups a month included and no card required.
More free tools
All free toolsNeed this at scale?
The Spaw API runs the same lookup with batch and bulk endpoints, monitored lists, webhooks, abuse contacts and reverse DNS — 10 free lookups a month, no card required.