01
IP INPUT
Enter IP or use auto-detect
IP Lookup
Find your IP address, geolocation, ISP, and check for VPN, proxy, or Tor usage
HOW IT WORKS
Complete IP address analysis
02
GEOLOCATION
Determine location and ISP
03
ISP INFORMATION
Get provider and ASN
04
THREAT ANALYSIS
Check VPN/Proxy/Tor status
What an IP Lookup Actually Knows About You
Type an IP into a lookup tool. Get back a country, a city, an ISP, sometimes a flag for VPN/Tor, and a 'fraud score'. Looks definitive. Most of it is a guess. IP geolocation is not GPS. There is no protocol that asks an IP for its location. There are databases that map IP ranges to claimed locations, maintained by a handful of commercial vendors who reverse-engineer the data from WHOIS records, DNS hostnames, BGP announcements, traceroute timings, and millions of correction submissions from people noticing their IP is shown 200km off. The closer the lookup gets to street-level, the more it's interpolating from indirect signals. What's reliable: the AS number, the country, often the ISP. What's loosely accurate: the city, the latitude/longitude (which lookup tools display with three decimals of false precision). What's a coin toss: VPN detection on borderline cases, ZIP code, neighborhood. Sections below: how the database actually gets built, why ASN beats city, and what the threat-score is really measuring.
How an IP Database Actually Gets Built
Five sources, in declining order of trust. WHOIS records. Every IP block is allocated by one of five Regional Internet Registries (ARIN for North America, RIPE for Europe, APNIC for Asia-Pacific, LACNIC for Latin America, AFRINIC for Africa). The registry record names the organization that holds the block, often with a registered address. For 1.1.1.0/24 (Cloudflare's public DNS prefix), WHOIS says 'Cloudflare, San Francisco, CA'. This is ground truth for who owns the block, not necessarily where the traffic originates. Like reading a fleet vehicle's registration: it tells you the operator in Memphis, not where the truck is parked tonight. DNS hostnames lie second. Reverse-DNS PTR records sometimes contain location hints. `ge-0-0-0.london.edge1.example.net` strongly suggests London. ISPs follow naming conventions like `cgnat-pool-msk-12.provider.ru` (Moscow). Geolocation parsers extract these patterns. Hostnames lie when ISPs use generic naming (`pool-12.dynamic.provider.com`) or when the parser misreads ('la' could be Los Angeles or Louisiana). BGP announcements add a third layer. The Border Gateway Protocol routes IP traffic between networks. Public BGP feeds (CAIDA, RouteViews, RIPE RIS) publish announcements. From those, you can infer that AS-X announces 192.0.2.0/24 to its neighbors, who is its upstream, and which datacenters participate. ASN-to-organization mapping comes directly from this. Geolocation gets less direct value here, more for network classification. Latency triangulation works through probes from known landmarks. Servers in major cities measure round-trip time to a target IP. Speed of light caps how far the IP can be from each probe. Three or more probes constrain the IP to a region. Used by services like CAIDA's ARK and Spur. Effective at country level, weak at city level once the IP sits in a continent's interior. User correction feeds close the loop. MaxMind has a public correction form. Cloud providers, content delivery networks, and large platforms submit bulk corrections when their users complain. These bulk feeds are how a Comcast subnet misclassified as Pittsburgh moves to Cleveland three months later. The actual lookup tool combines all five into one row in a database. 'Your IP, Frankfurt, DE, Deutsche Telekom, AS3320' is a synthesized statement, not a measurement.
Why ASN Beats City Every Time
The ASN field on a lookup tool is the most informative single value, and most users skip past it. An Autonomous System Number is a globally unique identifier for a network operator on the public internet. AS15169 is Google, AS16509 is Amazon, AS13335 is Cloudflare, AS3320 is Deutsche Telekom, AS8075 is Microsoft. There are roughly 110,000 active ASNs as of 2024. The mapping from IP to ASN comes from BGP route data and changes slowly (operators announce stable prefixes for months or years). What ASN tells you that city doesn't: Datacenter vs residential. AS16509 (Amazon AWS), AS14061 (DigitalOcean), AS24940 (Hetzner), AS63949 (Linode/Akamai). All hosting providers. AS7922 (Comcast), AS701 (Verizon), AS3320 (Deutsche Telekom). All residential ISPs. AS-level classification is how every fraud-detection system distinguishes 'user at home' from 'user on a VPS', the same way zip codes work for postal sorting instead of reading every street address. Then VPN provider identification. Most major commercial VPNs run on their own AS or rent IPs from specific datacenter ASNs. AS9009 was M247, a major VPN datacenter operator that hosted exits for ExpressVPN, NordVPN, and others until they restructured in 2023. AS197902 (Datacamp) hosts Surfshark exits. ASN matching is more reliable than IP-by-IP VPN list maintenance because the IP list rotates faster than the ASN. Network-type signals fall out of the ASN too. AS15169 traffic to a non-Google service is almost always Google's crawler or one of its scraping platforms (Google Search, Google Cloud, etc.). AS396982 is Google Fiber's ISP arm. The ASN tells you the role. Country-level routing also sits at the ASN layer. ASNs are nationally regulated. Russian operators have RU-issued ASNs, Chinese operators have CN-issued ASNs, regardless of where the actual servers physically sit. ASN is closer to 'regulatory jurisdiction' than 'geographic location'. City-level geolocation, by contrast, can mislead by hundreds of kilometers. Mobile carrier traffic shows the egress city, not the device's actual city. CDN-routed traffic shows the CDN's PoP, not the origin server. Recently-reallocated IP blocks lag the database by weeks. The city field is best treated as 'approximately, often', not as fact.
What 'Fraud Score' is Actually Measuring
The fraud-score field on most IP lookup tools synthesizes about a dozen sub-signals into a 0-100 number. Knowing what feeds the number tells you whether to trust it. Sub-signals that move the score up: - IP appears in DNSBLs (Spamhaus, SpamCop, Composite Blocking List) - IP belongs to a known VPN/proxy provider (Spur and IPQS data) - IP belongs to a Tor exit node (Tor Project's published list) - IP is on a hosting/datacenter ASN - IP recently sent abuse traffic (failed login attempts, scraping patterns) according to threat feeds - Geolocation differs from the user's claimed billing country (when context is available) - IP is in a CGNAT range with documented abuse from neighbors - IP's TCP/TLS fingerprint matches known scanner tools (Shodan, Censys, masscan) Sub-signals that don't move the score: - Whether the user is doing something bad right now. The score is a prior, not a posterior. It gives the prior probability that an unfamiliar IP is a fraud risk based on historical behavior of similar IPs. In Bayesian terms, the score is exactly that: like a hospital triage nurse glancing at vitals before any test results, ranking risk, not making a diagnosis. - Whether the user's intentions are legitimate. A journalist using Tor to access a banking site shows up as fraud-score 95 because that's what the IP looks like, not what they're doing. The commercial scoring providers (IPQS, Spur, MaxMind minFraud, Sift, DigitalElement) all publish broadly similar scores within a few points for any given IP. Where they diverge is on edge cases: residential proxies (compromised home routers reselling bandwidth), brand-new VPN exits, recently-rotated CGNAT ranges. Spur leads on residential-proxy detection as of 2024-2025 because they actively crawl proxy resellers. IPQS leads on consumer fraud signals because their feed is wired into the e-commerce stack. Reading a fraud score: 0-25 is residential consumer baseline, 25-50 is 'something's interesting' (mobile, CGNAT, VPN), 50-75 is 'datacenter or anonymizer', 75-100 is 'high probability of automated/abusive traffic'. The number isn't a verdict, it's a sorted bucket. Treating it as a verdict is the mistake fraud teams make until they see a 90-score on a real customer using a corporate VPN. The WHOX IP lookup pulls the AS number, the registered organization, the geolocation triangle (country, region, city), VPN/proxy/Tor classification from current public feeds, and a fraud-score breakdown that shows which sub-signals contributed. The breakdown is the part that matters. The number alone isn't.
FREQUENTLY ASKED QUESTIONS
Can websites see my real IP address?
Yes, unless you're using a VPN, proxy, or Tor. Your IP address is sent with every request you make on the internet. Websites can use it to determine your approximate location and identify you across sessions.
What does VPN Detected mean?
When we detect VPN usage, it means your IP address belongs to a known VPN provider. This is not necessarily bad - it means your real IP is hidden. However, some services may block VPN IPs.
Why is my location wrong?
IP geolocation is based on databases that map IP ranges to locations. These databases are not always accurate, especially for mobile networks or recently reassigned IP ranges. The accuracy is typically within 50km for most connections.
All our tests
Run the full WHOX toolkit from one place: leak checks, fingerprint probes, network diagnostics, reputation lookups, and privacy failure tests.