IP address lookup: what you can find out, and what you cannot

An IP address lookup answers four things: which network the address belongs to (its ASN), what kind of network that is (residential, mobile, datacenter, gateway), approximately where it is (country, region, city), and whether it has been observed in proxy, VPN or other risk infrastructure, with the age of that observation. It does not return a person, an account, a street address or a company name — those are not in the routing data, and a lookup that claims to have them is substituting a guess.

Look up an address

curl https://ip99.com/v1/ip/8.8.8.8

No key and no signup. To look up the connection you are calling from, drop the address: curl https://ip99.com/v1/ip.

The fields, and what each one actually is

• ip — the address itself, normalized. IPv4 and IPv6 are both accepted on the same endpoint.
• geo — country, region, city, lat, lon, tz, continent; district, subdivision and admin_code additionally on addresses in China. Accuracy and its limits: IP location.
• network.asn — the autonomous system that announces the address. This is the closest thing to an "owner" that routing data contains, and it identifies the operator of the network, not the customer using an address. See what is an ASN.
• network.usage_type — IDC datacenter, DYN residential broadband, MOB mobile, GTW gateway / NAT egress. This is usually the single most useful field for deciding how much to trust an address.
• risk.score, risk.level, risk.signals — whether the address has been observed in proxy, VPN, dial-up, cloud-phone or hosting infrastructure. Signals are slugs in alphabetical order, and the key is absent when nothing matched. hosting and mobile describe the network rather than evidence of abuse.
• evidence_state, computed_at — how fresh that evidence is and when the verdict was computed. Read these together with the score, never the score alone: what an IP risk score means.

What a lookup cannot tell you

• Who a person is. An address is a connection. There is no name, account or identity in the routing data.
• An owner's name. IP99's English API reports the ASN and not an operator name, because the number is exact and the name is not. Operator names live in the routing registries, which you can query separately with that ASN.
• A street address. Geolocation resolves the block. See the accuracy section on IP location.
• Whether an address is on a public blocklist. That is a different kind of data, held by the blocklist operators. IP99 reports its own observations of proxy and risk infrastructure, not Spamhaus or MXToolbox listings.
• Whether a user is trustworthy. An address with no evidence is unknown, not clean, and an address with evidence may be shared by hundreds of people. Combine it with your own signals.

Browser, ownership and WHOIS: where to go instead

Three things people often want from an "IP lookup" are not what this endpoint does, so here is where each one actually lives:

• Browser, device or fingerprint — not derivable from an address at all. That is a client-side signal.
• Operator name, registration and abuse contacts, allocation dates — the regional internet registries publish this per ASN and per block (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC). Take the ASN from this lookup and query the registry with it.
• Public blocklist status — the blocklist operators themselves, each with their own lookup for their own list.

FAQ

How do I look up an IP address?

Send it to the endpoint: GET https://ip99.com/v1/ip/{ip}, free and without a key, and read the JSON. To look up the connection you are calling from, call GET https://ip99.com/v1/ip with no address.

Can I find out who owns an IP address?

The lookup gives you the ASN, which identifies the organisation operating the network — an ISP, a hosting company, a cloud or a university. It deliberately does not return an operator name, because the ASN is exact and names are not. Registry records hold the registration and abuse contacts for that ASN.

What does an IP address lookup return?

Geolocation (country, region, city, coordinates, time zone), the network (ASN and usage type) and any observed risk infrastructure with the age of that evidence. It does not return people, accounts, street addresses or public blocklist status.

Is it free?

Yes. GET https://ip99.com/v1/ip/{ip} needs no key and no signup, and is rate limited per client IP. More volume, keys and per-source evidence detail are on the pricing page.

Does it work for IPv6?

Yes. IPv6 addresses are accepted on the same endpoint and return the same fields as IPv4.

What is the difference between an IP lookup and a WHOIS lookup?

A WHOIS query asks a registry who registered an address block, and returns names, contacts and dates. An IP lookup asks what the address is and how it is behaving now: geolocation, network type and observed risk evidence. Use the ASN from the lookup as the key for the registry query — the two are complementary, not substitutes.

Related: What is my IP address? · IP location: where an IP address is · How to detect a proxy, VPN or datacenter IP · Rotating residential proxies and dial-up pools · Residential proxy vs datacenter proxy · Is this IP a VPN? · What an IP risk score means · How fresh should IP risk evidence be? · What is an ASN? · Free IP geolocation and risk API · Proxy exit addresses captured this week · IP risk profile · IP ranges by country · IP ranges by ASN.