Want to get as much information about an IP address as possible? You’re in the right place.
Our guide on IP lookup tools and IP search will show you what’s possible and how it might benefit your company.
What is an IP Lookup Tool?
IP lookup tools allow you to learn more about a web user based on their IP address. It is a form of data enrichment: You start with a single data point (an IP address) and gather extra information.
There are dozens of different IP lookup tools. Some check proxies, while others look at whether an address appears on a blacklist. IP lookups are also known as IP address lookups, IP search, IP checkers, or even IP analytics.
Enter an IP address below to see what SEON’s lookup tool can reveal:
With SEON’s IP lookup you can identify bot traffic, spot connections between users, or gauge how risky a transaction is. It’s ideal at the onboarding stage, during user login, or at the checkout stage.
Why Perform an IP Check?
IP lookup tools deliver a wide range of information. For some, that information is helpful during an OSINT investigation. For others, it’s to reduce the chance of dealing with fraudsters and other bad actors.
However, most IP lookups tend to be performed by technical teams in the context of system administration or security research.
What Data Can You Gather from an IP Search?
Without going into technical details, here is the kind of information you can gather after enriching data from an IP lookup:
IP Address Validity
A simple IP ping test will let you know if the address is receiving data or not. Put simply, it’s about checking if the IP address is valid.
Ping test response time should be fast (under 10ms). Anything over 100ms could show that there are problems with that connection – including that it is going through proxies or nodes (see below).
Hundreds of mail servers worldwide collaborate on maintaining lists of spammy, fraudulent, or dangerous IP addresses. These IPs are collected in the DNSBL (Domain Name BlackList) and RBL (RealTime Blacklist), among others.
It is easy enough to check if an IP address appears on these lists. If they do, it should give you pause for concern as they have probably been used by known email spammers in the past.
Proxy Server Detection
Proxy detection lets you learn if the user is hiding their IP by using a proxy, VPN (Virtual Private Network) or a Tor node. These types of connections are designed to bypass geo-restrictions or to keep the user anonymous.
While it doesn’t necessarily point to fraudulent activity, this should raise the risk levels of dealing with that user. Some users connect via proxies for privacy reasons. However, others hide their IPs to deliberately mask their true identity online.
IP Hostname and Domain
Every IP address is connected to a hostname and domain. Using a reverse DNS lookup, you can query DNS servers to get a PTR (pointer) record, which stores IP addresses.
This works for two reasons:
- As an extra layer of information that can be handy for network troubleshooting, identifying spammy emails, or logging more user details as part of a digital footprint analysis process.
- Secondly, you can also figure out if the connection is hiding for anonymity reasons or if other websites are also hosted on the same DNS.
Finding out who the hostname helps with another important IP lookup feature: geolocation.
IP addresses are issued by Internet Service Providers (ISPs), who select them randomly from their range. That range of potential IP addresses is tied to a rough geographic location. By performing a quick check, you can get an idea of where someone is connecting from.
Note that location accuracy varies from one ISP to the next. Things get even trickier with mobile device IPs, which change dynamically as users connect via different mobile towers and can lead to one IP assigned to several devices and real users at the same time, when the server workload is heavy – as you can read in our guide to mobile proxies.
Still, getting an idea of a user’s geolocation has plenty of advantages – even if you should take the results with a grain of salt.
It’s possible to pinpoint a place on Earth with amazing accuracy, but it’s also possible to get it very wrong – especially when dealing with people who don’t want to be found.
WHOIS is a response protocol designed to identify the owners of an IP address. Every IP address on the internet is managed by one of five regional internet registry organizations:
- African Network Information Center (AFRINIC): for African IP addresses
- American Registry for Internet Numbers (ARIN): IP addresses for the United States, Canada, and several Caribbean and North Atlantic islands
- Asia-Pacific Network Information Centre (APNIC): IP addresses for Asia, Australia, and neighboring countries
- Latin American and Caribbean Network Information Centre (LACNIC): IP addresses for Latin America and parts of the Caribbean region
- Réseaux IP Européens Network Coordination Centre (RIPE NCC): IP addresses for Europe, the Middle East, and Central Asia
This is useful to confirm the geolocation information you may already have or to spot discrepancies in the data. It may also point to a website owner, as you can search WHOIS services by name – which is an additional data point to work with.
Open Port Scan
Proxy servers and computers functioning as servers tend to have at least one open port. If you know which port that is, you can identify the server and rate its risk.
For example, we know that some unscrupulous proxy providers resell hacked SSH connections where port 22 is always open.
If you can identify that port 22 is open, you can start raising red flags. It may not necessarily mean you are dealing with malicious agents but it’s helpful information to have as part of your digital profiling process.
How to do an IP Lookup?
Performing an IP lookup tends to be done via two methods:
- Manual check: You identify the IP address and run the code yourself. You can also paste it into a dynamic online tool (which just executes the code for you). Great for single checks.
- Third-party services: Because you can extract a lot of information from IPs, certain online services allow you to run all the checks at once. These tend to be paid services. You can import lists of IPs or connect to the service via APIs.
4 of the Best IP Lookup Tools Available in 2022
Disclaimer: Everything written in this article was gleaned from online research, including user reviews. We did not have time to test all the tools manually. However, we’ve ensured the information was correct as of Q1 2022. Feel free to contact us to request an update/correction.
SEON is a full fraud-fighting platform. Bundled with it is a selection of lookup tools, including a powerful IP lookup module. In terms of checks, you get a mix of proprietary data collection methods and common checks such as:
- ISP information and type
- open port detection
- Tor, VPN, web, or public proxy
- spam denylists
- velocity checks, including how often the IP appears on your site, plus the date first and last seen
But where SEON really shines is that it can perform these checks at scale via API call, delivering results under 200ms. For companies who need to track thousands of IP addresses, this is the best way to get as much information as possible, as fast as possible.
SEON’s IP lookup is also fully integrated with other fraud detection features, such as:
- Risk score analysis to learn if an IP points to a risky or not
- Digital footprint analysis: You can combine IP data with device data and social media checks, for instance.
- Machine learning suggestions: SEON can suggest rules based on your historical business data. This is helpful to spot patterns that human analysts may have missed.
- and much more
It is just one module in a complete end-to-end fraud prevention system, but you can also use the IP lookup module as a standalone. Moreover, this works particularly well via a lightweight Google Chrome plugin for quick manual checks.
Pros of SEON for IP Lookup
- Gather tons of information: ISP, proxy, VPN use, and more.
- Filter out fraudulent users: SEON delivers a risk score to help you decide if you should accept a user on your site, allow a login, or accept a transaction.
- Combine with other data enrichment modules: You can combine the IP data with device fingerprinting or email/phone data to build a complete customer profile.
- Flexible pricing: You get a free 30-day trial and cancel-anytime contracts.
Cons of SEON for IP Lookup
- Too sophisticated for basic checks: SEON is by no means hard to use, but it’s still a specialist tool that only risk managers will make the most of.
- You get a free 30-day trial and cancel anytime contract. It starts at $99 per month.
The website IPLocation.io is a veritable treasure trove of IP lookup tools. You will find, in no particular order: a blacklist database checker, a ping tool, IP range calculators, IP to decimal converter, and much more.
Best of all, all these tools are available for free. Simply copy an IP address and paste it into the relevant tool’s page. You can access all the different lookup tools in the sidebar, alongside some useful information about how they work, including technical details.
The only issue? Well, IPLocation.io isn’t really suitable for running big batches of IP addresses. There isn’t an API, so you’ll have to look elsewhere to integrate its results into your own business intelligence reports.
Pros of IPLocation.io
- Dozens of tools available: and not just for IP lookup either. You also get SEO tools, email tools, and cybersecurity tools.
- All accessible for free: It costs nothing to use the website.
Cons of IPLocation.io
- One check at a time: You can’t submit lists of IP addresses or connect to the service via API.
- It’s free!
MaxMind offers two IP-related services, including a fraud prevention API for transaction risk and their GeoIP databases. It’s the latter we’ll focus on, as it provides excellent intelligence from an IP address for customization, advertising, digital rights management, and compliance, among others.
The GeoIP databases are currently used by more than 5,000 businesses worldwide. It is estimated to cover a whopping 99.9999% of all IP addresses in use. The database is updated weekly and has had an excellent 99.98% uptime since 2002.
The database service is accessible via API, manual file upload, or web service.
Note that the pricing can be a bit confusing as there are six different offers from MaxMind. However, that includes a free, Lite version of the tools you can test to see if it helps your IP lookup research.
Pros of MaxMind
- Excellent for geolocation: MaxMind can detect where an IP points pretty much anywhere around the globe.
- A lot of flexibility both in terms of pricing and integration. There are a handful of licenses to choose from, so you can pay for MaxMind however it makes sense for your business.
Cons of MaxMind
- Segmented products: You first have to choose if you want their GeoIP or MiniFraud web services and the integration between the two isn’t clear. Even choosing the right GeoIP product becomes a challenge as there are so many licenses to choose from.
- Opaque pricing: Choosing a MaxMind product is hard enough. But you also have to jump on a sales call to get an idea of how much it costs.
- You need to get in touch with MaxMind to find out, though there is a limited, free version.
IPQualityScore, or IPQS as it is sometimes known, offers a veritable plethora of IP lookup tools, including Tor detection, IP reputation check, and IP blacklist check.
For cybersecurity experts, you also get what they call “threat intelligence feeds”, which connect you to their proprietary honeypot network, designed to identify cybersecurity threats.
Once you are in the IPQualityScore product ecosystem, you can also look at other anti-fraud tools such as bot detection, email verification, chargeback fraud detection, and dark web monitoring.
Pros of IPQualityScore
- Full suite of IP lookup and anti-risk tools: There is a lot to choose from with IPQualityScore, whether you need to learn more about IPs or boost your cybersecurity protection.
- Free offer: You can get up to 5,000 free IP lookups per month.
Cons of IPQualityScore
- Opaque pricing: While there is a generous free offer, it’s hard to gauge how much IPQualityScore will cost you as a business.
- The company operates under a freemium model, but the paid plans are hidden from view. You’ll need to contact them for a quote.
Fraud Detection & Prevention with IP Lookup Tool
At SEON, we’re always looking for the best ways to get information based on minimum data. This is to learn who you’re dealing with, specifically to block fraudsters before they can damage your business.
Our IP lookup tool is one of the most sophisticated on the market. The latest update brings the ability to track harmful IPs, reduce false positives, and, of course, to learn everything there is to know about an IP address.
Once you plug the IP lookup tool into your fraud detection stack, you’ve got access to all the information you need to make automated or educated guesses – and at scale.
Frequently Asked Questions about IP Lookup Tools
Yes. An IP address can reveal a lot about the person who connects with it, such as their geolocation, Internet Service Provider, and more. Note that VPNs and proxies are designed to spoof IP addresses, so the results might be flawed.
Yes. IP addresses are considered public knowledge. Any IP lookup tool that derives information from these addresses is legal and GDPR-compliant.
IP lookup data is found in ISPs’ databases, public blacklists, and proprietary databases. For instance, some companies create their own lists of suspicious IP addresses, which they flag by creating honeypot traps.
IP fraud scores are used by SEON in fraud detection, to help us catch bad actors. We have prepared a complete guide to IP fraud scoring for your perusal.
Sign up to download
In order to download this PDF, please sign up to our newsletter.
Thanks for submitting the form, click the button below to download our guide.
Click the button below to download our guide.