You can find the ISP and network details behind a public IP address using an IP lookup tool or a WHOIS or RDAP query. The results can show who manages the network, which registry holds the record, and roughly where the address is based.
This is a quick way to check IP address details when you spot an unknown address in a server log, an email header, or a security alert. This guide explains what each part of a result means, using 111.90.150.204 as a working example, and covers how far you can trust the information you find.
An IP address identifies a network connection or interface on the internet. A lookup doesn't read anything from the device itself. It pulls information from public registry records and commercial databases.
A typical lookup can show:
Just as important is what a lookup can't show. It won't give you a person's name, home address, or browsing history. An IP address points to a network connection, not directly to an individual.
Some addresses only work inside private networks. These include ranges starting with 10, 192.168, and 172.16 through 172.31. Home and office networks commonly use these ranges, which cannot be looked up in the same way as public IP addresses.
An address such as 111.90.150.204 falls outside those private ranges, so it can be checked in public registry data.
Many free websites let you paste in an address and see the results immediately. Look for a tool that shows the organization, ASN, and IP range rather than only a map pin. Those fields usually provide more useful network information than the estimated location alone.
WHOIS is the older system for reading registry records. RDAP is the newer protocol and returns similar registration data in a more structured format. Both can provide information maintained by regional internet registries.
On macOS and many Linux systems, you can type:
whois 111.90.150.204
Windows doesn't include a WHOIS command by default. A web-based WHOIS or RDAP service can be used instead.
Reverse DNS looks for a hostname associated with an IP address. A hostname can sometimes hint at how the address is used. Names containing words such as "static," "dynamic," or a server label may indicate whether the address is associated with a subscriber connection or server infrastructure.
Use:
Windows: nslookup 111.90.150.204
macOS and Linux: dig -x 111.90.150.204
Many addresses have no reverse-DNS hostname, so an empty result is normal.
Different lookup tools often disagree, especially about city-level location. Check the result in at least two places before relying on it. Registry information, such as the organization and IP range, is generally more dependable than an estimated city location.
The address 111.90.150.204 falls within address space administered through APNIC, the Regional Internet Registry for the Asia-Pacific region. A registry lookup can therefore be used to check the associated network record.
The record may list fields such as the network name, organization or description, country code, address range, status, and abuse contact. The current operator should be confirmed with a live lookup because address ranges can be reassigned and registration details can change.
A registry record commonly contains fields like these:
Field: What it means
Inetnum: The range of addresses covered by the record
Netname: A short label for the network
Descr: A description that may name the organization
Country: The country associated with the registration
Status: Whether the range is allocated or assigned
admin-c / tech-c: Contact handles associated with administrative or technical management
Abuse mailbox: Where reports about misuse can be sent
The country field shows where the range is registered or associated in the registry record. It does not necessarily show where a particular device is physically located.
Country-level results are generally more reliable than city-level results. IP geolocation databases may combine registry records, routing data, and other estimates, and their information can be outdated or inaccurate.
Several factors can affect the result:
If a tool places an address in a particular town or city, treat that location as an estimate rather than a street-level position.
The organization name is often the first clue. A consumer ISP usually appears under a telecom or broadband provider, while a hosting company or cloud provider may be identified in the organization name or network description.
The ASN can provide additional context. If the ASN is associated with residential broadband or mobile subscribers, the address may belong to a consumer network. If the ASN belongs to a hosting or cloud company, the address may instead be associated with a server, website, VPN, or other hosted service.
This distinction can provide useful context when reviewing login attempts or other network traffic. Neither network type proves that the activity is legitimate or malicious, but it can help determine what to investigate next.
Common reasons include:
A single IP lookup rarely settles a security question. Use it as one piece of evidence. If you need to report abuse, contact the abuse address listed in the registry record and include useful details such as the date, time, and relevant log lines.
A public lookup cannot tell you which individual customer was using an IP address at a specific moment. The provider that assigned the connection may hold subscriber records linking an address to an account at a particular time, but access to those records is generally restricted and may depend on applicable legal procedures.
IP lookups are most useful for identifying the network, organization, ASN, and registered address range behind a public IP. Treat precise location estimates cautiously and verify current ownership through live registry data.
You can usually identify the organization responsible for the address range, such as an ISP, hosting company, or business. A public lookup does not identify the individual person using the address.
Enter the address into an IP lookup tool or run a WHOIS or RDAP query. The organization or network information can identify the provider responsible for the range, while the ASN shows which autonomous system routes the address.
IP location databases rely partly on estimates. VPNs, proxies, mobile networks, hosting infrastructure, and reassigned ranges can all affect the result. Country-level information is generally more dependable than city-level information.
Public IP registry information is openly available for network administration, troubleshooting, and other legitimate uses. Laws and permitted uses vary by jurisdiction, so how the information is used still matters.