Run your own address through /ip-lookup to see exactly what any stranger would see.
What a public lookup returns
Anyone can paste an address into a lookup tool. These are the fields they get, and where each comes from.
| Field | Source | Accuracy |
|---|---|---|
| Country | Registry allocation records | 99.8% by MaxMind’s own estimate |
| Region or state | Commercial geolocation database | Around 80% for US addresses |
| City | Commercial geolocation database | 66% within a 50 km radius |
| Postal code | Inference from the city entry | Weak. Frequently the city centre default |
| Latitude and longitude | The centroid of the guessed area | Not a position. A representative point |
| ISP and ASN | WHOIS or RDAP, and the BGP table | High |
| Reverse DNS | The PTR record the ISP publishes | Often names the exchange or region |
| Connection type | Heuristics over ASN and prefix | Good for hosting and mobile |
Nothing in that list comes from your device. It is all attached to the address block, published by registries and routing tables, and the same for every subscriber in the block.
Why the coordinates look precise and are not
A lookup returns something like 51.5074, -0.1278 with four decimals, which reads as a rooftop. It is the centre of whatever area the vendor assigned to the block. MaxMind, one of the main database vendors, ships an accuracy radius alongside every coordinate for that reason, and its geolocation accuracy page gives an example returning coordinates with a 100 kilometre radius. A coordinate without its radius invites exactly this misreading.
Where the entries come from: address registrations that ISPs file with the registries, latency measurements between known reference points, geofeeds that ISPs voluntarily publish under RFC 8805, and observed locations from apps that report both a position and an address. None of it is a survey of where you sit.
There is a well-known consequence. In 2016 a farm in Kansas received years of harassment because one vendor used the geographic centre of the United States as the default coordinate for any address it could not place, and hundreds of millions of addresses resolved to that property. The failure was in the default, not in the addresses.
The line between an address and a person
Two records exist, and they sit in different places.
Public: the address belongs to an ISP, that ISP operates in a country, and the block is used in roughly a region. Anyone can read this.
Private: at 20:14 on a given date, the address was leased to account number 4471. Only the ISP holds this, and only for as long as retention rules require, which varies by country from weeks to a couple of years.
Crossing from the first to the second needs legal process: a warrant, a court order, or the disclosure regime your jurisdiction defines. A private individual cannot buy it, and services that claim to sell it are selling database guesses with a confident interface.
IP addresses are personal data under GDPR, which is the same conclusion from the other direction. Recital 30 treats online identifiers as personal data, and the Court of Justice confirmed it for dynamic addresses in Breyer (C-582/14) precisely because a legal route to the subscriber exists.
What changes the picture
Some connections give away more than others.
- A fixed line at home is the most stable case: right country, usually right region, city correct often enough to be useful for a weather site.
- Mobile data is the least precise. Carriers aggregate large regions through a small number of gateways, so a phone in a small town commonly reports a city a hundred kilometres away.
- A corporate VPN or iCloud Private Relay places you at the egress point, which may be another country.
- Business and hosting ranges often carry accurate registered addresses, because the organisation filed them.
If you use social platforms, a messaging service, or an online game, they hold far more precise location data than any IP lookup, taken from device permissions and from your own posts. An IP address is rarely the weakest link.
What an IP address does not enable
Knowing an address is not access. Reaching a device needs a service listening on an open port with an exploitable flaw. A typical home router accepts no inbound connections at all unless someone configured a port forward, and port forwarding is a deliberate act.
The realistic risks tied to an address are a denial-of-service flood against your connection, which your ISP can mitigate and which is disruptive rather than revealing, and a rough geographic guess used to make a social-engineering message sound convincing. Neither is helped by hiding the address from ordinary websites.
If you want fewer sites to see it anyway
Route your traffic through something else. A VPN, Tor, or a different network substitutes a different address, and how to hide your IP covers what each one does and does not cover. Verify the result rather than trusting a badge: check IPv4, IPv6, DNS, and WebRTC together on /vpn-check.
If a site places you in the wrong city and you would like it corrected, that is a database entry rather than a leak. Why a site thinks you are somewhere else lists the vendors and their correction forms.
Questions people ask
- Can someone find my exact address from my IP?
- No. Commercial databases resolve to a city or a postal district at best, and that entry is an inference rather than a record of where you live. The subscriber address exists only in your ISP's billing system.
- How accurate is IP geolocation?
- MaxMind estimates 99.8% at country level, around 80% at state level for US addresses, and 66% for cities within a 50 kilometre radius. Mobile connections do far worse, because carriers route large regions through a few gateways.
- Can police find me from my IP address?
- Law enforcement can compel your ISP to disclose which account held an address at a given time, using a warrant, a court order, or the equivalent in your jurisdiction. That is the route from an address to a person, and it is not open to the public.
- Someone said they have my IP. Should I worry?
- Not on its own. Every server you connect to receives it, and it is required for the connection to work. It gives no access to your devices, and a home router accepts no inbound connections unless you configured a port forward.
Related
Last reviewed 2026-09-04. Reviewed quarterly, or sooner when a vendor changes something.