IP Address Lookup: How to Look Up Any IP Address Online and Offline

An IP address lookup tells you who an IP address is registered to and roughly where it is used: the network owner, the regional internet registry, the country, often the ISP and an approximate city. You can run one online through an RDAP (whois) query or a geolocation service, or offline on Windows with NirSoft's free IPInfoOffline, which resolves addresses from a database stored on your PC.

This guide covers what an IP lookup can and cannot reveal, how to look up an IP address online, how to do it offline for log files and privacy, and how to get city and ISP data into an offline lookup.

What an IP address lookup shows

An IP address lookup returns registration data and estimated location data, which come from two different sources. Registration data comes from the five regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC) and is authoritative: who holds the address block, its start and end address, the CIDR block, the registration date and abuse contacts. Location data comes from geolocation databases that estimate where a block is used.

Typical fields you get back:

• IP range and CIDR block the address belongs to
• Network name and holder (company, ISP or hosting provider)
• Autonomous system number (ASN) that announces the block
• Country and country code
• Approximate region and city (geolocation only)
• Abuse contact for reporting spam or attacks (registry data)

Location is the weakest part of any result. MaxMind, which publishes the widely used GeoLite databases, describes city results as a circle with an accuracy radius from a few kilometers up to 1,000 kilometers, and states that some addresses resolve only to a country. Treat a city as a hint, never as an address.

How to look up an IP address online

The most reliable online IP lookup is an RDAP query, the structured alternative to the older text-based whois protocol, because it returns the registry's own record. ARIN's RDAP service refers queries for addresses held by other registries to the right one.

1. Open ARIN's RDAP search.
2. Enter the IP address (IPv4 or IPv6) and run the search.
3. Check the network name, start and end address, origin ASN and the entities listed with roles such as registrant and abuse.
4. Look at the source registry field to see whether ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC holds the record.

Scripts and command-line tools can query the same data as JSON at a URL in the form https://rdap.arin.net/registry/ip/ followed by the address, as documented on ARIN's RDAP page.

To see the host name behind an address, run a reverse DNS lookup on Windows: open Command Prompt and type nslookup followed by the IP address, for example nslookup 4.4.4.4. Microsoft's nslookup documentation confirms that an IP address returns the computer name when a PTR record exists. Host names often contain the ISP or hosting provider, which helps when registry data is generic.

For a location estimate, geolocation services do the job; MaxMind's free GeoLite web services require an account and allow 1,000 lookups per day per service.

Why look up IP addresses offline

An offline IP lookup resolves addresses from a local database, so nothing about the addresses you check leaves your computer. That matters in two situations.

• Log analysis: firewall logs, web server logs or router logs can hold hundreds of addresses. Pasting them into a local tool is faster than querying a website one by one, and it works on machines without internet access.
• Privacy and operational security: online lookup services see every address you submit. If you investigate an attack, a suspicious login or a client's server, an offline lookup leaves no trace with a third party.

The trade-off is depth. A local tool is only as good as its database, and it cannot show live registry records such as abuse contacts. If you want to harden the machine you analyze logs on, our guide to blocking entire folders in Windows Firewall shows how to keep chosen programs offline.

How to look up IP address information offline with IPInfoOffline

IPInfoOffline is a free, portable NirSoft utility for Windows 98 through Windows 11 that looks up IP addresses from a compressed database built into its executable. No installation and no server connection are needed.

1. Download IPInfoOffline from the NirSoft page, extract the ZIP file and run IPInfoOffline.exe.
2. Type or paste one or more IP addresses into the text field, for example a list copied from a log file.
3. Run the lookup. Each address appears in its own row.
4. Read the columns: IP block range, Organization, Assigned Date, Country Name and Country Code, plus Index, CIDR and Duplicate Count in current versions.
5. Select rows and save them as text, tab-delimited, CSV, HTML or XML, or copy them to the clipboard.

One detail trips up many users: the Organization column shows the regional registry that assigned the block (RIPE, ARIN, APNIC, LACNIC or AFRINIC), not the ISP or company using it. For ISP or company names, add an external database as described below.

IPInfoOffline also works from the command line. /iplist loads addresses, switches such as /scomma or /shtml save results directly to a file, and /AddCountry adds country names to the IP addresses in a text file, for example tracert output.

How to add city and ISP data to an offline IP lookup

IPInfoOffline can read external databases that add city, ASN and company name data, which turns it into a near complete offline IP location lookup. Version 1.70 supports CSV files from the open ip-location-db project for country, city and ASN data on IPv4 and IPv6. Version 1.50 and later also read MaxMind's GeoLite2 City and ASN CSV files.

1. Pick a database: ip-location-db offers DB-IP Lite (city, updated monthly, CC BY 4.0, which requires credit to DB-IP) and its own country and ASN sets built from registry, BGP routing and geofeed data (updated daily, public domain dedication). GeoLite2 requires a free MaxMind account and license key.
2. Download the CSV version of the database.
3. Place the files in the IPInfoOffline folder and keep their original file names, which is how the program finds them.
4. Start IPInfoOffline and run your lookup again; the extra columns fill in.

NirSoft notes that loading the GeoLite2 City files is slow, so expect a pause on first use. Licenses differ: GeoLite2 is governed by MaxMind's end user license agreement, which requires deleting old copies within 30 days of a new release, and MaxMind states that its location data should not be used to identify a particular address or household. Refresh whichever database you use regularly, because address blocks change hands and location estimates drift.

Online vs offline IP lookup methods compared

Online RDAP gives the most authoritative ownership data, while offline tools win on speed for bulk lists and on privacy.

For a single suspicious address, start with RDAP and reverse DNS. For a log with hundreds of entries, run IPInfoOffline first, then check the few addresses that matter online.

FAQ

Related: display all cached DNS entries on Windows, check whether your browser uses secure DNS, enable DNS over HTTPS in your browser