IP Lookup Tool FreeFree Account Required
Forensic IP address lookup for OSINT and investigations. Look up geolocation, ISP, VPN/proxy/Tor detection, and generate court-ready digitally signed PDF reports.
What is My IP Address?
Your public IP address is shown below. This is the address websites and online services see when you connect.
Enter IP Addresses
Enter one or more IP addresses (IPv4 or IPv6).
Supports multiple formats: one per line, comma-separated, space-separated, or mixed. Upload any document (PDF, Word, Text, JSON, CSV, or Log) and we'll automatically extract all IP addresses from anywhere in the file - perfect for ISP reports, logs, API responses, and other documents with scattered IPs.
Ctrl+K or / to focus · Ctrl+Enter to look up
No IPs to Display
Enter IP addresses in the text area above or upload a file to get started.
How to Use This Tool for OSINT
Perform forensic IP lookups with network context, VPN/proxy detection, and court-ready reporting in four steps.
- 1
Enter One or More IP Addresses
Paste a single IP or a list of IPs separated by commas or newlines. The tool validates each address and shows a preview before processing. Supports both IPv4 and IPv6.
- 2
Review Network and Location Context
Each result shows the ISP, organization, approximate geographic region, network type, and whether VPN, proxy, or Tor infrastructure is detected. All data is time-stamped.
- 3
Generate a Court-Ready PDF Report
Click "Generate Report" to produce a professionally formatted, digitally signed PDF with all lookup data, timestamps, and methodology notes included.
- 4
Cross-Reference with Other Evidence
Use our guides below to understand limitations and corroborate IP evidence with other data sources for a complete investigation.
Understanding IP Address Evidence
IP evidence provides network-level context for investigations, but must be interpreted carefully with awareness of its limitations.
Network, Not Identity
IP addresses identify network connections, not individuals. A single IP may serve multiple users, and a single user may use multiple IPs over time.
Approximate Location
IP geolocation is derived from publicly available network routing and registration data, not GPS or device tracking. Results reflect ISP infrastructure and do not identify the physical location of a device or individual.
VPN & Proxy Detection
When VPN, proxy, or Tor infrastructure is detected, the observed IP reflects an intermediary network. Attribution to an individual is typically not possible.
Time-Bound Evidence
IP addresses can be reassigned by ISPs. Recording the exact time of a lookup is essential to preserve investigative context and evidentiary value.
Court-Ready Reports
Preserve IP lookup results in timestamped, digitally signed reports designed for investigative documentation, legal proceedings, and later review.
Corroborate Everything
IP evidence should always be cross-referenced with other data sources. Used alone, it provides context but rarely establishes definitive attribution.
Learn How to Interpret IP Evidence
Understanding IP data requires context. These guides explain how investigators use IP evidence responsibly.
Why IP Address Location Is Often Wrong
Understand why geolocation data can be misleading and how to account for inaccuracies.
Why IP Evidence Must Be Time-Bound
Learn why timestamps are critical when documenting IP address evidence.
What Makes a Report Court-Ready
Standards for IP lookup reports that meet legal and evidentiary requirements.
IPs Identify Networks, Not Individuals
Why an IP address cannot be used to identify a specific person.
Interpreting VPN, Proxy & Tor Evidence
How anonymization tools affect IP attribution and what investigators should know.
Frequently Asked Questions
No. An IP address identifies a network connection, not an individual. Multiple people may share the same IP address on a home or business network, and a single person may use different IPs across devices and locations.
IP geolocation is based on network routing and registration data, not GPS. The reported location may reflect the ISP's infrastructure or a regional routing hub rather than the actual device location. Accuracy varies by provider and network type.
When anonymization infrastructure is detected, the observed IP reflects an intermediary network rather than the originating device. In most cases, direct attribution to an individual is not possible. Investigators note these indicators to explain technical limitations in their reports.
IP addresses can be reassigned by ISPs over time. Recording the exact date and time of a lookup preserves the investigative context and ensures the evidence remains meaningful if referenced later.
Your public IP address is displayed at the top of this page. It is the address assigned to your connection by your internet service provider. This address may change if you reconnect or if your ISP uses dynamic addressing.
Yes. This tool is intended for lawful OSINT and investigative use. All lookups query publicly available network registration data. Users are responsible for ensuring their use complies with applicable laws and regulations.
Start Your OSINT Investigation
This free tool is brought to you by Forensic OSINT, the evidence-grade web capture platform for OSINT investigators. Take your workflow to the next level.
