How to geolocate an IP address
Maybe an app is quietly connecting somewhere and you want to know where. Maybe a log line has an unfamiliar IP in it. Geolocating an IP maps that address to an approximate real-world location and tells you which network owns it — so you can see roughly where a connection goes and who runs the far end. Here's how to do it accurately, and how to read the result without fooling yourself.
The short version
IP geolocation is approximate. Country is usually reliable; city is a best guess. If an IP belongs to a VPN, proxy, mobile carrier, or a cloud/CDN provider, the "location" you get back is the provider's, not a person's.
It's genuinely useful for understanding where your traffic goes and who owns the network — but it never pinpoints an individual's home address, and no honest tool claims it does.
How IP geolocation actually works.
An IP address has no built-in location. Geolocation works by looking the address up in a database that maps ranges of IPs to places. Those databases — the well-known MaxMind GeoIP data is the classic example — are assembled from several sources: the Regional Internet Registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC) publish which blocks are allocated to which organizations; ISPs and routing data reveal how those blocks are used and where they terminate; and providers add their own signals on top.
Because it's inference from registry and routing data rather than a GPS fix, the result is an estimate. Country is right the vast majority of the time for fixed broadband. City is far shakier — it can be off by a whole metro area, and for some networks it defaults to the middle of a region or country.
Several common situations make the "location" reflect the provider, not the user: VPNs and proxies resolve to the exit server's location; Tor shows the exit node; mobile carriers often route many subscribers through a handful of gateways (CGNAT), so the pin lands on the carrier's hub; and cloud and CDN IPs (Akamai, Cloudflare, AWS) resolve to a datacenter or an anycast edge, not to whoever set up the service. Keep that in mind before you read too much into a single pin on a map.
Ways to geolocate an IP.
Do it by hand with built-in tools and a lookup service, or let NetGlobe geolocate every connection for you as it happens.
Manually
-
Find the remote IP of a live connection with
netstat -anoon Windows orlsof -nP -ion macOS. - Look the IP up in a GeoIP database or service for an approximate country, region, and city.
- Run WHOIS/RDAP to see the RIR allocation and the ISP or hosting company that owns it.
Automatically, with NetGlobe
- Every outbound connection is already geolocated onto a live 2D map and 3D globe.
- It uses a bundled, local-first GeoIP database — no need to send each lookup to the cloud.
- Click any connection for the location plus WHOIS/RDAP owner, reverse DNS, and threat-intel context.
How to geolocate an IP, step by step
-
Identify the IP address
First, get the IP you actually want to locate. On Windows, open a terminal and run
netstat -anoto list every active connection with its remote IP; the-oflag adds the owning process ID so you can tie it back to an app. On macOS (or Linux) runlsof -nP -ito see the same connections with process names. Pick the remote address you're curious about. -
Look the IP up in a GeoIP database
Feed that IP to a MaxMind-style GeoIP database or a reputable IP-geolocation service. You'll get back an approximate country, region, and city, and usually the ASN (autonomous system number) the address belongs to, which is the first hint of who runs the network.
-
Confirm the owning network with WHOIS/RDAP
Query WHOIS — or the newer, structured RDAP — for the IP to see which Regional Internet Registry allocated the block and which ISP or hosting company owns it. This is the step that tells you whether you're looking at a home ISP, a mobile carrier, a VPN, or a datacenter, which completely changes how you read the location.
-
Interpret the result responsibly
Trust the country; treat the city as a best guess. If the owner is a VPN, proxy, or cloud/CDN provider (Cloudflare, Akamai, AWS), the pin is the provider's location, not a person's. Geolocation gets you the neighborhood of a network — never the doorstep of an individual.
Reading the result responsibly.
A geolocation result is a set of confidence levels, not a single fact. The country is reliable enough to act on. The city is a best-guess and should be treated as "somewhere in this region." A hosting or CDN IP shows the datacenter or edge node the service runs from, which may be nowhere near the company using it. And a VPN shows the VPN's location by design — that's the whole point of a VPN.
That's why the network owner matters as much as the coordinates. Knowing an IP resolves to "AWS us-east-1" or "a residential ISP in Lyon" tells you far more than a dot on a map ever will — and it keeps you honest about what the location does and doesn't prove.
IP geolocation — FAQ
How accurate is IP geolocation?
It's approximate. Country is usually reliable — well over 90% for fixed broadband — but city-level accuracy is a best guess and can be off by tens or hundreds of miles. Databases are built from registry allocations and network routing data, not GPS, so precision varies a lot by ISP and region.
Can you find someone's exact address from an IP?
No. IP geolocation is approximate and usually reflects the ISP or provider, not an individual. A residential IP typically resolves to a city or region, not a street address, and VPNs, proxies, mobile carriers, and cloud/CDN networks resolve to the provider's location instead. Only the ISP, with a legal request, can tie an IP to a subscriber.
How do I find the location of an IP my computer is connecting to?
Run netstat -ano on Windows or lsof -nP -i on macOS to find the remote IP of a live connection, then look that IP up in a GeoIP database and check WHOIS/RDAP for the owning network. NetGlobe does all of this for you: every outbound connection is already geolocated on a live map, with the owner and threat context one click away.
Does NetGlobe geolocate connections automatically?
Yes. NetGlobe geolocates every outbound connection automatically and plots it on a live 2D map and 3D globe, using a bundled local-first GeoIP database. Click any connection to see the approximate location plus the WHOIS/RDAP network owner, reverse DNS, and threat-intel context.
Does geolocation require sending data to the cloud?
Not with NetGlobe. It ships a local GeoIP database and resolves locations on your device, so it doesn't need to send each lookup to a cloud service. WHOIS/RDAP and optional threat-intel checks query public registries and feeds when you ask for them.
MaxMind and GeoIP are trademarks of MaxMind, Inc.; other names are the property of their respective owners. NetGlobe and Van Dien io are independent and not affiliated with them. IP geolocation is inherently approximate and is provided for informational and diagnostic purposes — it does not identify individuals.
Related guides
See where every connection actually goes.
NetGlobe geolocates every connection on a live map automatically — a one-time $18.99 on the Microsoft Store for Windows, or a direct download for Mac.
No account. Runs entirely on your device. See the full feature list or the FAQ.