What Your IP Address Actually Reveals
What someone can and cannot learn from your IP address, why geolocation is so often wrong, and how to tell whether you are behind carrier-grade NAT.
"They have my IP address" sits somewhere between a genuine privacy concern and an internet myth, and the gap between the two is worth understanding — because the answer changes what you should actually worry about.
An IP address is a routing label. It has to be visible to every server you connect to, or replies could not find their way back. What matters is how much can be inferred from it, and the honest answer is: more than nothing, considerably less than people assume.
See what yours exposes
The IP lookup shows your public address, the network that owns it, and what geolocation databases claim about it — the same view any website gets.
What can be learned
Your ISP, reliably
Every address block is registered to an organisation, and that registration is public. A lookup returns the ISP or hosting provider and its autonomous system number — the identifier used to route traffic between networks. This part is accurate, because routing depends on it being accurate.
It also reveals the kind of connection: residential broadband, mobile carrier, corporate, or datacenter. Sites use this constantly. Datacenter and shared addresses are treated with more suspicion than residential ones, because they are where VPNs, proxies, automated traffic and large numbers of pooled users tend to appear — which makes CAPTCHAs and access restrictions more likely. That is a statistical bet about the address, not a judgement about you. The AS lookup shows the network, and our guide to autonomous systems explains what the numbers mean.
Your approximate location, unreliably
This is where expectations and reality diverge most.
Geolocation is not a property of an IP address. It is a guess, sold by commercial databases that infer location from registration records, latency measurements, and user-submitted corrections. There is no lookup that returns where you physically are.
In practice accuracy varies enormously:
| Connection type | Typical accuracy |
|---|---|
| Fixed residential broadband | City, often correct |
| Business / corporate | Registered office, which may be a different city |
| Mobile | The carrier's gateway — potentially hundreds of km away |
| VPN / hosting | The datacenter, not the user |
| Satellite | Frequently the wrong region entirely |
If a site has ever insisted you are in a city you have never visited, this is why. It is also why "IP location" results should never be treated as fact — including the one our own tool displays, which reports what the databases claim rather than where you are.
It also explains a result people often find baffling: two lookup sites can report different cities for the same address, because they license different databases with different inference methods. Neither is authoritative. Disagreement between them is a reasonable signal that the estimate is weak.
A hostname, sometimes
Many addresses have a reverse DNS entry, which often encodes the ISP, the connection type and a regional identifier — something like cpe-24-4-31-50.socal.res.example.net. It is set by the network operator and can be more specific about region than the geolocation guess. But it is assigned by whoever owns the address, is not verified by anyone, and often goes stale after equipment moves — so treat it as a clue rather than proof of where you are. The reverse DNS tool shows yours.
What cannot be learned
Being equally clear about the other direction.
Not your name or address. That mapping exists only inside your ISP's subscriber records, and reaching it requires legal process. A website looking up your IP does not get it.
Not your browsing history. Your IP does not carry a record of where you have been. Your ISP knows because they carried the traffic — that is a different exposure, and the one a VPN and clean DNS actually address.
Not direct access to your machine. An address on its own is not a way in. A typical home router drops unsolicited inbound connections, and behind CGNAT there is nothing to forward to, so "someone has my IP so they can get into my computer" does not follow. It is not an absolute guarantee either: a deliberately forwarded port, a UPnP mapping opened by an application, an exposed router admin interface, or an unpatched vulnerability in something reachable all create exceptions. The address is what makes those findable, not what makes them vulnerable.
Not a stable identity. Most residential addresses are dynamic and change periodically. Mobile addresses can change within a single session.
The practical exposure from an IP address alone is: which ISP you use, roughly where, and what kind of connection it is. That is meaningful for fingerprinting in combination with other signals, and thin on its own.
Your IP and your DNS answer different questions
These two get conflated constantly, and they expose unrelated things:
| Your IP address exposes | A DNS leak exposes |
|---|---|
| Which ISP or network you use | Which domains you looked up |
| Its ASN and connection type | When you looked them up |
| A rough, often wrong location | Which resolver answered |
An IP says where you connect from. DNS says what you were looking for. A VPN with leaking DNS hides the first and not the second, which is why checking both matters.
Are you behind CGNAT?
This is the part with real day-to-day consequences, and most people affected by it have no idea.
IPv4 addresses ran out. Rather than assign one per customer, many ISPs — especially mobile networks and newer fixed providers — put multiple subscribers behind a single public address using carrier-grade NAT. You get an address from a shared range; the ISP translates it on the way out.
How to check
Compare two numbers.
- Your router's WAN address, in its admin interface — sometimes labelled "Internet IP" or "WAN IP".
- Your public address from the IP lookup.
If they match, you have a normal public IP.
If they differ, and the router shows an address in one of these ranges, you are behind CGNAT:
100.64.0.0/10 100.64.0.0 – 100.127.255.255 ← the CGNAT range (RFC 6598)That range exists specifically for this purpose. Seeing it on your WAN interface is close to conclusive.
Reading the two numbers together:
| Router WAN address | Compared with public IP | What it means |
|---|---|---|
| A public address | Identical | Normal public IPv4. Port forwarding works. |
100.64.x.x – 100.127.x.x | Different | CGNAT. Port forwarding cannot work. |
192.168.x.x | Different | Double NAT — a second router in the path, often your own. |
10.x.x.x | Different | Double NAT, or a private upstream network. |
172.16–31.x.x | Different | Double NAT, or private upstream addressing. |
Double NAT is usually your own doing and usually fixable — putting the upstream device in bridge mode collapses the two layers into one, though check what else that box is providing first, since bridging can disable ISP-supplied TV, VoIP or managed Wi-Fi. CGNAT is the ISP's and is not fixable from inside your network.
One false positive to know about: 100.64.x.x addresses also appear on some VPN and mesh products, which allocate from the same range for their own tunnels. If you are running one, that is what you are looking at rather than carrier NAT.
What CGNAT actually breaks
- Port forwarding does not work. There is no public port to forward. This is the big one.
- Self-hosting and remote access break. A home VPN back to your own network, a NAS you reach while travelling, camera systems, a game server for friends, remote desktop — anything expecting an unsolicited inbound connection needs a relay or tunnel service instead.
- Some games report a strict or moderate NAT type, which affects matchmaking and voice.
- Peer-to-peer connections fall back to relays, adding latency — including for video calls, which is why this shows up in call quality diagnosis.
- Shared reputation. You inherit the behaviour of everyone else on that address, which is a common cause of unexplained CAPTCHAs and blocks.
What you can do
Ask your ISP for a public IPv4 address. Many will provide one on request, sometimes free, sometimes as a small monthly charge. This is the cleanest fix and worth asking about before anything else.
Use IPv6 if you have it. IPv6 has no address shortage, so ISPs have no reason to share addresses the way CGNAT does and every device can hold a globally unique one. That removes the addressing obstacle, not every obstacle: inbound IPv6 is still gated by your router's firewall, which usually blocks it by default, and both ends have to support IPv6 at all. A global address is reachable only once you have also allowed it through.
Use a tunnel or relay for the specific service you need to expose. Adds a hop, but works regardless of what the ISP does.
How to read an IP lookup result
Running the IP lookup, the fields worth attention:
- IP address — what every site you visit sees.
- ISP / organisation — reliable.
- ASN — reliable; useful when reporting a routing problem, since it identifies the network precisely.
- Location — a database guess. Treat accordingly.
- Reverse DNS — often more informative about region than the location guess.
- IPv4 vs IPv6 — if you see an IPv6 address, you have IPv6 connectivity, which matters for CGNAT and for DNS leaks.
If you use a VPN, run the lookup connected and disconnected and compare. Read more than one field: the public address, the ISP or organisation, and the ASN should all change, and your DNS resolvers should too. Seeing your home ISP still named while connected is a strong sign the tunnel is not carrying that traffic — though split tunnelling can produce the same result deliberately, which is why the combination of fields tells you more than any single one. The VPN check evaluates several signals together for this reason.
Frequently asked questions
What can someone do with my IP address?
Look up your ISP, your autonomous system, and a rough guess at your region. They cannot obtain your name or street address without legal process through your ISP. An IP alone also does not grant access to your devices, because home routers drop unsolicited inbound connections — though a forwarded port, a UPnP mapping or an exposed service is a real exception, so this is a strong default rather than a guarantee.
Why does my IP location show the wrong city?
Because it is an estimate from a commercial database, not a property of the address. Mobile connections are the worst case, since they geolocate to the carrier's gateway, which can be hundreds of kilometres from you. Business and satellite connections are frequently wrong too.
How do I know if I am behind CGNAT?
Compare your router's WAN address with your public address. If they differ and the router shows something in 100.64.0.0/10, you are behind carrier-grade NAT. Addresses in 10.x or 192.168.x on the WAN side usually indicate double NAT from a second router instead.
Can I get a public IP address if my ISP uses CGNAT?
Often yes — many ISPs will assign one on request, free or for a small charge. It is worth asking before resorting to tunnels. IPv6, where available, removes the reason CGNAT exists — there is no address shortage to work around, so nothing is shared. Reaching a device still means allowing it through your router's firewall, which blocks inbound by default.
Does hiding my IP make me anonymous?
No. It removes one identifier. Browser fingerprinting, cookies, and account logins identify you independently of your address, and a VPN with leaking DNS still exposes the domains you visit.
Can someone hack me with my IP address?
Not by knowing it alone. An IP address is a routing label, not a credential — it tells someone where to send packets, not how to get in. What actually determines risk is whether anything reachable is listening: a forwarded port, a UPnP mapping an application opened, an exposed router admin page, or an unpatched service. Behind CGNAT there is typically nothing forwarded at all. Knowing the address makes those things findable; it does not create them.
Is a dynamic IP more private than a static one?
Marginally. A changing address makes long-term correlation slightly harder, but it changes infrequently enough that it is a weak protection, and other tracking methods do not depend on it at all.
Why do I keep getting CAPTCHAs?
Frequently a shared-address problem. Behind CGNAT you inherit the reputation of everyone else on that IP, so one bad actor affects everybody. Datacenter and VPN addresses attract the same treatment because they correlate with automation.
More guides
Why Your VPN Slows Everything Down
Encryption is rarely the reason a VPN is slow on modern hardware. Distance, a busy exit server and MTU are — and MTU is the one that makes some sites hang forever while everything else works.
Is Your VPN Actually Working?
A changed IP address is the weakest possible evidence that a VPN is doing its job. What to check instead, and the four ways a connected VPN still exposes you.
Is Your ISP Throttling You, or Is It Just Busy?
Throttling and congestion feel identical and need completely different responses. Here is how to tell them apart with evidence, and what to do once you know.
NAT Types, Double NAT, and Why Port Forwarding Sometimes Cannot Work
What your console means by strict NAT, how to tell double NAT from carrier NAT, and why port forwarding is impossible on some connections no matter what you configure.