---
title: "What Your IP Address Reveals: Location, ISP, IP Type and Reputation"
description: "What does your IP address reveal? A field-by-field look at location accuracy, ISP lookups via RDAP, IP type and reputation, plus a router port and UPnP check."
url: https://cdnping.org/en/blog/what-your-ip-address-reveals
language: en
published: 2026-10-21
category: "IP & privacy"
tags: ["IP address","privacy","IP geolocation","RDAP","IP reputation"]
source: cdnping.org
license: Free to quote and summarize with a link to the url above.
---
# What Your IP Address Reveals: Location, ISP, IP Type and Reputation

What does your IP address reveal? In short: roughly which city you are in (often only the province or country, and different databases disagree), which ISP or organization the address belongs to, whether it is a home broadband, mobile or data center address, and whether it has ever been put on a blocklist. It does not directly expose your name, phone number or street address. Only your ISP can map an address to those, and normally only when legally compelled.

Below, we go through the fields of an exit IP check one by one: where each comes from, how far to trust it, and how you can verify it yourself. The demonstrations use cdnping's [IP and environment check](/en/ip), so you can open your own result and compare as you read. Example IPs come from the documentation range 203.0.113.0/24 and do not belong to any real user.

## Which IP can a website see?

When you visit a website, it sees your exit IP: the address your traffic uses when it leaves your local network and enters the public internet. At home this is usually the public address held by your modem or router. On mobile data it is the address of the carrier's gateway. If you use a proxy or VPN, it is the proxy server's address.

Two things are easy to overlook:

- One computer can have both an IPv4 and an IPv6 exit. Which one a site sees depends on whether the site supports IPv6. If the two exits do not match, see [troubleshooting mismatched IPv4 and IPv6 exits on dual-stack networks](/en/blog/ipv6-dual-stack-proxy-mismatch).
- Browser WebRTC and system DNS queries can bypass a proxy and send out a different address. The mechanics of both leaks are covered in [DNS leaks and WebRTC leaks](/en/learn/dns-leak-webrtc-leak), and the fix is in [how to turn off WebRTC leaks](/en/blog/fix-webrtc-leak-chrome-firefox-safari).

Websites in mainland China can also see the address that "did not go through your proxy" via their own CDN nodes. This is exactly what the mainland split-routing check relies on; see [how Chinese websites see your real IP](/en/blog/how-chinese-sites-see-your-real-ip).

## How accurate is IP geolocation, and why only city level?

An IP carries no coordinates. "IP geolocation" is a lookup table that database vendors build to map address ranges to places. Sources include the registration data for the range, information published by ISPs, network latency measurements and data submitted by users. Accuracy is limited by nature:

- ISPs often allocate a large range to a whole province for scheduling, so the database can only label it with the provincial capital or some aggregation city.
- Ranges get transferred and reassigned, and databases lag behind.
- Mobile network exit gateways are usually concentrated in a few cities, so a phone roaming elsewhere may show a location far from where the person actually is.

For this reason cdnping does not rely on a single database. It has 11 geolocation databases each return a result, takes a vote, and shows a confidence level. Here is how to read the result:

| What you see | What it means |
|---|---|
| Most databases agree on one city, high confidence | The range's ownership is fairly clear; city level is broadly trustworthy |
| Country agrees, cities scattered | You can only be sure of the country or province; do not trust the city |
| Countries disagree | Common with recently transferred ranges or cross-border networks; judge by registration data |

Suppose you check 203.0.113.5 and the databases split between two different cities, with one more placing it in a neighboring country. That is a mix of the second and third cases. [Why 11 IP databases give different locations](/en/blog/ip-geolocation-databases-differ) breaks down the reasons one by one.

The takeaway: IP geolocation tells you roughly which area someone is online from. It cannot reach a street or a door number. Any claim of pinpointing a home from an IP alone is either exaggerated or uses data beyond the IP.

## Can it tell which ISP I use?

Yes, and this part is more reliable than geolocation. Every public address range is registered with a holder at a Regional Internet Registry (APNIC for the Asia-Pacific region). There are two protocols for querying registration data: the older WHOIS returns plain text, and its successor RDAP returns structured JSON with more regular fields that programs can parse easily.

cdnping's check shows the network range, holder organization and autonomous system number (ASN) found via RDAP. You can also query it yourself in a terminal:

```bash
# Traditional WHOIS lookup; look at the netname, descr and country fields
whois 203.0.113.5

# Find the ASN of the exit IP (via Team Cymru's public DNS service)
dig +short 5.113.0.203.origin.asn.cymru.com TXT
```

What you typically see is an organization name at the level of "a provincial telecom branch", "a cloud provider" or "a university". For a home broadband user this reveals little, because an ISP's ranges are shared by many customers. On a corporate network, though, the holder may well be the company's own name.

## How do sites tell home, mobile and data center IPs apart?

cdnping classifies IP type into four categories: data center, home broadband, mobile and Tor. These judgments are usually based on the ASN and the attributes of the range, for example:

- ASNs belonging to cloud and hosting providers are generally classified as data center;
- fixed-line ranges of broadband ISPs are classified as home broadband;
- ranges of carriers' mobile networks are classified as mobile;
- addresses that appear in the public list of Tor exit nodes are classified as Tor.

Many sites adjust their policies accordingly, for example showing an extra CAPTCHA for data center IPs. The criteria and the cases where they misjudge are covered in [data center IP vs. residential IP](/en/blog/datacenter-ip-vs-residential-ip). A related field is "native IP / broadcast IP", which asks whether the registered location and the actual place of use match; the concept is explained in [native IP vs. broadcast IP](/en/learn/native-ip-vs-broadcast-ip).

## What does "IP purity" measure?

Purity answers one question: has this address been used for abuse in the past? cdnping aggregates 14 reputation sources, including ip-api, proxycheck, IP2Location, StopForumSpam, the Tor exit list, a hosting ASN list, and DNS blocklists such as DroneBL, SpamCop, Mailspike, Barracuda, UCEPROTECT, s5h and dan.me.uk. The weight of every hit is shown openly.

Two points matter for ordinary users:

1. A blocklist hit does not necessarily mean you did anything. Home and mobile networks make heavy use of shared addresses or CGNAT (carrier-grade NAT), so records left by a previous user can land on you. See [do shared IPs and CGNAT affect IP reputation](/en/blog/shared-ip-cgnat-reputation).
2. The sources use different criteria, so disagreement between them is normal. The scoring method and the cases where it misjudges are covered separately in [how the IP purity score is calculated](/en/blog/ip-purity-score-explained), so we will not repeat them here.

## What does an IP not reveal?

Stating the boundaries clearly is more useful than dramatizing the risk. From an IP alone, an outsider cannot get:

- your name, national ID number or phone number;
- your address down to the compound, building or door number;
- your accounts on other websites;
- what you browse (HTTPS traffic is not visible to nodes along the path; what they can see is which domain you connected to).

What links an IP to a specific customer is the ISP's dial-up and address assignment records, and those are generally released only through legal process.

Websites usually do not identify you by IP alone. Cookies, login state and browser fingerprint (time zone, language, fonts, hardware traits) combined are far more stable than an IP. If your IP changes but your fingerprint does not, a site can still link the two visits. See [what a browser fingerprint is](/en/blog/browser-fingerprint-explained-self-check) for more.

## What are the real dangers of an exposed IP?

The risks that are real and need action fall into two groups.

The first is open ports being scanned. Public addresses are probed continuously by scanners. If you set up port forwarding on your router, or a device opened ports automatically through UPnP, services such as a NAS, cameras or remote desktop are exposed directly to the internet, and devices with weak passwords or missing patches are easy to exploit. This has nothing to do with whether your IP is "known to others", because scanners sweep every address anyway.

The second is location information being used as material for social engineering. For example, someone mentions the city you are in during a chat or in an email to make a phishing pitch more believable. The defense is knowing how far IP geolocation goes: city-level information is available to anyone, so it is no evidence that the other party really knows you.

As for "knowing an IP lets someone break into your computer", that essentially does not hold when no services are exposed and the system is updated normally.

## Self-check list: from exit IP to router ports

Work through these in order; each step has a clear pass/fail criterion:

1. Look at your exit. Open [/ip](/en/ip) and note your IPv4 and IPv6 exits, IP type, geolocation database vote and confidence. If the IPv4 and IPv6 exits belong to different countries, one stream of traffic is not taking the path you expect.
2. Verify the registration data. Run the `whois` or `dig` command above and confirm the holder is your ISP or proxy provider.
3. Check for leaks. On the same page, look at the DNS leak and WebRTC leak results. If an unexpected address shows up, follow the articles linked earlier.
4. Log in to your router's admin page and check port forwarding. Confirm the device and purpose behind each rule, and delete any you do not recognize or no longer use.
5. Turn off UPnP if you do not need it. Router UPnP (sometimes labeled "UPnP/NAT-PMP") lets devices on the LAN open ports by themselves. If you have no need such as game console online play, turn it off; if you do need it, at least review which mappings it currently has open on a regular basis.
6. Check remote management. Make sure the router's "remote web management" and "WAN-side management" are off, and that the admin password is not the default.
7. Confirm ports from outside. From a work network or a phone hotspot, scan your own public IP with `nmap`, for example `nmap -Pn 203.0.113.5` (substitute your own address). Only scan addresses you own; scanning other people's devices may violate laws and terms of service.

If you also need to troubleshoot network problems when calling AI APIs, the [developer network self-check list (2026 edition)](/en/blog/developer-network-self-check-2026) lays out exit IP, DNS and latency testing as a sequence of checks. To measure connection latency to each AI API provider, use the [online speed test](/en) on the home page, which runs in your browser.

After changing networks or devices, run the check at [/ip](/en/ip) again and compare the two results side by side: exit IP, IP type and geolocation vote.