1 Introduction
An IP address is like a postal address for your computer. Just as the postal service needs a street address to deliver a letter, the internet needs an IP address to route data to the right device. Every computer, phone, server, and smart device connected to the internet has at least one IP address. Without them, no communication would be possible online.
4.3 B
Total IPv4 addresses available
2128
Total IPv6 addresses available
2 types
Public (internet) and Private (local network)
2 How It Works
Use the IP checker below to look up information about any IP address. You can see where an IP is geographically located, which organization owns it, and whether it has a suspicious reputation.
IPv4 vs IPv6
IPv4
The original format, written as four groups of numbers separated by dots.
192.168.1.1
32 bits = about 4.3 billion possible addresses
IPv6
The newer format, designed to solve the IPv4 shortage. Uses hexadecimal notation.
2001:0db8:85a3::8a2e:0370:7334
128 bits = virtually unlimited addresses
3 Detailed Analysis
Public vs Private addresses
Think of it like a building. Your public IP is the street address of the building -- visible to anyone on the internet. Your private IP is your apartment number -- only visible within the local network. A router acts as the concierge, translating between the two using NAT (Network Address Translation).
Private IP ranges (RFC 1918)
10.0.0.0/8 —
172.16.0.0/12 —
192.168.0.0/16
Special addresses
127.0.0.1 (localhost -- your own machine) —
0.0.0.0 (all interfaces)
What an IP address reveals
An IP address is not anonymous. From a public IP, analysts can determine:
Geolocation
Approximate country, city, and region. Not precise enough for a street address, but enough to identify a general area.
ISP and organization
Which internet provider or company owns the IP block. Useful to identify hosting providers or corporate networks.
Try it on mlab.sh
Look up any IP address to see its geolocation, ISP, ASN, and reputation data. Put what you just learned into practice by investigating real IP addresses.
Scan an IP on mlab.sh4 Red Flags
IP from an unexpected country
If a connection to your server comes from a country where you have no users or customers, this deserves investigation.
IP associated with a VPN or Tor exit node
Attackers often hide behind VPNs or Tor. A connection from a known anonymizer warrants extra scrutiny.
IP on a blacklist
Reputation databases track IPs involved in spam, brute force attacks, or malware distribution. A blacklisted IP is a strong indicator of malicious activity.
Many connections from a single IP
A sudden burst of connections from one IP address could indicate a brute force attack, credential stuffing, or a denial-of-service attempt.
IP hosted on a cloud provider
Attackers frequently rent cheap cloud servers for their operations. A connection from AWS, DigitalOcean, or similar providers may be automated and malicious.
Related Modules
Reading an IP reputation
Assessing the danger of an IP address using reputation databases and threat intelligence.
Understanding ASN and geolocation
Identifying who hosts an IP and where it comes from using autonomous system numbers.
What is DNS?
The Internet's phone book: how DNS translates domain names into IP addresses.
Source: mlab Academy — Cybersecurity Awareness Platform
URL: https://academy.mlab.sh//page/ip-address
Module: What is an IP address? — Fundamentals
Disclaimer: This content is for awareness purposes only.