IP Address Lookup

The Received headers in an email reveal the path it took. Look up the first non-local IP in the chain — that's usually the sending server.

• ASN tells you the carrier — AS15169 = Google = Gmail. AS8075 = Microsoft = Outlook. Mismatched ASN vs claimed sender is a phishing flag.
• Reverse DNS matters for mail. A sending IP with no PTR record, or one that resolves to a different domain than the From header, is suspicious.
• Residential IPs sending mail directly bypass spam filters — almost always abuse.

When suspicious traffic appears in your access logs, IP lookup is the first triage step.

• Datacenter / hosting ASN on an endpoint that expects human users (login, checkout) is a bot signal.
• Country mismatch with your customer base is a quick filter — but VPNs make this noisy.
• Bulk lookup the top 50 IPs from your logs and export to CSV for grep-able analysis.

Most commercial VPNs use datacenter IP ranges (AS9009 M247, AS46562 Total Server Solutions, AS20473 Choopa). If a customer IP's ASN matches a known VPN provider, that's a strong signal.

Tor exit nodes are a published, downloadable list — far more reliable to check against than IP heuristics.

Be careful with blanket VPN blocking: privacy-aware users, journalists, and corporate networks (which often route through VPNs by policy) are legitimate users.

Paste up to 50 IPs (comma, semicolon, or newline separated). Lookups run sequentially in your browser against ipwho.is — we keep the rate polite to avoid burning the free quota.

Export as CSV (ip, type, country, country_code, region, city, isp, asn, lat, lon, error). Pipe into pandas, Excel, or your SIEM.

For larger jobs (1000+ IPs), use a paid batch API (MaxMind GeoIP2 Precision, IPinfo Lite). The accuracy of free-tier providers degrades on edge cases.