"Whose IP Is This? How to Trace a Public IP’s Owner and Location"

Ever checked your logs and thought:

"Who’s this IP that keeps connecting?"
"Is it a hacker? A VPN? A server in China?"

That moment of confusion always leads to the same question:
“Where is this IP address coming from?”

---

🌐 What Is a Public IP?

Addresses like 20x.0.113.x are public IPs — globally unique and traceable.
You can usually find out who owns it, which country or city it’s based in, and even which ISP it belongs to.

---

🔍 How to Look Up a Public IP

1. Use Online Tools (Easy & Fast)

Just copy the IP and paste it into any of these:

• ipinfo.io

• db-ip.com

• whois.domaintools.com

Example:
Input 8.8.8.8 and you'll see something like:
Google LLC
Mountain View, California, USA
ISP: Google

---

2. Use CLI Tools (PowerShell or Bash)

In your terminal or PowerShell, run:

curl ipinfo.io/8.8.8.8

You'll get JSON output with country, city, and organization info.

---

🧠 Practical Tips

• If the owner is Amazon, Google, Azure, it’s likely a cloud server.

• IPs from China, Russia, or Southeast Asia with high connection frequency?
  👉 Might be VPN, proxy, botnet, or brute force.

• You can even hook up GeoIP DB to automate suspicious IP logging.

---

🛡️ Why This Matters

• Company PC accessing strange external IPs?
  → Could be data exfiltration.

• Unknown IP shows up in your SOC logs?
  → Run a whois and block if needed.

---

🎯 TL;DR

An IP address is a trace.
And every trace can be followed.