ISP & Connection Type Lookup
Identify the provider behind an IP address and what kind of connection it is: residential, business, mobile or hosting, and static or dynamic.
Enter a public IP address to identify the provider and what kind of connection it is.
Confidence values are the data source's own estimate of how sure it is, from 0 to 100. A low city confidence with a high country confidence is normal and means exactly what it says.
Related tools
All Network tools →This tool queries an external service to answer your request. Only the value you enter — such as a domain or IP address — is sent. Your other data stays on your device.
This tool reads public records — DNS, WHOIS and certificate data that registries and servers publish openly. It sends nothing to the host you enter and changes nothing there. Use it on infrastructure you own or are authorised to look into.
About the ISP & Connection Type Lookup
Identify the provider behind an IP address and — the part that makes this different from a plain location lookup — what kind of connection it is. Residential broadband, a business line, a mobile network or a data centre; cable, DSL or cellular; an address that stays with one subscriber or one that is reassigned nightly.
That distinction answers a question location cannot. When you are looking at a log entry and wondering whether it is a person or a machine, the city is nearly irrelevant and the connection type is nearly the whole answer. Traffic from a hosting address that is behaving like a browsing human is a bot, a scraper or someone routing through a server they rented. Traffic from a residential address that is behaving like a data centre is more interesting still, and usually means a compromised machine or a residential proxy.
The static or dynamic field matters for a different reason: it tells you whether an address is worth remembering. Blocking a dynamic residential address achieves very little — it will belong to somebody else by next week, and you will have blocked them instead. Blocking a static hosting address is durable. The same reasoning applies to allow-listing, where putting a dynamic address on a permanent list is a support ticket waiting to happen.
This tool also shows confidence values, which most geolocation tools quietly hide. They are the data source's own estimate of how sure it is, from 0 to 100, and a city at 30 with a country at 99 is a completely normal answer that means exactly what it says: the country is near-certain and the city is a guess. Hiding that would present an estimate as a fact. Where the accuracy radius is given, it is the same honesty in kilometres — a 20 km radius is a circle, not a pin.
If you want a clean location summary instead, use our IP Address Lookup. For registration and abuse contacts, use IP WHOIS. For whether an address is anonymising traffic, use the VPN and Proxy Detector.
How to use the ISP & Connection Type Lookup
-
Enter the address
Type any public IPv4 or IPv6 address. A port or CIDR suffix from a log line or firewall rule is stripped for you.
-
Run the lookup
Complete the verification check and press Identify connection. The lookup is live rather than cached.
-
Read the connection section
User type tells you residential, business, mobile or hosting. That is the field that answers whether traffic is likely a person or a machine.
-
Check before you block
A dynamic residential address will belong to someone else shortly, so blocking it mostly punishes a stranger. A static hosting address is worth remembering.
Frequently asked questions
How is this different from your IP Address Lookup?
They answer different questions from different data. IP Address Lookup tells you where an address is and which network operates it — a clean summary of country, city, ASN, time zone and currency. This tool tells you what kind of connection it is: residential or business or hosting, cable or DSL or cellular, static or dynamic, and how many subscribers share it. If you want to know where an address is, use that one. If you want to know whether it is a person or a server, use this one.
What does "user type: hosting" actually tell me?
That the address belongs to a data centre rather than to a home or office connection. That is entirely normal for servers, APIs and CDNs, and it is worth noticing when the traffic is claiming to be a person browsing your site. It is not proof of anything by itself — people legitimately browse through VPNs hosted in data centres — but combined with behaviour it is one of the more informative signals available.
Why does it say my connection is dynamic when my IP never changes?
The score is a probability based on how addresses in that range behave in aggregate, not a statement about your specific line. Many ISPs issue technically dynamic addresses that in practice stay with the same subscriber for months because the lease keeps renewing. If your address has not changed in a year it is effectively static, whatever the score says — but it can still change after a long outage or a router replacement, which is why it is not classified as static.
What does a high user count mean?
Carrier-grade NAT: many subscribers sharing one public address, which is standard on mobile networks and increasingly common on fixed broadband as IPv4 addresses run out. It has two practical consequences. Geolocation for those addresses is poor, because the shared address sits wherever the carrier's equipment is. And blocking one blocks everybody behind it, which on a mobile carrier can be a large number of entirely uninvolved people.
Why do you show confidence values when other tools hide them?
Because hiding them turns an estimate into an apparent fact. A city with 30% confidence is a guess, and presenting it in the same style as a country with 99% confidence would be misleading in a way that matters — people make blocking and fraud decisions on this data. Showing the number lets you weigh it. The accuracy radius does the same job in kilometres: it describes a circle, not a point.
Do you keep a record of the addresses I look up?
No. The address goes to the lookup service and is not written to our database or our logs. We count that a lookup happened so we know the tool is used, with no record of which address, who asked, or what came back.