About this tool
Five independent sources for one address, queried at the same time so a slow one never holds up the rest. MaxMind supplies the city, country, coordinates and time zone — always with the accuracy radius beside them, because a latitude and longitude on their own imply a precision that IP geolocation does not have. The same record carries the ISP, the organisation, the connection type, and whether the address is anycast — announced from many places at once, in which case no single location exists and the tool says so instead of inventing one. What it deliberately does not claim is VPN, Tor or proxy detection: those signals come only from MaxMind's pricier Insights service, and the site uses the City service, so a "not a VPN" verdict here would be unfounded.
The routing view comes from Team Cymru, who publish the global BGP table over DNS: the AS actually announcing the address, the covering prefix, the registry and the allocation date — and a warning when more than one AS announces the same prefix, which is either deliberate multi-homing or a route leak. Reverse DNS is forward-confirmed, so a PTR record that does not resolve back to the address is shown as unconfirmed rather than presented as fact; mail servers reject on exactly that check. RDAP supplies the registry allocation and the abuse contact.
Addresses that are not globally routable skip the network lookups entirely. There is nothing for a public database to say about 192.168.1.1, and five empty panels would say it five times. Instead the address is classified against the IANA special-purpose registry — private, carrier-grade NAT, link-local, documentation, benchmarking, multicast and the rest, each with the RFC that defines it — and 169.254.169.254 is called out by name as the cloud metadata endpoint that SSRF attacks target. The alternate representations (decimal, hexadecimal, octal, binary, IPv4-mapped IPv6 and the reverse-DNS name) are computed in the tab and never sent anywhere.