About
One request, one address, a city-level location and an honest list of limits.
What the page returns
The browser asks /api/ip and the server answers with four groups of fields:
| Group | Fields | Where it comes from |
|---|---|---|
| Address | IP, IPv4 or IPv6, private or public | The connection itself, read by the server |
| Location | Country, region, city, postal code, latitude, longitude, time zone | The IP database |
| Network | ISP, organisation, ASN, domain | The IP database's connection record |
| Interpretation | Residential, mobile, hosting or business; likely dynamic or unknown | Inferred from the ISP and organisation names |
The request path
- The page sends a same-origin GET /api/ip. No address is sent in the request body or query string.
- Nginx passes the request to the application and supplies the client address in X-Real-IP, after the edge proxy has resolved it.
- The application accepts the address only from that header, validates it with a strict IP parser, and rejects private or reserved ranges.
- For a public address, the server asks ipwho.is for the location and connection fields, with a four-second timeout.
- The result is cached in server memory for up to one hour and returned as JSON. The page renders it with text nodes only.
The main endpoint has no address input: it reports the connection that called it. On dual-stack networks the page also obtains the browser's IPv4 address from an IPv4-only echo service and sends it to a separate endpoint with a short-lived token, a same-site origin check and a daily per-client cap; that endpoint is not a general address lookup service.
How the connection type is inferred
The database does not publish a "residential" flag. The page looks for words in the ISP, organisation and domain fields:
| Signal | Examples | Label |
|---|---|---|
| Hosting and cloud names | Amazon, AWS, Google Cloud, Microsoft Azure, DigitalOcean, Hetzner, Cloudflare, a data-centre or hosting provider | Data centre / cloud |
| Residential access names | Broadband, fibre, cable, DSL, Comcast, Charter, Verizon, China Telecom, China Unicom | Residential broadband |
| Mobile access names | Mobile, cellular, wireless, LTE, 5G | Mobile network |
| Other named networks | A company, university or public institution | Business network |
| No usable name | An empty connection record | Unknown |
This is a keyword heuristic, not a registry lookup. A reseller of a residential line can appear as a business, a mobile carrier can also sell home broadband, and a public DNS resolver can sit on an ISP's range. The label is a hint about the kind of network, not a statement about the customer.
Why the fixed / non-fixed flag is cautious
No public database records whether an ISP assigned a static address to a particular line. The page therefore reports one of three states:
- Likely non-fixed for residential broadband and mobile networks, which commonly change addresses.
- Not a home connection for hosting and cloud networks.
- Unknown for business and unclassified networks.
None of these is proof. A residential customer can pay for a static IP; a business can use DHCP. The only definitive checks are the ISP's account record or watching the router's WAN address over several days.
Accuracy and blind spots
- City-level, not device-level. The coordinates are a centre point for a city or network, often tens of kilometres from the actual device. They are not GPS.
- Carrier-grade NAT. If the ISP shares one public address among many subscribers, the location is the carrier's, not the subscriber's.
- VPN and proxy. The address shown is the exit node. The location belongs to the VPN provider.
- Mobile and satellite. These networks route traffic through regional gateways, so the city can be far from the handset.
- IPv6. An IPv6 address is handled the same way; the database coverage is good but not uniform.
- Stale records. Address blocks are reassigned. A database can lag behind a transfer by weeks or months.
Rate limits and caching
The upstream free endpoint allows a limited number of requests per day from this server. The page reduces the load in three ways: it caches each address for one hour, it limits concurrent upstream requests, and it returns the IP alone with a notice if the service is busy or the daily allowance is exhausted. A reload normally hits the memory cache rather than the provider.
Why the page has no map
A marker on a map looks precise. The underlying data is a city centroid, so the marker would be a false promise. Coordinates are printed as text, with the accuracy limit stated next to them. A map would also require a third-party tile server, which would see the visitor's address and add a script to the page.
Corrections
If a network is mislabelled or a field is missing, the fix belongs in the classification table or the response mapping, not in a hand-edited page. The worked examples used to check a change are a Google address (data centre), a China Telecom address (residential), a private address (no lookup) and an address with an empty connection record (unknown).