Look up an IP.
Location, network
and risk, instantly.

It happens the moment you open the site: the "Your network check" card shows your public IP, country and city, ISP and ASN, IP version and TLS version. When the site runs with edge functions these values are read straight from your connection without any third-party API; on a purely static deployment it falls back to public geodata and labels the current source honestly in the corner of the card.

Yes, the input accepts both. Type example.com, https://example.com/path or even an internationalised domain: the parser strips the scheme, path and port, converts IDNs to punycode, then queries A and AAAA over DNS-over-HTTPS against public resolvers before running the location, ASN and risk analysis. A domain often resolves to several addresses (CDNs especially) — the resolution box lists every address with TTL and the CNAME chain, and clicking one switches the analysis target. Resolution happens in your browser and never touches this site's servers.

The IP-to-location mapping comes from address blocks registered by network operators plus network measurement data, aggregated by public geodatabases. This site tries several sources in order, moving to the next on a timeout or rate limit, and tells you which one answered. Country level is reliable, city level is an approximation — datacenter egress, mobile networks and shared egress are typically off by tens to hundreds of kilometres, and some sources even return a country that contradicts their own coordinates, in which case trust the pin on the map.

Three common reasons: you are behind a carrier's centralised egress (metro egress is often in another city); you are on a proxy, VPN or cloud network node; or your network shares addresses through CGNAT. In all three cases the lookup returns the location of the egress router, not your device — no IP lookup tool can do the latter.

Both. The input recognises either format, for example 8.8.8.8 and 2001:4860:4860::8888, and also accepts embedded-IPv4 forms such as ::ffff:1.2.3.4. The result card additionally gives the decimal integer, the fully expanded form, the containing subnet (a /24 for IPv4, a /64 for IPv6) and the reverse DNS name, all converted locally. The PTR record is a real lookup — plenty of datacenter addresses have one, and it often names the cloud provider outright. Note that IPv6 geolocation coverage is generally weaker than IPv4, and the interface says so.

Use the "Subnet / CIDR calculator" card: enter something like 10.0.0.0/22 or 2001:db8::/48 and it returns the network address, broadcast address, subnet mask, wildcard mask, usable host range and total count. All of it is computed in the browser with no requests, so it works offline. The "Subnet" row in the result card is a button — press it and the current IP's /24 or /64 is loaded into the calculator. With no prefix length the input is treated as a single host (/32 or /128); /31 and /32 follow RFC 3021 and real point-to-point and single-host conventions.

Because domains like that exist to send and receive mail, not to serve a website. A domain lookup fetches A, AAAA, MX, TXT, NS and CAA in parallel plus the _dmarc subdomain. If there is no address but there are other records, the interface lays out the record list instead of reporting a failure, and runs a mail configuration check: whether SPF ends in -all or the dangerous +all, whether the DMARC policy is none or reject, and whether any MX record can receive mail.

It can. To establish peer-to-peer connections WebRTC gathers local network candidates, and historically that step could bypass the system proxy and reveal the real egress. The "Browser exposure check" card probes in two rounds: the first without STUN, purely to see whether private addresses leak; the second against Cloudflare's public STUN node to obtain a public reflexive address, which is then compared with your current egress — a mismatch means the proxy did not hold. Modern browsers enable mDNS obfuscation by default and hand out random .local hostnames instead, which is protection working, not a leak. The probe only runs when you ask for it, and nothing is sent back to this site.

Look at the "Risk signals" card. It scores heuristically from ASN ownership and ISP keywords: cloud providers and hosting companies (public clouds, colocation, CDNs, proxy providers) add a lot, mobile carriers and residential lines add little, and the result is a 0–100 score in four bands — residential, backbone egress worth noting, cloud host, and likely proxy or VPN. It is a hint about the nature of the line, not live threat intelligence, and it proves nothing about an address doing anything wrong.

Yes. Paste addresses into "Batch lookup" separated by newlines, commas or spaces, up to 20 at a time. Two run concurrently and the table reports location, ASN and ISP, line type and data source, exportable as CSV with one click. Public APIs have rate limits, so long runs may start failing — wait a moment and retry.

Yes, and no key is required. curl -L ip.fs.kg returns one line of plain-text IP, which is handy in scripts, Makefiles or a shell prompt; curl -sL ip.fs.kg/json returns the full JSON (IP, country, city, coordinates, ASN, ISP, TLS version, edge colo), and ?pretty formats it. That -L matters: this site forces HTTPS, so a request without a scheme gets a 301 first and without -L you only see the redirect. Detection is based on User-Agent and Accept: curl, wget, httpie and PowerShell get plain text while browsers get the interface. The data is read by Cloudflare edge nodes straight from your connection, with no third-party API and no server-side storage; responses carry a wildcard CORS header so browser fetch works as well.

That is not the site. PowerShell maps curl to an alias for Invoke-WebRequest, which is not real curl and defaults to http:// when no scheme is given. This site forces HTTPS, so the request lands on port 443 and you get 400 The plain HTTP request was sent to HTTPS port. Use the real client with an explicit scheme: curl.exe -L ip.fs.kg or curl.exe https://ip.fs.kg. To check which one you are running, Get-Command curl — if it says Alias, that is the culprit.

There is no database, no query log on the server, and no third-party analytics or ad scripts on the page. Your public IP is only read while performing a lookup for you. The only local storage is the "Recent lookups" list, kept in your own browser's localStorage and clearable from the "Data & limits" card.