Measuring…
There is more than one address that can honestly be called yours, and the difference between them is the only thing on this page worth knowing.
Every request you make carries a source address, because otherwise the reply has nowhere to go. That is the address in other people’s logs, the one a rate limit counts against, the one a geo-block acts on, and the one that ends up on a blocklist if something on your network misbehaves.
It is the answer to the question almost everyone is asking.
A STUN server tells a browser what address a UDP packet arrived from. WebRTC needs this to set up a call directly between two participants rather than relaying everything through a server.
Any page can ask, without permission and without touching your camera or microphone. That is why it is a privacy question as well as a networking one.
Both are real. The usual cause is a VPN or proxy that handles TCP but not UDP, so your browsing goes through the tunnel and your real-time traffic goes straight out of your own connection.
For a privacy VPN that is a failure of the thing you are paying for. For a corporate VPN it is often deliberate, so that calls do not hairpin through the office.
Not every address is a public one, and the range an address sits in determines what is possible on that connection.
| Range | Reserved by | What it means for you |
|---|---|---|
| 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 | RFC 1918 | Private. Fine inside a network, never routed on the internet. Seeing one here means something between you and us did not pass your real address along. |
| 100.64.0.0/10 | RFC 6598 | Carrier-grade NAT. Your provider shares one public address between many subscribers, so nothing can connect inwards. Port forwarding, self-hosting and some VPN and gaming setups will not work until the provider gives you a real address. |
| 169.254.0.0/16 | RFC 3927 | Link-local, assigned by the device itself when DHCP did not answer. On a local interface it means the network is not handing out addresses. |
| fe80::/10 | RFC 4291 | The IPv6 equivalent of link-local. Every IPv6 interface has one, and it never leaves the segment. |
| fc00::/7 | RFC 4193 | Unique local addresses — IPv6’s private range, used inside a site. |
Every free geolocation database is an inference. Registry records say which organisation holds a range and which country it was registered in; everything more precise than that is derived from reverse DNS names, from traceroute timings, from submitted corrections, and from guesswork. The result is good enough for choosing which language to show and bad enough that people are routinely placed in a city hundreds of miles from where they are — or at the geographic centre of their country, which is what a database returns when it has nothing and will not say so.
Commercial providers do better, by buying data and by measuring continuously, and they charge for it. We have not bought it, so this page reports what the registries actually publish: the organisation holding the allocation, the range, the autonomous system announcing it, and the abuse contact. Those are facts. A city would be a guess wearing the same typeface as the facts, which is the part that makes it harmful.
If you need to know where a network is, the autonomous system and the organisation name tell you far more than a pin on a map: a residential ISP in one country, a hosting provider in another, or a mobile network whose addresses move with the subscriber.
Because they are measuring different things. Most 'what is my IP' pages report the source address of the request their server received, which is the address the internet sees you from. A few use WebRTC instead, which reports where a UDP packet from your browser arrived from. On an ordinary connection both are the same. On a VPN that carries web traffic but not real-time traffic they differ — and that difference is a leak, not a discrepancy between the sites.
WebRTC needs to know your real address to set up a direct audio or video connection, so it asks a STUN server on the public internet what address it sees. If your VPN only routes TCP, or if the browser is configured to use the real network interface for real-time media, that question is answered by your actual connection rather than the tunnel — and any page you visit can ask it. You care if you are using a VPN for privacy: the tunnel is doing nothing for the one protocol that discloses your address directly. You do not care if the VPN is for reaching a corporate network.
Because that address is not yours. 100.64.0.0/10 is reserved by RFC 6598 for carrier-grade NAT, where a provider shares one public address between many subscribers. Inbound connections have nowhere to go: there is no port on your address to forward, and nothing you change on your own router will create one. Providers usually offer a public IPv4 address as a paid extra, and most will enable it on request. IPv6, where the service supports it, sidesteps the problem entirely because there are enough addresses to give you real ones.
Because we would be guessing. Address-to-location data is a commercial product, and the free databases are built from registry records, reverse DNS and inference — which is why they routinely place people in the wrong city, the wrong state, or the geographic centre of the country. What can be stated as fact is who the address is allocated to, what range it belongs to and which network announces it, so that is what this page shows. A confident wrong city is worse than no city.
It identifies the connection, which is usually a household or an office rather than a person, and on carrier NAT it may be shared by thousands of subscribers. It is enough for a site to rate-limit you, geo-block you, or log you; it is not enough to name you without the provider's records, which generally require legal process. It also changes: most residential connections get a new address periodically, and mobile connections change constantly.
No. The WebRTC measurement happens in your browser. The server-side measurement is the ordinary source address of the request, which every web server necessarily sees in order to reply at all; it is used to answer this page and is not retained for it. Nothing here builds a profile, and there is no account.
We design, procure and manage business connectivity — circuits, SD-WAN, failover and the prioritisation that keeps voice usable while the line is busy. A result that is persistently below what you pay for, or calls that break up on a connection which tests clean, is a diagnosis worth doing properly rather than repeatedly.