pwnsy
Live lookup

Exit IP Lookup

Shows the public address your connection exits from, or any IP, host or URL you enter, with the network that owns it and whether sites will read it as a VPN, Tor exit, datacenter or home line.

Try

Network details appear with the first lookup

Routing record, reverse DNS and the registry record over RDAP.

How the exit IP lookup works

With no input, the page asks our API at vpn.pwnsy.com which address your request arrived from. That is your exit IP: the address every site you visit sees. Type an address, a hostname or a URL to look up something else instead.

  • Hostnames are resolved over DNS-over-HTTPS (dns.google) to their A and AAAA records. The first address is looked up and the others are offered as chips.
  • Network facts (ASN, prefix, owner, location) come from Team Cymru and ipwho.is, and Tor status from the Tor Project's exit list.
  • Reverse DNS comes from our API, or from dns.google when the API has none. The PTR name is then resolved over dns.google to see whether it points back to the same address (forward-confirmed).
  • Registry record and abuse contact come from the regional registry over RDAP.
  • Routing comes from RIPEstat (RPKI status, route visibility, first seen) and the Spamhaus DROP list.
  • Both address families: for your own connection, two single-family endpoints (api4 and api6.ipify.org) report which address IPv4 and IPv6 each leave from, and their networks are compared.

How to read the result

  • Reads as tor exit (red): the address is on the Tor Project exit list. Sites that check it will challenge or block this traffic.
  • Reads as vpn network or datacenter exit (amber): the owner matches a commercial VPN operator or a hosting company. Consumer traffic rarely starts there, so VPN-list and fraud checks flag it.
  • Looks residential (green): no hosting, VPN or Tor signal. A VPN that exits through residential ranges reads the same way, so a miss proves nothing on its own.
  • Both address families: IPv4 and IPv6 leaving through different networks while a VPN is on is the classic IPv6 leak.
  • RPKI: signed and valid means a signed record says who may announce the prefix. Spamhaus DROP: a listed range is one many networks refuse outright.

Geolocation is a provider estimate, and city-level location is often wrong.

Exit IP lookup FAQ

How does the tool decide an IP reads as a VPN or datacenter?

It matches the network name (ASN), the owner and the whois organisation against keywords for commercial VPN operators and hosting companies, and checks the address against the Tor Project's exit list. The matched keywords are shown under the verdict so you can see why.

My VPN is on. Why does my exit IP read as residential?

Either the tunnel is not carrying this browser, or your VPN exits through residential address space, which carries no hosting or VPN signal. A miss proves nothing on its own. Run the VPN leak test to see whether your traffic, DNS and WebRTC follow the same path.

What does forward-confirmed reverse DNS mean?

The address has a reverse DNS (PTR) name, and that name resolves back to the same address. Only someone who controls both zones can publish that pair, so it is stronger evidence of who runs the address than a PTR name alone.

What does the open ports check scan?

Ten common ports on your own public address only, meaning the address your request to our API came from. It cannot be pointed at another address. Each port shows whether it answered and why an open one matters.

Can I share a lookup?

Yes. A lookup puts the address or hostname in the page address, for example pwnsy.com/tools/vpn/exit-ip/8.8.8.8, and opening that link runs the same lookup. The My exit IP view never puts your own address in the link.

Network facts from Team Cymru and ipwho.is; Tor status from the Tor Project; registry and abuse contact over RDAP; routing from RIPEstat and the Spamhaus DROP list; reverse DNS and hostnames via dns.google; address families via ipify.

Copied