Grabify is a link-shortening tool that logs the IP address, approximate location, device, and browser of anyone who clicks the link — without them knowing. It gets shared as an “IP logger” because that’s exactly what it does: someone sends you a disguised link (often through Instagram DMs, Discord, or email), you click it, and your IP, rough location, ISP, and device details get logged to a dashboard the link’s creator can view. This article previously walked through setting one up to track people; here’s what it actually does, why that matters, and how to protect yourself from it.
Why “tracking someone’s IP” through a link is a problem
Sending someone a disguised link specifically to capture their IP address and location — without their knowledge — is a form of covert surveillance. Depending on what’s done with that information and where you live, it can cross into harassment, stalking, or doxxing territory, particularly if the IP is used to look up an approximate home address or shared publicly to intimidate someone. An IP address alone usually only reveals a city-level location and an internet provider, not a home address — but combined with other information (a social media profile, a name), it can meaningfully narrow down where someone lives.
How to protect yourself from IP loggers
- Don’t click shortened or unfamiliar links from people you don’t know or trust, especially ones sent with urgency (“look at this!”) — that pressure is a common social-engineering tactic.
- Preview links before clicking. Hovering over a link (desktop) or long-pressing it (mobile) often reveals the real destination domain before you commit to opening it. Link-preview/expander tools can also unshorten a URL safely.
- Use a VPN if you regularly click links from strangers (streamers, online marketplaces, gaming communities) — a VPN means any logged IP traces back to the VPN provider, not you.
- Know that most platforms strip or proxy links. Some apps (including several messaging platforms) route outbound link clicks through their own servers first, which already limits what a logger can see — but this isn’t universal, so don’t rely on it alone.
If you think someone has your IP
An IP address by itself is rarely enough for someone to find your home address. If you’re being harassed or feel unsafe, document the messages/links, report the account to the platform (Instagram, Discord, etc. all have policies against this), and consider changing your IP by restarting your router (most home ISPs assign dynamic IPs) or using a VPN going forward.
Legitimate uses of link analytics
Link-tracking technology itself isn’t inherently malicious — marketers and website owners legitimately use link analytics (click counts, referral sources, general geographic breakdowns) all the time, typically disclosed via a privacy policy and aggregated rather than used to identify one specific person. The difference is consent and intent: analytics on your own marketing links is standard practice; secretly logging one specific person’s IP to identify or track them is not.
