The numeric address every machine on the internet can be reached at, like a phone number for computers.
Why it exists
For one machine to send data to another across the internet, it needs an exact, unique way to locate that machine, and the network itself has no concept of names. The IP address exists to be that locator: a number every connected machine can be reached at, so requests actually arrive at the right place. Because each address identifies a specific source, it also becomes the handle you use to block an abusive one, allow a partner's, or notice a single address making thousands of requests.
How it actually works
Every server has an IP address, a string of numbers such as 34.120.8.11. When one computer wants to talk to another, it needs that number to find it.
Humans do not use these numbers directly. We use names like tiffinbox.com, and a lookup step turns the name into the number behind the scenes.
A senior PM walks you through it
A junior PM, stuck
Security said "all the fraud attempts are coming from the same IP block, should we ban it?" and pointed me at an auth log. I could not see what they saw. I do not want to approve blocking an address range without understanding what in the log makes it obviously one bad actor and not a bunch of normal customers.
An IP address is the number a request arrives from, like the return address on every envelope. Real customers come from many scattered addresses; an attack usually comes from one, hammering the same endpoint over and over. Here are fifteen lines from the login log. Read the source-IP column, not the timestamps, and the pattern draws itself.
POST /api/auth access log, 15 lines from 09:00
2026-03-06T09:00:01Z POST /api/auth 200 ip=27.147.203.11
2026-03-06T09:00:03Z POST /api/auth 401 ip=103.108.140.22 email=promo+aa@mail.com
2026-03-06T09:00:05Z POST /api/auth 401 ip=103.108.140.22 email=promo+ab@mail.com
2026-03-06T09:00:06Z POST /api/auth 200 ip=118.179.51.7
2026-03-06T09:00:08Z POST /api/auth 401 ip=103.108.140.22 email=promo+ac@mail.com
2026-03-06T09:00:09Z POST /api/auth 401 ip=103.108.140.22 email=promo+ad@mail.com
2026-03-06T09:00:11Z POST /api/auth 200 ip=202.134.10.99
2026-03-06T09:00:12Z POST /api/auth 401 ip=103.108.140.22 email=promo+ae@mail.com
2026-03-06T09:00:14Z POST /api/auth 401 ip=103.108.140.22 email=promo+af@mail.com
2026-03-06T09:00:15Z POST /api/auth 200 ip=43.245.117.3
2026-03-06T09:00:17Z POST /api/auth 401 ip=103.108.140.22 email=promo+ag@mail.com
2026-03-06T09:00:18Z POST /api/auth 401 ip=103.108.140.22 email=promo+ah@mail.com
2026-03-06T09:00:20Z POST /api/auth 200 ip=157.119.24.6
2026-03-06T09:00:22Z POST /api/auth 401 ip=103.108.140.22 email=promo+ai@mail.com
2026-03-06T09:00:24Z POST /api/auth 200 ip=180.211.199.8
Click a step to see the lines it points at.
Mistakes I've seen
Approving an IP ban without reading the log yourself. If the abuse were spread across many addresses, blocking one does nothing; the "same IP" claim is exactly what you can verify in the source column in thirty seconds.
Reading the timestamps instead of the source column. The story here is not when the requests came, it is that nine of them share one address; group by IP first, everything else second.
Confusing a shared office IP with an attacker. Many real users behind one corporate proxy also share an address; the tell here is nine failed logins in seconds, so check the status codes before you ban, not just the repetition.
Banning too wide. Blocking the whole range around 103.108.140.22 can catch a neighborhood of real customers; the log points at one exact address, so block that, not the block around it.
Reply to security: "Confirmed from the auth log: 103.108.140.22 made nine failed logins in twenty-four seconds against different promo emails, while every legitimate customer in the same window comes from a different address and succeeds. Blocking that single IP is safe; I would not widen it to the range." You grouped the log by source and told one attacker apart from normal traffic.
Where a PM meets this
IP addresses come up in security work: blocking a range of IPs, allowing only certain ones, or spotting one address making thousands of requests.
"Whitelist our IP" is a common request when connecting two company systems.
Hear it in a meeting
"All the fraud attempts are coming from the same block of IPs."