Who Owns an IP Address? How to Read IP Ownership Data

Who owns an IP address? Under registry policy, no one outright: a regional internet registry registers each block of addresses to a holder, usually a network operator, for its exclusive use, and the holder can reassign part of it to a customer. One lookup can therefore name several organizations: the one the address is registered to, the network that announces it, and the team that takes abuse reports.

On October 22, 2026, example.com resolved to 104.20.23.154. IANA keeps example.com for documentation, yet every record on that address names Cloudflare: the company is Cloudflare, Inc., the announcing network is AS13335, and abuse reports go to Cloudflare's abuse desk. Here the records agree with each other and disagree with the domain; on many addresses, they disagree with each other too.

TL;DR

Who owns an IP address depends on what you need to know. The company field names the organization the address is assigned to, the ASN names the network that announces it, the company's type tells you whether that organization is an ISP, and abuse reports go to the contact on the most specific range.

• A network typed ISP can carry ranges registered to agencies, colleges, banks, and hosting firms, so check the company type on each range.
• An address on a CDN's own network names the CDN provider, not the website's owner; a site that brings its own block, as GitHub does on Fastly, keeps its own name.
• Behind carrier-grade NAT, one public address serves many subscribers, and the provider needs the source port and an accurate timestamp to tell them apart.

Why no one owns an IP address outright

Registries hand out address space for use, and they don't sell it. ARIN's Number Resource Policy Manual says "number resources are not 'sold' under ARIN administration"; they're assigned to an organization for its exclusive use for as long as the registration terms are met.

IANA allocates pools of unallocated addresses to the five regional internet registries: AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC. Each registry allocates blocks to holders in its region, often internet providers. A holder can then pass addresses on in two ways, which ARIN's policy manual names separately: a reallocation hands a block to another organization to distribute to its own customers, and a reassignment hands it to a customer for that customer's own use. In the ARIN region, every IPv4 reassignment or reallocation of a /29 (eight addresses) or larger has to be registered within seven calendar days, with the customer's name, unless a policy exemption applies.

Blocks also change hands. RIPE NCC's transfer policy lets a holder transfer all or part of a block, permanently or not, and requires the RIPE Database to record it. Renting IPv4 space from a RIPE NCC member is a recognized option too, but it doesn't always leave a record with the tenant's name: under RIPE NCC's IPv4 policy, a member can register its customer assignments one by one or as a single object marked AGGREGATED-BY-LIR.

Routing sits outside the registry system. RFC 7020 puts whether and how addresses are announced to the internet "outside the scope of the Internet Numbers Registry System." Networks announce the blocks they carry through BGP, telling other networks to send traffic for those addresses their way, and that's where the second name on an address comes from.

What an ownership lookup returns

Ownership and abuse contact data are two of the layers of IP intelligence an IP lookup returns. They answer four questions, and each answer can name a different organization.

{
  "ip": "185.199.108.153",
  "network": {
    "route": "185.199.108.0/24"
  },
  "asn": {
    "as_number": "AS54113",
    "organization": "Fastly, Inc.",
    "type": "HOSTING"
  },
  "company": {
    "name": "GitHub, Inc.",
    "type": "BUSINESS",
    "domain": "github.com"
  },
  "abuse": {
    "route": "185.199.108.0/22",
    "name": "GitHub Abuse",
    "emails": ["abuse@github.com"]
  }
}

---

3. ISP: a company type, not a separate record

No registry record is labeled ISP. In IPGeolocation.io's data, the ISP is the company whose company.type is ISP, so the field answers one question: is the organization this address is assigned to an internet provider? When the type is HOSTING, BUSINESS, EDUCATION, or GOVERNMENT, it isn't.

That's a different question from who connects the address to the internet. The college reaches the internet through Cogent, its upstream provider, and the ASN shows that; the company field still names the college, typed EDUCATION. A tool that labels Cogent the college's ISP is answering the network question.

The trap is reading the network's type as the answer for every range it carries, since asn.type describes the whole network. Sheharyar's rule: an ASN typed ISP tells you about a range only when the network uses its routes for its own customers, and once ranges are reassigned or leased out, you check the company type on each one. Cogent's AS174 is typed ISP, and on October 22, 2026, IPGeolocation.io lookups of an address in each of these registered ranges all returned AS174:

Registered Range	Company (Company.name)	Company.type	Registry Record
38.0.0.0/8	Cogent Communications, LLC	ISP	ARIN direct allocation, 1991
167.141.0.0/16	Illinois Criminal Justice Information Authority	GOVERNMENT	ARIN direct allocation to the agency, 1993
63.160.95.0/26	Philadelphia College of Osteopathic Medicine	EDUCATION	ARIN assignment, 2021
208.11.8.0/21	Branch Banking and Trust Company	BUSINESS	ARIN assignment, 2005
208.29.138.0/23	CHAMBERLAIN GROUP INC	BUSINESS	ARIN assignment, 2015
193.235.207.0/24	EDIS GmbH	HOSTING	RIPE NCC assigned PA, 2018
66.243.224.0/24	FAIRPOINT COMMUNICATIONS, INC.	ISP	ARIN allocation to FairPoint, 2007

A state agency, a college, a bank, a manufacturer, a hosting company, and a second ISP all reach the internet over one ISP-typed network, and the company type on each range is what separates them.

For home and mobile connections, the company usually is the ISP, and it's also the network and the abuse contact. ARIN's policy even lets a provider put its own name on a residential customer's record, with "Private Residence" as the street address, as long as accurate upstream abuse and technical contacts stay visible. A separate guide covers how an ISP differs from an ASN.

Why the names disagree

The names disagree when a holder passes addresses to someone else, when another network carries a holder's block, or when an address serves a website that belongs to someone else. Sheharyar lists five reasons a company field can look wrong: a reassignment, IPv4 leasing, cloud or CDN infrastructure, a stale record, or a different expectation, where the reader wants one organization's name and the data names another.

CDN addresses break the link between a domain and an address, as the example.com lookup showed: the site's owner appears in none of the IP records, and the CDN provider is the one to contact. If a CDN or cloud address turns up in your own logs, check first that it isn't your own proxy (step 1 of the how-to), then whether security data flags it as a privacy relay's exit.

Leased blocks are the hardest to read. Sheharyar sorts them into three cases by what the registry and routing data show:

1. A registered lease or reassignment: the lessee may appear as a downstream customer, and the route comes from the lessee's ASN or the provider's.
2. A lease with no public customer record: the original holder stays visible in the registry, while the lessee's ASN may still announce the route.
3. A hosted or provider-announced lease: the provider or holder is visible, and the provider's ASN announces the route.

Put the registry and the route side by side to tell them apart. A customer record under the holder's block points to the first case. Only the original holder in the registry, with a different network announcing the route, points to the second. The holder or provider on both sides points to the third.

Some records hide the customer on purpose. One RIPE NCC record checked on October 22, 2026 registers a sub-allocated /24 to the word "Company" followed by a string of characters, lists its contact as "Private Customer" at "Private Residence", and sends abuse reports to an outsourced abuse-handling service. Only the provider can say who uses those addresses.

How to find who owns an IP address

To find an IP address owner yourself, follow the records in five steps.

1. Check that the address is public. Private ranges, other bogon addresses, and the shared 100.64.0.0/10 space that RFC 6598 sets aside for carrier-grade NAT have no public owner record. If the address came from your own logs, make sure it's the visitor's real IP address and not your proxy's or CDN's.
2. Look up the registry record over RDAP. RDAP returns registration data as structured JSON over HTTPS, where WHOIS returns text over its own protocol and port (ARIN's RDAP page). ICANN Lookup accepts IP networks and ASNs, and ARIN's RDAP service redirects questions about other regions to the registry that holds the record.
3. Read the record type. ARIN's type field reads DIRECT ALLOCATION for blocks ARIN issued itself, and ALLOCATION or ASSIGNMENT for blocks that came through an upstream provider; the college's record is an ASSIGNMENT under Cogent's DIRECT ALLOCATION. RIPE NCC uses its own status values, such as the ALLOCATED-ASSIGNED PA on GitHub's block.
4. Find the network that announces it. Routing data tells you this, not the registry: ARIN's optional Origin AS field, which can list the networks a block may be announced from, is empty on the college's record. RIPE NCC's RIPEstat shows the announcing ASN for any prefix, and IPGeolocation.io's free IP lookup page shows the ASN together with the route, the company, and the abuse contact.
5. Take the abuse contact from the most specific record, the one with the smallest range that covers the address.

With curl and jq installed, this command runs the same RDAP lookup from a terminal and returns the record's name, type, range, registrant, and abuse contact for any address:

curl -sSL --fail https://rdap.arin.net/registry/ip/185.199.108.153 | jq '{
  name, type, startAddress, endAddress,
  registrant: [.entities[]? | select(.roles | index("registrant"))
               | .vcardArray[1][]? | select(.[0] == "fn") | .[3]][0],
  abuse: [.. | objects | select((.roles? // []) | index("abuse"))
          | .vcardArray[1][]? | select(.[0] == "email") | .[3]] | unique
}'

{
  "name": "US-GITHUB-20170413",
  "type": "ALLOCATED-ASSIGNED PA",
  "startAddress": "185.199.108.0",
  "endAddress": "185.199.111.255",
  "registrant": "GitHub, Inc.",
  "abuse": [
    "abuse@github.com"
  ]
}

The -L flag follows ARIN's redirect to RIPE NCC, which returns GitHub's /22. Without it, curl prints ARIN's own record for 185.0.0.0/8, which names RIPE NCC as the registrant, and it's easy to mistake the registry for the owner.

Can you find the person behind an IP address?

Not from public records. ARIN says it "will not collect any personal information for inclusion in its public Whois," and providers can list residential customers under their own name. Carrier-grade NAT puts many subscribers behind one public address, and RFC 6302 spells out what the provider then needs: "In the absence of the source port number and accurate timestamp information, operators deploying any address sharing techniques will not be able to identify unambiguously customers when dealing with abuse or public safety queries." That's why it recommends that servers log the source port and a UTC timestamp accurate to the second. If you run servers, log both now, before you need to file a report.

Matching a session to a subscriber happens inside the provider, through its own processes and legal requests, not through any lookup you can run.

How to report abuse from an IP address

1. Find the abuse contact on the most specific record covering the address.
2. Send evidence the operator can match: the source IP, the timestamp in UTC to the second, the source port, the destination port and protocol, and the relevant log lines. Those are the fields RFC 6302 recommends servers log, and RIPE NCC asks reporters for "as much detail as possible including the IP address and the time the abuse took place."
3. Expect a network team to answer. RIPE NCC reminds reporters that the contact will be an ISP or another network operator, not the abuser.
4. Go upstream when the first contact won't help. If the contact belongs to the organization you're reporting, or nobody answers, report to the network that announces the range. Its abuse contact is in its AS number's registry record; for Cogent, that's AS174's RDAP record. The registry can't make an operator reply: "There is nothing we can do if a network operator chooses not to reply," RIPE NCC says.
5. Report contacts that bounce to the registry, which validates abuse contacts on a schedule.

IPGeolocation.io's IP Abuse Contact API returns the contact, its emails, and the range it covers for any public IPv4 or IPv6 address.

IP ownership data from IPGeolocation.io

IPGeolocation.io returns geolocation, security, ASN, company, abuse contact, time zone, and user agent data from one IP Geolocation API endpoint, in one JSON response. Its security data scores each address from 0 to 100 and flags VPNs, proxies, residential proxies, Tor, known attackers, bots, spam, cloud addresses, and corporate gateways.

For ownership work, a single call covers it: one request returns the announcing ASN and its type, the registered company and its type, the network route, and the abuse contact with the range it covers. This request asks only for the ownership fields of the college's address:

# Company, network, and abuse contact data need a paid key.
# The key is read from the environment so it never sits in the script.
curl -sS --fail "https://api.ipgeolocation.io/v3/ipgeo?apiKey=${IPGEO_API_KEY}&ip=63.160.95.10&include=abuse&fields=asn.as_number,asn.organization,asn.type,company.name,company.type,network.route,abuse.name,abuse.route"

{
  "ip": "63.160.95.10",
  "network": {
    "route": "63.160.0.0/12"
  },
  "asn": {
    "as_number": "AS174",
    "organization": "Cogent Communications, LLC",
    "type": "ISP"
  },
  "company": {
    "name": "Philadelphia College of Osteopathic Medicine",
    "type": "EDUCATION"
  },
  "abuse": {
    "route": "63.160.95.0/26",
    "name": "PCOM-Admin"
  }
}

Cogent's network, typed ISP, announces the /12; the company is the college, typed EDUCATION; and the abuse contact covers only the college's /26. The response field references documents every field.

ASN data is rebuilt every day from global BGP routing feeds and all five regional internet registries, and abuse contacts are refreshed daily from the WHOIS and RDAP records operators file with them. The ASN API adds routes, peers, upstreams, downstreams, and the raw WHOIS record for any ASN or IP, and the IP Geolocation API's bulk endpoint takes up to 50,000 addresses per request. For offline work such as enriching logs, the IP to Company, IP to ASN, IP Abuse Contact, IP WHOIS, and ASN WHOIS databases come as downloadable files. Free and paid plans include different data, and the pricing page compares them.

What to do next

Take one address from your logs and look it up on the free IP lookup page, which opens on GitHub Pages' address and takes any other in its search box. For production, the IP Geolocation API returns the same records in one call, and the pricing page shows which plan includes company, network, and abuse contact data. To try the paid data first, ask the support team about a free trial.