How to Find Out Who Owns an IP Address (WHOIS & ASN)

PAYATE Team· Oct 26, 2026· 19 min read

HPAYATE

Every device that connects to the internet has an IP address — a numeric label like 8.8.8.8 or 2606:4700::1111. Behind every one of those addresses is an owner: an internet provider, a hosting company, a cloud platform, a university, or a large corporation. When you see a suspicious login, a scraping bot hammering your server, a spam email, or an unfamiliar visitor in your analytics, one question comes up again and again: who owns this IP address?

The good news is that this information is public by design. The organisations that hand out IP addresses are required to publish who holds each block. In this guide you’ll learn exactly how to look up the owner of any IP, the difference between registration and geolocation, what an ASN is, and how to read the results like a professional — all without installing anything.

You can follow along with three free tools: the IP WHOIS & ASN Lookup for official registration, the IP Lookup for geolocation, and the Reverse IP Lookup to find other sites on the same server.

Two Different Questions: “Where” vs “Who”

People often say “look up an IP” as if it’s one action, but there are really two very different questions, answered by two different data sources:

Where is this IP? (Geolocation) — an estimate of the country, region, and city, plus the ISP, drawn from commercial geo-IP databases. Great for “which country is this visitor in?” Use the IP Lookup.
Who owns this IP? (Registration) — the official record of which organisation the address block is allocated to, held by the internet registries. This is authoritative, not an estimate. Use the IP WHOIS & ASN Lookup.

Understanding this distinction saves a lot of confusion. Geolocation can be wrong by hundreds of miles, especially on mobile and corporate networks. Registration data, by contrast, is maintained by the registries and tells you the actual owning organisation and the exact address range they hold.

Who Hands Out IP Addresses? The Five RIRs

The world’s IP address space is managed by the Internet Assigned Numbers Authority (IANA), which delegates large blocks to five Regional Internet Registries (RIRs), each covering a part of the globe:

ARIN — North America
RIPE NCC — Europe, the Middle East, and Central Asia
APNIC — Asia-Pacific
LACNIC — Latin America and the Caribbean
AFRINIC — Africa

These RIRs allocate blocks to ISPs, hosting companies, and large organisations, and they publish who holds each block. That public database is what you’re querying when you do an IP WHOIS lookup. Because an IP’s registration is handled by whichever RIR covers its region, a lookup for a European IP ultimately pulls from RIPE, an American one from ARIN, and so on — modern tools follow this chain for you automatically.

WHOIS vs RDAP: The Old Way and the New Way

Historically, you looked up IP (and domain) ownership using the WHOIS protocol — a simple, decades-old service on port 43 that returned a blob of text. WHOIS worked, but it had problems: inconsistent formatting between registries, no structure, no internationalisation, and weak access control.

The modern replacement is RDAP (Registration Data Access Protocol). RDAP returns clean, structured JSON over HTTPS, with consistent fields across all registries, proper support for Unicode, and standardised error handling. When you use the IP WHOIS & ASN Lookup, it queries RDAP behind the scenes, which is why the results come back neatly organised into fields like network range, organisation, and abuse contact rather than a wall of raw text.

What an IP WHOIS Lookup Tells You

Run any public IP through the IP WHOIS & ASN Lookup and you’ll typically get back these fields:

Network Range and CIDR

The exact block the IP belongs to — for example 8.8.8.0 – 8.8.8.255, written in CIDR notation as 8.8.8.0/24. This tells you the size of the allocation and which neighbouring addresses belong to the same owner. A /24 is 256 addresses; a /16 is 65,536.

Network Name

A short handle the owner chose for the block, like GOGL for Google or APPLE-WWNET for Apple. It’s a quick hint at who’s behind the range.

Organisation

The entity the block is registered to — the company or institution that holds it. This is the authoritative answer to “who owns this IP.”

Country

The country of registration. Note this is where the block is registered, which may differ from where a specific address is physically used — another reason registration and geolocation can disagree.

Abuse Contact

Perhaps the most practically useful field. If an IP is attacking you, spamming you, or scraping your site, the abuse contact is the published email address for reporting it to the owning network. For example, Google’s blocks list network-abuse@google.com. Sending a clear, factual abuse report here is the correct way to get action taken.

What Is an ASN?

An Autonomous System Number (ASN) identifies a network that announces routes on the internet — an ISP, a cloud provider, a CDN, or any large organisation that runs its own routing. The global internet is essentially a mesh of autonomous systems exchanging traffic using a protocol called BGP, and each one has a unique ASN like AS15169 (Google) or AS13335 (Cloudflare).

Every public IP is announced by exactly one autonomous system at a time. Knowing the ASN tells you which network actually carries the address on the internet — which is often more meaningful than the registration, because it reflects who is operating the IP today. The IP WHOIS & ASN Lookup shows both the ASN and its name, so you immediately see, for example, that 8.8.8.8 is announced by AS15169 Google LLC.

Why ASNs Matter for Security

ASNs are a powerful lens for threat analysis. If you see attacks from many different IPs that all belong to the same ASN — especially a “bulletproof” hosting provider or a known abuse-friendly network — you can block or rate-limit the entire autonomous system rather than chasing individual addresses. Conversely, seeing that traffic comes from a reputable cloud ASN (AWS, Google Cloud, Azure) tells you it’s likely automated but not necessarily malicious.

Reverse IP Lookup: Finding Other Sites on the Same Server

A regular DNS lookup turns a domain into an IP. A reverse IP lookup does the opposite kind of investigation: it finds the other domains hosted on the same IP address. This is useful for several reasons:

Reconnaissance — map all the sites a company runs, or every domain sharing a server you’re investigating.
Shared-hosting checks — see how crowded a shared server is. A server packed with spam or adult sites is a “bad neighbourhood” that can hurt your SEO and deliverability.
Migration verification — confirm which sites still point at an old IP after a move.

Try the Reverse IP Lookup on a shared-hosting IP and you may see dozens or hundreds of unrelated domains. One important caveat: sites behind big CDNs like Cloudflare all share the CDN’s IPs, so a reverse lookup there shows the CDN’s neighbours, not the real origin server. Reverse-IP data is best-effort and sampled from public sources, so treat it as a strong lead rather than a guaranteed complete inventory.

Putting It Together: A Real Investigation Workflow

Say you spot a suspicious IP repeatedly trying to log into your site. Here’s how the pieces fit:

Geolocate it with the IP Lookup to get a rough country and ISP. Useful context, but remember it’s an estimate.
Check registration with the IP WHOIS & ASN Lookup to find the owning organisation, the network range, the ASN, and the abuse contact.
Check if it’s a VPN, proxy, or datacenter IP with the VPN & Proxy Detection tool. Login attempts from a datacenter or anonymiser are a strong fraud signal for a consumer service.
Map the neighbourhood with the Reverse IP Lookup to see what else lives on that address.
Act — block the IP or its ASN, rate-limit the range, and if the behaviour is clearly abusive, email the published abuse contact with timestamps and log excerpts.

For merchants and anyone screening payments, there’s an extra layer: comparing the buyer’s IP country against the issuing country of their card. That mismatch is a classic fraud indicator, which is exactly what the BIN / IP Fraud tool is built to flag.

Privacy: What You Can and Can’t See

It’s important to set expectations. IP WHOIS tells you about the organisation that owns the address block — not the individual person using a specific address. For a home internet connection, the owner is the ISP, not the subscriber. Identifying an actual person behind an IP generally requires legal process directed at that ISP; it is not something any public lookup can or should reveal.

This is by design and is a good thing. Registration data exists so that networks can be held accountable and abuse can be reported to the responsible operator — not so that anyone can de-anonymise individuals. Use these tools for legitimate purposes: security, abuse handling, diagnostics, and research.

IPv4 vs IPv6 Lookups

Everything above applies to both IPv4 (8.8.8.8) and IPv6 (2606:4700::1111). IPv6 blocks are vastly larger — a single customer might receive a /48, which is an astronomically big range — so the “network range” field for IPv6 can look enormous. The owning organisation, ASN, and abuse contact work exactly the same way, and modern RDAP-based tools like the IP WHOIS & ASN Lookup handle both address families transparently.

Understanding CIDR Notation

IP WHOIS results are full of CIDR notation like 8.8.8.0/24, and it’s worth a moment to demystify it. CIDR (Classless Inter-Domain Routing) describes a block of addresses by a starting address and a prefix length — the number after the slash — which says how many bits are “fixed” as the network portion.

/24 fixes 24 of 32 bits, leaving 8 bits for hosts — that’s 2^8 = 256 addresses (e.g. 8.8.8.0 to 8.8.8.255).
/16 leaves 16 host bits — 65,536 addresses.
/32 is a single address; /8 is roughly 16.7 million.

The smaller the number after the slash, the larger the block. When an IP WHOIS lookup shows a /16 owned by a company, that organisation controls 65,536 consecutive addresses — a strong hint you’re dealing with a major provider rather than a small customer. For IPv6, prefixes look huge (a customer might get a /48), because the address space is astronomically larger.

Reading a Real RDAP Response

When you look up an IP, the structured RDAP data behind the scenes contains a predictable set of fields, which the IP WHOIS & ASN Lookup surfaces in plain language:

startAddress / endAddress — the boundaries of the allocated block.
name / handle — the network’s short label and registry identifier.
type — how it was allocated: DIRECT ALLOCATION (straight from the RIR to a large holder), ALLOCATED PORTABLE, or REASSIGNED (handed down to a customer by an ISP).
entities — the people and organisations attached to the block, each with roles like registrant, administrative, technical, and abuse. The abuse entity’s email is the one you want for reports.
events — timestamps for registration and last change.

The type field is especially telling: a REASSIGNED block means the IP belongs to a customer of a larger ISP, so you may see both the ISP and the end customer in the data. Following that hierarchy is exactly how abuse teams and investigators trace responsibility.

How IP Geolocation Actually Works (and Why It’s Often Wrong)

Geo-IP databases don’t magically know where a device is. They’re built from a mix of signals: the RIR registration country, data that ISPs voluntarily publish about where ranges are used, latency measurements, and user-submitted corrections. The result is an estimate that’s usually accurate at the country level but can be wildly off for city-level claims.

Common reasons geolocation misleads:

Mobile networks route traffic through regional gateways, so a phone in one city may appear in another.
Corporate VPNs and proxies show the exit location, not the user.
Cloud and CDN IPs may be registered in one country but serve traffic globally.
Newly reassigned ranges can carry stale location data for months.

This is why serious analysis pairs the geo estimate from the IP Lookup with the authoritative ownership from the IP WHOIS & ASN Lookup, and checks whether the IP is an anonymiser with the VPN & Proxy Detection tool. Any one signal can mislead; together they tell a reliable story.

IP Reputation and Blocklists

Beyond “who owns it,” a practical question is “is this IP trouble?” IP addresses accumulate a reputation based on past behaviour. Mail servers consult DNS blocklists (DNSBLs) like Spamhaus to decide whether to accept mail from an IP; security tools track addresses seen in attacks. An IP’s reputation is tied to its ASN and range, which is why a “bad neighbourhood” — a hosting provider full of spammers — can taint every address in it. If you’re running a mail server, checking your own IP’s reputation and reverse DNS (PTR) before you send is essential; a mismatched PTR or a listed IP means your mail lands in spam regardless of how clean your content is.

Case Study: Investigating a Brute-Force Attack

Let’s walk through a realistic scenario to see all the pieces working together. Your server logs show hundreds of failed SSH logins from 198.51.100.42 over an hour.

Geolocate with the IP Lookup: it reports a datacenter in Eastern Europe. Context, not proof.
Check ownership with the IP WHOIS & ASN Lookup: the block is REASSIGNED to a budget VPS provider, ASN AS200xxx, with an abuse contact.
Check anonymiser status with VPN & Proxy Detection: flagged as a datacenter IP — consistent with an automated bot, not a real user.
Map the neighbourhood with the Reverse IP Lookup: the IP hosts a handful of throwaway domains — classic disposable infrastructure.
Respond: block the IP immediately, consider blocking the whole ASN at your firewall if the abuse is widespread, enable rate-limiting and fail2ban, and send the provider’s abuse contact a concise report with UTC timestamps and log lines.

In five minutes, a meaningless number became a full profile: who runs it, what kind of host it is, what else lives there, and a concrete response. That’s the power of combining these lookups.

IPv4 Exhaustion and the Shift to IPv6

Part of why IP ownership data has grown more complex is that the world ran out of fresh IPv4 addresses. All five RIRs have exhausted their general IPv4 pools, which created a secondary market where blocks are bought, sold, and leased — so an IP’s registered owner may now differ from who actually uses it, and ranges change hands more often. This is another reason to lean on the ASN (who announces the IP today) alongside the registration (who it’s allocated to). The long-term answer is IPv6, with its effectively unlimited address space, which is why publishing AAAA records and understanding IPv6 WHOIS is increasingly important. Modern RDAP-based tools handle both address families identically, so the skills you build on IPv4 carry straight over.

How to Write an Effective Abuse Report

Finding the abuse contact is only half the battle — a vague or angry report gets ignored, while a clear, factual one gets action. Once you’ve pulled the abuse email from the IP WHOIS & ASN Lookup, structure your message like this:

Subject — name the abuse type and the offending IP, e.g. “SSH brute-force from 198.51.100.42”.
The offending IP and, if relevant, the ASN and network range you found.
Timestamps in UTC — abuse teams work across time zones, so always normalise to UTC and include the range of activity.
Concrete evidence — a few representative log lines (not a 10MB dump), showing the behaviour clearly.
What you’re asking for — usually “please investigate and stop this activity.”
Your contact details so they can follow up.

Keep it calm and professional. The person reading it usually isn’t the attacker — they’re an operator who wants their network to behave, and a well-written report makes their job easy. For ongoing or large-scale abuse, you can also report to the relevant RIR or to threat-intelligence platforms, but the owning network’s abuse contact is almost always the fastest route to action.

Regional Registry Quirks

Although all five RIRs publish ownership data, they don’t behave identically, and knowing the differences saves confusion:

ARIN (North America) tends to have detailed organisation records and clear reassignment hierarchies, so you often see both the ISP and the end customer.
RIPE NCC (Europe/Middle East) runs a famously rich database with explicit inetnum, route, and dedicated abuse-contact objects.
APNIC (Asia-Pacific) covers an enormous, fast-growing region; records vary in detail by country.
LACNIC (Latin America) and AFRINIC (Africa) are smaller but follow the same model.

Modern RDAP smooths over most of these differences by returning a consistent JSON structure regardless of which registry ultimately holds the data — which is why a single lookup tool can seamlessly answer for an IP in any region. Behind the scenes it follows referrals from one registry to another until it reaches the authoritative source.

The IP Leasing and Secondary Market

Since IPv4 ran dry, a genuine market for address blocks has emerged. Organisations with spare IPv4 space sell or lease it to those who need more, under rules set by the RIRs. This has a direct consequence for anyone reading WHOIS data: the registered owner of a block and the party currently using it may differ, especially for leased ranges. A block registered to one company might be announced by a completely different ASN belonging to the lessee.

This is the practical reason to always read both the registration (who it’s allocated to) and the ASN (who announces it today). When they disagree, the ASN usually reflects the current operator — the one actually responsible for traffic from that IP right now. The IP WHOIS & ASN Lookup shows both side by side precisely so you can spot these cases.

Understanding IPv6 Addresses

As you do more IP lookups, you’ll increasingly meet IPv6, and its addresses look intimidating at first: 2606:4700:4700::1111. They’re actually straightforward once you know the rules. An IPv6 address is 128 bits written as eight groups of four hexadecimal digits separated by colons. To keep them readable, two shortcuts apply: leading zeros in a group can be dropped, and one run of all-zero groups can be collapsed to ::. So 2606:4700:4700:0000:0000:0000:0000:1111 becomes 2606:4700:4700::1111.

For ownership lookups, the important thing is that IPv6 blocks are allocated in huge prefixes — an ISP might receive a /32 (containing billions of addresses) and hand customers a /48 or /56. So when the IP WHOIS & ASN Lookup shows an IPv6 network range, don’t be alarmed by the astronomical size; it’s normal. The owning organisation, ASN, and abuse contact are identified exactly as they are for IPv4, so the investigative workflow doesn’t change — only the address format does.

There’s an important distinction between IP WHOIS and domain WHOIS when it comes to privacy. Domain WHOIS historically exposed the registrant’s name, email, and address — which, after GDPR and similar privacy laws, is now largely redacted for individuals. If you look up a domain in the WHOIS Lookup, you’ll typically see the registrar and dates but not personal contact details.

IP WHOIS is different: it describes the organisation that holds a network block, not a private individual, so this data remains public by design — it has to, because networks must be accountable and reachable for abuse handling. The abuse contact for a corporate or ISP block is a role address, not someone’s personal email. This is a sensible balance: you can always find and contact the responsible network, without exposing the private details of individual internet users. Using these tools for legitimate purposes — security, diagnostics, abuse response — keeps you firmly on the right side of that line.

Common Misconceptions

“The IP location is exactly where the user is.” No — geolocation is an estimate, often accurate only at country level. Always treat city-level claims with skepticism.
“WHOIS tells me the person’s name and address.” For IPs, it tells you the organisation that holds the block, typically an ISP or host — not an individual.
“One IP = one website.” Shared hosting and CDNs put many sites on one IP; that’s what reverse IP lookups reveal.
“Blocking one IP stops the attacker.” Determined attackers rotate IPs; blocking by ASN or using rate-limiting is often more effective.
“A datacenter IP means it’s malicious.” Not necessarily — lots of legitimate automation (monitoring, search crawlers, APIs) comes from datacenters. Context matters.

Frequently Asked Questions

Can I find the exact person who owns an IP address?

No. Public lookups reveal the organisation that owns the address block (usually an ISP or hosting company), not the individual using a specific address. Linking an IP to a person requires legal process.

What’s the difference between IP WHOIS and IP Lookup?

IP WHOIS shows the official registration (owner, network range, ASN, abuse contact) and is authoritative. IP Lookup shows estimated geolocation (country, city, ISP). Use IP WHOIS for “who” and IP Lookup for “where.”

What is an ASN and why should I care?

An Autonomous System Number identifies the network that announces an IP on the internet. It tells you which provider actually operates the address, and it lets you analyse or block entire networks rather than single IPs.

Look up the IP’s abuse contact with the IP WHOIS & ASN Lookup and email that address a clear, factual report with timestamps (in UTC), the targeted service, and relevant log excerpts.

Why does a reverse IP lookup show no results for some sites?

Sites behind CDNs like Cloudflare share the CDN’s IPs, so reverse lookups reflect the CDN rather than the origin server. Reverse-IP data is also sampled from public sources, so it’s a strong lead rather than a guaranteed complete list.

How often does IP ownership data change?

Registration details are generally stable for years, but they do change — when blocks are transferred, sold, or leased in the post-IPv4-exhaustion market, or when a company reorganises. The announcing ASN can change more frequently than the registration. That’s why, for current responsibility, the ASN shown by the IP WHOIS & ASN Lookup is often the most reliable indicator of who operates an address right now.

Is it legal to look up who owns an IP address?

Yes. IP registration data is published deliberately by the internet registries so networks can be contacted and held accountable. Looking it up for security, diagnostics, research, or abuse reporting is entirely legitimate. What matters is how you act on it — reporting abuse is fine; harassment or unauthorised intrusion is not.

Conclusion

Finding out who owns an IP address is not hacking or guesswork — it’s reading public registration data that the internet’s registries are required to publish. Separate the two questions in your mind: “where” (geolocation, an estimate) and “who” (registration, authoritative). Reach for the IP WHOIS & ASN Lookup to find the owning organisation, network range, ASN, and all-important abuse contact; the IP Lookup for a quick geographic estimate; and the Reverse IP Lookup to map the neighbourhood.

Whether you’re a developer debugging traffic, a security analyst investigating an attack, or a business owner screening suspicious activity, these three lookups turn a meaningless string of numbers into a clear picture of who’s on the other end — and what you can do about it.

Key Takeaways

“Where” and “who” are different questions. Geolocation is an estimate; registration is authoritative.
IP WHOIS (via RDAP) reveals the owning organisation — network range, CIDR, country, and the all-important abuse contact.
The ASN tells you who announces the IP today, which often matters more than who it’s registered to, especially with leased ranges.
Reverse IP lookups map the neighbourhood — other sites on the same server — but are blurred by CDNs.
You can’t identify an individual from public data — only the responsible network, which is exactly who to contact about abuse.
Combine the tools: geolocation + registration/ASN + anonymiser check + reverse IP gives a complete, reliable profile.

Written by PAYATE Team

The PAYATE team builds free tools for merchants and developers.