IP Address to Company: How a Lookup Works (Worked Example)

Turning an IP address into a company name sounds like magic, but the core of it is a public lookup anyone can run. This article walks through the "ip address to company" process step by step on a real UK registry record, shows where the method goes wrong, and explains why serious tools score a match instead of simply asserting it.

What happens in the first millisecond?

When someone loads a page, their browser opens a connection to your web server. To send the page back, the server has to know where to send it, so every request arrives with the visitor's public IP address.

That is all you know at this point: a number such as 194.66.0.1. No name, no email, no employer. Everything else in visitor identification is an attempt to answer one question: who is responsible for the network this number belongs to?

Who says which organisation owns an IP range?

The regional internet registries. There are five of them worldwide, and they "manage, distribute, and register Internet number resources (IPv4 and IPv6 address space and Autonomous System (AS) Numbers) within their respective regions."¹ For the UK the registry is RIPE NCC, which serves "Europe, the Middle East and parts of Central Asia".¹

RIPE NCC runs the RIPE Database, which "contains registration information for networks in the RIPE NCC service region and related contact details."² It also publishes routing information, through the RIPE Internet Routing Registry, and supports reverse DNS delegation.² The database is public and has a REST interface, so you can query it from a browser or a terminal.

Two kinds of record matter for us:

• inetnum objects record who a block of IPv4 addresses was allocated or assigned to.
• route objects record which network (identified by an autonomous system number, or ASN) announces a block to the rest of the internet.

Worked example: what does the registry say about 194.66.0.1?

We queried the RIPE Database for 194.66.0.1 on 27 September 2026.³ Registry records change, so if you repeat this later you may see different results. The query returned three relevant layers.

The most specific assignment (inetnum):

inetnum:  194.66.0.0 - 194.66.0.255
netname:  NERC-BAS
descr:    Natural Environment Research Council
country:  GB
status:   ASSIGNED PA
mnt-by:   JANET-HOSTMASTER

The wider allocation it sits inside (inetnum):

inetnum:  194.66.0.0 - 194.66.255.255
netname:  UK-JANET-940418
org:      ORG-UA23-RIPE   (Jisc Services Limited, an LIR)
status:   ALLOCATED PA

The route that carries it (route):

route:    194.66.0.0/16
descr:    JANET
origin:   AS786

RIPE's statistics service, RIPEstat, confirms the routing view: the address is not announced on its own, so it aligns the query to the covering 194.66.0.0/16, announced by AS786 with the holder "JANET - Jisc Services Limited".⁴

The query also returns a contact object (a "role") for the people who administer the network. Those contacts exist so that network operators can coordinate with each other.² They are not a sales contact list, and they tell you nothing about who visited.

So which organisation "owns" 194.66.0.1? There are two plausible answers:

The routing and allocation records name the network operator: Jisc, which holds AS786 and the wider allocation. The assignment record names the body the /24 block was actually assigned to: the Natural Environment Research Council. The more specific record is the better answer. A tool that stopped at the ASN would report "Jisc" for a visit that came from a NERC network.

A third, independent signal agrees. The reverse DNS name for 194.66.0.1 is magica.nerc-bas.ac.uk,⁵ a hostname under a NERC domain.

What is an ASN and why does it matter?

An autonomous system number identifies a network that announces blocks of addresses to the rest of the internet. Services such as Team Cymru's IP to ASN mapping will "map any IP address to its BGP prefix, origin ASN, and registry record", returning the origin ASN, prefix, country, registry, allocation date and AS description.⁶

The ASN is fast to look up and very useful as a classification signal:

• A corporate ASN, where a company runs its own network, is a strong sign that a visit came from that company.
• An ISP, mobile or cloud ASN is a warning. The address belongs to the provider, and the visitor could work anywhere.

What the ASN cannot do on its own is name the right customer when a provider has sub-assigned part of its space, as the worked example shows.

Scout uses this kind of network classification in its confidence score: a corporate network adds to the score, while ISP, residential, mobile, VPN and data-centre networks reduce it sharply and can never score above the low band.

Where does it break?

The worked example is a tidy case: a public body, a clear assignment and a matching hostname. Real traffic is messier.

• Assignments often stop at the provider. Unless a provider registers a separate assignment for its customer, the most specific record simply names the provider.
• Blocks get sub-let and resold. The organisation in the record may have passed the addresses on without updating the registry.
• Records go stale. The NERC assignment above was created in 2001 and last modified in 2018.³ Companies move offices, merge and change providers faster than registry records change.
• Reverse DNS is optional. A PTR record is a recommendation, not a requirement, and "not all IP addresses have a reverse entry."⁷
• Shared addresses hide many organisations. With carrier-grade NAT, "a single public IP address is shared between multiple customer's routers", and the technique is "most widely used on mobile phone networks".⁸ Home broadband, mobile, VPN and public Wi-Fi addresses resolve to the provider, never the employer. We cover that in why internet providers show up as website visitors.

How do commercial tools go beyond WHOIS?

A registry lookup gives you a candidate. A commercial tool tries to decide whether the candidate is right. The usual ingredients are:

1. Registry data at every level, preferring the most specific record.
2. Reverse DNS as a second opinion where it exists.
3. Network classification: corporate, ISP, mobile, VPN, cloud or bot.
4. Observed behaviour: how many pages, which pages, return visits.
5. First-party signals. In Scout's case, Google Analytics 4 session depth and the Google Search Console queries associated with each company.

The output should be a score and a reason, not a bare name. Scout gives every identified company a confidence score from 1 to 99, a band (high, medium or low) and a one-line reason, because an IP match is an inference. For a fuller introduction, see the guide to website visitor identification.

Do it yourself: the lookup in four commands

You can reproduce the worked example from any terminal with curl. These are the queries used for this article.

# 1. Every registry object covering the address, including the parent allocation
curl -s -H 'Accept: application/json' \
  'https://rest.db.ripe.net/search?query-string=194.66.0.1&flags=L&type-filter=inetnum'

# 2. The assignment plus its route object
curl -s -H 'Accept: application/json' \
  'https://rest.db.ripe.net/search?query-string=194.66.0.1'

# 3. Which ASN announces it, and who holds that ASN
curl -s 'https://stat.ripe.net/data/prefix-overview/data.json?resource=194.66.0.1'

# 4. The reverse DNS name
curl -s 'https://stat.ripe.net/data/reverse-dns-ip/data.json?resource=194.66.0.1'

Swap in an address from your own server logs to see how often the answer is a provider rather than an organisation. Only look up addresses you have a legitimate reason to process: the ICO lists IP addresses among the online identifiers that can make information personal data,⁹ a point covered in our guide to visitor identification and UK GDPR.

Scout runs this process for every visit, adds network classification and your GA4 and Search Console signals, then tells you how sure it is. Start a 14-day free trial with no card, or see plans by identified visits per month.

Frequently asked questions

Can an IP address be traced to a person?

Not from public registry data. Registry records name the organisation responsible for a network, and most home and mobile addresses resolve only to the provider. The ICO lists IP addresses among the online identifiers that can be personal data, so treat them with care; this is general information, not legal advice.

Is reverse IP lookup legal?

Querying public registries such as the RIPE Database is a normal, published service. What matters under UK data protection law is what you do with the addresses you collect and why. Our guide to visitor identification and UK GDPR covers this; it is general information, not legal advice.

Why does the same IP show two companies?

Because different records describe different layers. The route and ASN name the network that carries the traffic, often a provider, while a more specific assignment can name the customer using that block. The more specific record is usually the better answer.

What is the difference between WHOIS and an ASN lookup?

A WHOIS or registry query returns the registration records for an address block, such as who it was allocated or assigned to. An ASN lookup tells you which network announces the block on the internet. The first is better for naming an organisation; the second is better for classifying the type of network.

Sources

1. Number Resource Organization: Regional Internet Registries nro.net
2. RIPE NCC: RIPE Database ripe.net
3. RIPE Database REST API: search for 194.66.0.1 (queried 27 September 2026) rest.db.ripe.net
4. RIPEstat: prefix overview for 194.66.0.1 stat.ripe.net
5. RIPEstat: reverse DNS for 194.66.0.1 stat.ripe.net
6. Team Cymru: IP to ASN mapping team-cymru.com
7. Wikipedia: Reverse DNS lookup en.wikipedia.org
8. DrayTek: What is Carrier Grade NAT (CGNAT)? draytek.co.uk
9. ICO: What are identifiers and related factors? ico.org.uk