Who Owns an IP Address? How to Check with WHOIS and RDAP
A provider offers you a /24 IPv4 block. The message says it is "clean, ready to route, and fully verified."
Artem Kohanevich
Co-Founder & CEO at IPbnb
Last updated
Table of Contents
item
You run an IP WHOIS lookup. One company name appears. You check BGP and see a different ASN announcing the prefix. The quote came from a third company.
Is the offer fake?
Not necessarily. One organization may be the registered holder, another may operate the origin ASN, and a third may be an authorized broker. That setup can be legitimate. But until the three roles make sense together, you should not sign or announce anything.
The question "who owns an IP address" has no single answer. It has five, and they live in five different databases.
Who Owns an IP Address? The Short Answer
For a public IP address, WHOIS or RDAP can usually show the organization registered for the block that contains it. People call that organization the IP address owner. The accurate term is the registered holder.
That record does not necessarily identify the person using the address, the ASN announcing the route, the server's physical location, the company offering the block for lease, or a universally recognized legal property owner.
IP addresses are distributed through a hierarchy. IANA distributed large ranges to five Regional Internet Registries until the global IPv4 free pool ran out in 2011. The RIRs register resources to ISPs, operators, and other organizations under regional policy, and today work almost entirely from recovered space and transfers. The five are ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC. The authoritative registry depends on the address range, not on where you run the lookup.
One IP address, five different questions
What you want to know | Where to look | What the result means |
|---|---|---|
Who is registered for the block? | RDAP or RIR WHOIS | The owner or responsible organization in the registry |
Who is announcing the prefix now? | BGP data, such as RIPEstat | The current origin ASN seen by route collectors |
Is that origin authorized? | RPKI and, secondarily, IRR | Whether the origin matches a published ROA |
Where is the IP used? | Geolocation databases | An estimate, not an exact address |
Does the IP have abuse history? | Reputation and blocklist services | Current, provider-specific risk signals |
No single database answers all five. That is the most important idea in this guide.
RDAP vs WHOIS
Both expose registration data. RDAP is the better starting point because its queries and responses are standardized: RFC 9082 defines how you ask, RFC 9083 defines the JSON you get back, and RFC 9224 handles bootstrapping to the right registry. WHOIS returns plain text that varies between registries and needs custom parsing for each one.
Neither makes the underlying record accurate. A stale company name in WHOIS is just as stale in RDAP, because both depend on registry data maintained by resource holders.
You may have read that WHOIS was retired in 2025. That applied to generic top-level domain names. RDAP became the definitive source for gTLD registration data on 28 January 2025, and adoption moved fast: 374 gTLDs had switched WHOIS off by September 2025, RDAP query volume overtook WHOIS in June 2025, and in January 2026 ICANN revoked a registrar's accreditation for failing to implement RDAP. Most country-code TLDs still run WHOIS.
None of that touched the RIR WHOIS services used for IP and ASN records. For IP resources, both remain in active use in 2026.
How to Find the Owner of an IP Address
1. Start with the full CIDR block
For a lease, ask for the complete prefix in CIDR notation, such as 198.51.100.0/24, and check the range as a whole. That example comes from a block reserved for documentation - do not use it as a real routing target.
Private ranges are different. 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are reused inside private networks. There is no unique global owner for an address like 192.168.1.10.
2. Run an RDAP lookup
The IANA RDAP bootstrap registry maps ranges to the correct RIR, and a global client follows it automatically. You can also go direct:
Region | Registry | Lookup |
|---|---|---|
North America and parts of the Caribbean | ARIN | ARIN RDAP Search |
Europe, Middle East, parts of Central Asia | RIPE NCC | RIPE Database Search |
Asia Pacific | APNIC | APNIC Whois Search |
Latin America and much of the Caribbean | LACNIC | LACNIC RDAP Client |
Africa and part of the Indian Ocean region | AFRINIC | AFRINIC RDAP - check operational status first (see below) |
If you are automating, RDAP supports a standard path such as /ip/198.51.100.10. A correct client follows bootstrap data instead of assuming every address belongs to ARIN or RIPE NCC.
3. Three commands that answer most of it
Command 1 tells you what the registry says. Command 3 tells you what the internet says. Any gap between them is your first due-diligence question.
Save the raw JSON, not a screenshot. Both datasets change, and a timestamped response is evidence a counterparty cannot dispute later.
4. Read the record as a set of clues
Field | What to check | Common mistake |
|---|---|---|
Start/end address, or CIDR | Does the record contain the full offered prefix? | Checking one IP and assuming the whole range matches |
Name, handle, or netname | Which registry object identifies the subnet? | Treating a netname as a verified company name |
Entity and roles | Which organization and contacts are attached? | Assuming every contact is authorized to lease it |
Status or type | Allocation, assignment, legacy, or other? | Applying one RIR's terminology to every registry |
Parent handle | Is this a more-specific under a larger allocation? | Stopping at the parent ISP when a customer record exists |
Events or changed date | When was the record last updated? | Reading a recent timestamp as proof everything was reverified |
RDAP returns the most specific network object for an IP query. Review the parent and related entities when the commercial relationship is unclear, and make sure your evidence points back to an authoritative RIR response rather than an aggregator that copied it.
What a Lookup Cannot Tell You
It usually cannot identify the end user. The record may name an ISP, hosting company, or enterprise. It will not reveal which subscriber or virtual server used one address at a given moment. That mapping lives in the operator's private logs.
It does not prove physical location. A country field describes a registration or administrative location. Geolocation providers estimate where addresses are used. Neither is a street address, and the two may legitimately disagree.
It does not prove the lessor is authorized. The company in your contract may be a broker, platform, or subsidiary. That can be fine - it just means another link in the chain needs documenting.
It does not show whether the block is clean. WHOIS and RDAP are registration services, not reputation databases.
It does not tell you whether the registry can act
A lookup shows what is recorded today. It does not show whether the registry maintaining that record is in a position to change it.
That became practical rather than theoretical in the AFRINIC service region. The board was dissolved and AFRINIC placed under receivership in 2022-2023, and during the period without an operational board, address requests stalled for months. A board was seated after the 2025 elections and the Receiver applied to terminate the receivership in October 2025 - but litigation begun before and after those elections is still running, the June 2025 election was annulled and re-run under different rules, and a new CEO does not take office until January 2027.
For a lease, these are timing questions. How long does a registry update take right now? Can the holder execute a change during the lease term? Is there pending litigation affecting the resource? Ask explicitly for the RIR your prefix sits in, and get it in writing.
Registry conditions are not a permanent property of a region. Policy varies too - our guide to RIPE NCC membership covers what one registry actually requires, and the 24-month hold period explains a rule that can block a transfer you assumed was available.
Why the Owner and Origin ASN May Differ
RDAP tells you who is registered. BGP tells you which Autonomous System is announcing the prefix. Different roles.
A mismatch is legitimate when the block is already leased, the owner uses transit or managed BGP, a cloud platform announces the range through BYOIP, a parent company holds what a subsidiary operates, or routing is mid-transition. Which of those applies depends on the announcement path - our comparison of four routing paths for leased IPv4 covers the ROA rules for each, and what IP transit is explains the upstream relationship behind most of them.
It can also expose a stale route, an unauthorized announcement, or a hijack. The mismatch is not a verdict. It is a question that needs an answer. Forged paperwork on dormant space is a live problem - see how legacy IPv4 hijacking works in practice, from Whois capture to fake LOAs.
Use RIPEstat or another BGP source to check current origin and history. A prefix that looks quiet today may have been announced from unrelated networks last month.
Then check RPKI. A Route Origin Authorization states which ASN may originate a prefix and how specific the announcement may be. Valid means prefix and origin are covered by a matching ROA. Invalid means a ROA exists but the ASN or prefix length does not match. NotFound means no covering ROA.
A valid route is a strong signal, but know what it buys you. In June 2026, RPKI coverage hit a record 67.43% of announced prefixes - roughly 1.07 million of 1.58 million routes carried a signed ROA. Enforcement lags: measurement work cited by RIPE Labs puts full route origin validation at around 12% of ASes, with roughly 36% not validating at all. A ROA protects your prefix only to the extent that networks between you and an attacker actually drop invalids.
Validity also does not prove that the company emailing you is the owner, or that the addresses have good reputation.
How to Verify a Block Before Leasing
Verify the exact resource. Get the full CIDR, RIR, proposed origin ASN, lease term, and activation date. Contract, LOA, route object, and ROA plan must all name the same prefix. Be wary of a seller who describes only sample IPs - status varies across adjacent ranges.
Match the counterparty to the registered holder. If they match, confirm the signer can bind the organization. If they do not, get the relationship in writing and verify that authority independently - a known corporate contact or registry-published contact, not just a PDF from the agent. Old names are not automatically fraud; legacy space, mergers, and reorganizations leave historical names behind. But succession must be documented.
Confirm operational control. A legitimate lessor can issue a prefix-specific LOA, create or update the ROA for the agreed ASN, handle the IRR route object, coordinate reverse DNS, and withdraw old routing authorization before activation. The LOA alone is not proof - it can be forged. Match its signer, prefix, ASN, purpose, and validity period against independently verified information.
Review routing history. Record current and previous origins, first and last seen dates, and unusually specific announcements. Ask the provider to explain recent changes. The safe activation sequence is: old announcement withdrawn, ROA and IRR updated, new announcement started, propagation monitored. If the destination is a cloud platform, the provider's own process applies - the AWS BYOIP guide shows what that looks like end to end.
Check reputation for your actual use case. Do not ask "is this IP clean?" Ask "is this prefix acceptable for the systems we plan to run?"
There is a reason this is not optional for traded space. A study of RIR transfer reports from 2009 to 2019 found that almost 40% of routed transferred prefixes carried at least one blacklist report, against about 6% of routed prefixes never transferred. Space that has changed hands is not automatically dirty, but it is a different risk class.
Check | What it reveals | How to read it |
|---|---|---|
Spamhaus IP and Domain Reputation Checker | Listings across SBL, CSS, XBL, PBL, DBL | Identify the exact list. A PBL policy listing is not an abuse listing |
AbuseIPDB | Community reports and confidence score | Weigh report age, categories, volume, source diversity. Crowdsourced signal, not verdict |
Cisco Talos Intelligence | IP, domain, and network reputation | Compare against other providers and your intended workload |
BGP history | Previous origins, gaps, route changes | Unexplained churn is a reason to investigate, not to disqualify |
Scan the whole prefix where the service permits. One clean address in a /24 does not clear the other 255. And distinguish active problems from historical ones - old reports may no longer affect delivery, while an empty report page may mean limited visibility rather than cleanliness.
Write the result into the lease. Identify the prefix, parties, permitted and prohibited uses, origin ASN, authorization method, activation date, abuse process, remediation deadlines, monitoring, suspension rights, and end-of-lease withdrawal. If reputation matters commercially, define an acceptance window and name the sources you will check. "Clean IPs" is too vague for a contract.
A Fast Decision Table
Signal | Green | Yellow | Red |
|---|---|---|---|
Registry holder | Contracting party matches the owner | Agent, old name, or parent company with documented relationship | No credible connection to the owner |
Routing | Current and historical origins explained | Recent changes with evidence and a transition plan | Unexplained origin or conflicting live announcements |
RPKI and IRR | Correct updates ready for activation | Missing ROA with a documented creation plan | Authorization conflicts and nobody will fix them |
Reputation | No material current findings for the intended use | Limited or historical findings with a remediation plan | Active severe listings, repeated recent abuse, or concealment |
Documents | Prefix-specific contract and independently verified LOA | Minor inconsistencies being corrected before payment | Generic LOA, mismatched prefix or ASN, unverifiable signer |
Provider behavior | Transparent evidence and a named escalation path | Slow or incomplete answers | Pressure to pay before basic verification |
A yellow result is not a failed deal. It means the open question gets resolved before activation, and before funds become non-refundable.
From Ownership Check to Leasing Safety
Confirming the registered holder tells you who may authorize the lease. It does not tell you how control is protected once the new ASN starts announcing.
In a typical routed lease the holder stays the same while another ASN gets limited authority to announce the subnet. How that appears in the registry varies - depending on the RIR and structure, a lease may be recorded as an assignment, allocation, or sub-allocation, and in RIPE NCC systems it can also be registered as a temporary transfer. Each delegates a different amount of responsibility. A formal temporary transfer under RIR policy is a different structure from an ordinary routed lease and should be documented as such. If you are still weighing the structure itself, buy vs lease covers that decision, and the pricing calculator covers the numbers.
FAQ
Can I find a person's name from an IP address?
Usually not. WHOIS and RDAP identify the organization registered for the containing block, such as an ISP or hosting provider. The provider may hold private logs linking an IP to a customer at a given time, but that is not public registry data.
Is WHOIS still available for IP addresses in 2026?
Yes. RIR WHOIS services for IP addresses and ASNs remain available, and most RIRs run RDAP alongside them. The January 2025 transition that made RDAP definitive concerned gTLD domain names, not IP resource lookups.
Who owns a private IP address such as 192.168.1.1?
No organization owns it uniquely on the public internet. Private ranges are designed for reuse inside many separate networks and are not globally routed.
Does an IP WHOIS lookup show the address's location?
Not reliably. A registry country field may describe an administrative location. Commercial geolocation databases estimate where an address is used, but neither identifies a precise physical address or person.
Why does the ASN name differ from the WHOIS organization?
The registered holder and routing operator can be different - leasing, transit, managed BGP, BYOIP, and corporate group structures all produce this. Not automatically suspicious, but it should match the documents.
Does it matter which RIR the block belongs to?
Yes, twice over. Transfer and lease policies differ between registries, so the same arrangement may be documented differently in ARIN and RIPE NCC records. And operating conditions differ - governance disputes or litigation can slow or block updates in a region. Ask which RIR holds the resource and what a change currently takes there.
The Bottom Line
To find out who owns an IP address, start with authoritative RDAP or RIR WHOIS. Read the result as the registered holder of the containing block - not the current user, the exact location, the routing operator, or final proof of legal authority.
Before leasing, connect that record to the counterparty, verify routing control through BGP and RPKI, confirm the registry can actually execute changes, and check reputation across multiple sources. A good deal is not a clean lookup. It is a consistent chain of evidence from registry record to contract to route.
IPbnb combines identity and block verification with routing authorization and ongoing monitoring. Review the process on Trust and Compliance, or explore IPv4 blocks available for lease.
