How to Find Which Company Owns an IP Address or Range

An IP's owner is usually answered by two lookups: the network that announces it (its ASN) and the organization its address block is registered to. Paste a list into the bulk IP to ASN lookup: each row shows the ASN, the network's registered name (such as GOOGLE or AMAZON-02), the routed prefix and the regional registry. Domains work too; each is resolved to an IP first.

Look up who owns a list of IPs →

Look them up in bulk

1. Open the bulk IP to ASN lookup.
2. Paste IP addresses or domains, one per line: up to 100 a run, or 500 after a free Google sign-in.
3. Press Look up networks.
4. Read each row: the IP, the ASN, the network name, the routed prefix, the registry and the country the registry lists for the network.
5. Filter by network to see how many of your IPs sit on the same provider, and download the CSV.

Do it by hand

Team Cymru's IP to ASN service answers over DNS. Reverse the IP's four parts and ask for a TXT record:

dig +short txt 3.112.82.140.origin.asn.cymru.com
# "36459 | 140.82.112.0/20 | US | arin | 2018-04-25"
# "36459 | 140.82.112.0/24 | US | arin | 2018-04-25"

dig +short txt AS36459.asn.cymru.com
# "36459 | US | arin | 2018-04-25 | GITHUB - GitHub, Inc., US"

whois -h whois.cymru.com " -v 104.16.132.229"
# AS      | IP               | BGP Prefix          | CC | Registry | Allocated  | AS Name
# 13335   | 104.16.132.229   | 104.16.128.0/20     | US | arin     | 2014-03-28 | CLOUDFLARENET - Cloudflare, Inc., US

For the registered range and organization, use RDAP, the JSON successor to whois. rdap.org redirects to the right registry:

curl -sL https://rdap.org/ip/140.82.112.3 | jq -c '{name, handle, startAddress, endAddress}'
# {"name":"GITHU","handle":"NET-140-82-112-0-1","startAddress":"140.82.112.0","endAddress":"140.82.127.255"}

We ran these on 9 November 2026. The first answer lists two prefixes because GitHub announces both the /20 and a more specific /24 inside it. RDAP shows the registered block, 140.82.112.0 to 140.82.127.255, and ARIN's full answer names the organization as GitHub, Inc.

Team Cymru asks that you use DNS or its bulk whois mode for volume, and says IPs sending large numbers of single whois queries get null-routed. Its page recommends GNU netcat for bulk mode.

How to read the answer

• The ASN is the network, not always the user. 104.16.132.229 belongs to Cloudflare because Cloudflare serves the site, not because Cloudflare is the business behind it. Same for AWS, Google Cloud and other hosts.
• The country is registry data. Team Cymru's page says country codes "often differ significantly from where an IP is actually used" and that the service shouldn't be used for geolocation.
• No ASN means no network currently announces the address: unused space, a range being moved, or a private address.

To see the hostname each IP's owner published, run the bulk reverse DNS lookup on the same list. To name the platform behind a website (Shopify, Vercel, Wix), see find which company hosts a website.

Next step: check the addresses behind the domains

Knowing a domain's network doesn't tell you whether the email address you have on it works. Upload the list at /verify to check every mailbox without sending. The first 100 checks are free with a Google sign-in, no card.

Pro, $39 a month: Unlimited email verification.* Never metered, never cut off. See pricing.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.

More: find who owns the IPs in a bounce or email header, bulk DNS lookup for a list of domains.