Technology · 7 November 2026 · 4 minute read
Reverse IP lookup explained simply
Reverse IP lookup means three different things. Here is what Whois, RDAP and PTR do, who maintains the registries and where the limits lie.
Anyone searching for „reverse IP lookup“ finds very different tools. That is because the term is not precisely defined. Depending on the provider and context, different queries are meant by it. Here we sort them out so that you know what you actually need.
Three meanings
| Meaning | Question | Method | Result |
|---|---|---|---|
| Looking up the network holder | Who owns the network with this address? | Whois or RDAP at the regional registries | Network name, country, holder, contacts |
| Finding domains on an address | Which websites run on this server? | Evaluation of DNS data, often from providers' collections | List of domain names |
| Host name for the address | What is the host behind the address called? | PTR query in DNS | A host name, if one is entered |
For company identification on your own website, the first meaning counts above all. The second answers a different question, namely which sites share a server. It says nothing about who a visitor is. The third supplements the first in special cases, see PTR record: how a host name turns into a company.
Who maintains the directories
IP addresses are administered worldwide by five regional registries. Each is responsible for one part of the world:
- RIPE NCC: Europe, the Middle East and parts of Central Asia
- ARIN: North America
- APNIC: Asia and the Pacific
- LACNIC: Latin America and the Caribbean
- AFRINIC: Africa
RIPE NCC is responsible for the DACH region. The registries know the address blocks they have allocated, and the entries for them. Anyone who sends a query to the wrong registry is usually forwarded to the right one.
RDAP instead of Whois
The old Whois is a text service with freely designed answers. Each registry formatted them a little differently. For programs this was laborious to evaluate. The successor is called RDAP, Registration Data Access Protocol. It brings three advantages:
- Uniform format: the answers are JSON, that is machine-readable. The query paths are defined in RFC 9082, the response structures in RFC 9083.
- Uniform addresses: a query is an ordinary web address following the pattern
/ip/<address>. - Redirection: a server that does not manage the address itself refers to the responsible registry. IANA maintains a list of the responsible servers.
For developers this means: you can query a registry and get a structured answer instead of running text. The registries' answers still differ somewhat in detail, so it is not entirely uniform. The IETF has published the technical foundations in the RFCs mentioned; the RIPE documentation on RDAP describes the implementation in Europe.
What is in an entry
A network entry typically contains the following fields:
- Address range: start and end of the network
- Network name: an abbreviation chosen by the holder
- Country: the country stated in the entry
- Type of allocation: for example a large allocation to a provider or an assignment to an end customer
- Holder: usually an organisation, sometimes only a description
- Contacts: points of contact for technical questions and abuse reports
- Remarks: free text maintained by the holder
The network name and description are free text. They are inconsistent and partly outdated. That is why every company identification works with rules that read and classify these fields, instead of a simple one-to-one match.
Limits
A registry entry says who owns a network. It does not say who is sitting at a device right now. Several limits follow from this:
- Network holder is not the same as device. Many people can be behind one address, for example in a mobile network.
- Provider networks. If the network belongs to an internet provider, the entry shows the provider and not the customer. Why this applies to home office and mobile is covered in Home office, VPN and mobile: whom you do not see.
- Sub-allocation. Providers pass on parts of their networks to customers. Whether this is recorded in the registry is up to the provider. If it is missing, the provider remains visible as the holder.
- Maintenance. Entries are maintained by people and can be outdated.
The consequences for the number of hits are described in Identification rate: why the figures vary so much. The whole process from query to company is shown in How does company identification work? The technology in 6 steps. What the classes in the report mean is explained in the help section under Visitor classes: company, internet provider, data centre.
Whether reverse IP lookup is the right route for you or a form is enough is compared in Which companies visit my website?.
For orientation on Whovisit: the query runs there via RDAP, after which the address is discarded.
