Technology · 7 November 2026 · 4 minute read
Who owns this IP address? How to find the holder
You can find the holder of an IP address free of charge in the network registry. A guide to Whois, RDAP and the RIPE database, with an example and the fields explained.
You see an IP address in a log, in an email or in a firewall and want to know who it belongs to. The answer is in a public registry. The lookup is free and takes a minute. However, it does not show which person is behind the address, but to whom the network is allocated. We explain this limit at the end.
Who maintains the registries
IP addresses are administered worldwide by five regional registries. Each keeps a public database:
| Registry | Responsible for |
|---|---|
| RIPE NCC | Europe, the Middle East, parts of Central Asia |
| ARIN | North America |
| APNIC | Asia and the Pacific |
| LACNIC | Latin America and the Caribbean |
| AFRINIC | Africa |
For addresses from Germany, Austria and Switzerland, RIPE NCC is almost always responsible. You do not need to know the registry, though: the tools below forward you automatically.
Three ways to run the query
1. In the browser via the RIPE database
Open the RIPE database query, enter the address and start the search. You receive the entry for the address range the address belongs to. If the address is not in the RIPE region, the page shows a pointer to the responsible registry.
2. With the whois command
On macOS and Linux the whois command is usually already available. In the terminal, this is enough:
whois 193.0.6.139The address in the example belongs to RIPE NCC itself. The output is plain text with fields such as inetnum, netname and org.
3. Via RDAP
RDAP is the successor to Whois. It provides the same information, but as structured data (JSON) that programs can read easily. The rdap.org service forwards you to the right registry:
curl -L https://rdap.org/ip/193.0.6.139For queries from your own software, RDAP is the better choice, because every registry delivers the same structure.
The most important fields
| Field | Meaning |
|---|---|
inetnum or inet6num | The address range the address belongs to |
netname | A short name for the network, assigned by the holder |
descr | Free description, often a company name or location |
org | Reference to the organisation that holds the network |
country | Country according to the entry, not necessarily the location of the device |
status | For example ALLOCATED PA (a provider's range) or ASSIGNED PA (assigned by the provider to a customer) |
abuse-c | Contact for reports of abuse, such as spam or attacks |
An entry with its own network name and a company as the organisation suggests that the company uses this network itself. If an internet provider is listed there, the address may belong to any customer of that provider.
What you will not find out
No individual. For private connections and most small companies, the internet provider is listed in the registry. Only the provider knows who had the address at a given time. It releases this only to authorities or on a court order.
No exact address. The country field describes the entry, not the location of the device. Services that show a city are estimating. More on this in IP tracking: what an IP address reveals about visitors.
Not always the current user. Data centres and cloud services lease addresses on. The registry then shows the operator of the data centre, not its customer.
If you need it more often
Individual manual lookups are no problem. Anyone who wants to classify many addresses every day, for example visits to a website, should cache results and observe the registries' usage rules. How visitor identification does exactly this automatically while discarding the address after the lookup is described in How does company identification work? The technology in 6 steps. A second lead is the host name of an address, see PTR record: how a host name turns into a company. The terms behind all this are sorted out in Reverse IP lookup explained simply.
Frequently asked questions
Is the lookup permitted? Yes. The registries are public precisely so that operators can find the right contact when there are problems.
Why does my own address show my internet provider? Because the network is allocated to the provider and it assigns you an address from it. Your name is not in the registry.
Is an IP address personal data? Often yes, even if you do not know the person yourself. The assessment is in IP address and GDPR: is it personal data?.
