The internet feels like one seamless thing, but it isn't. It's more like a hundred thousand separate networks that have agreed to pass traffic to each other. Each of those networks belongs to someone — an ISP, a telecom, a cloud provider, a university, a company — and each announces its slice of address space to the rest of the world using BGP, the routing protocol that stitches everything together. So every IP address has an owner and a route, whether or not you ever think about it.
You start caring the moment something goes wrong. A stream of failed SSH logins. A checkout that smells like fraud. An outage you can't explain. In each case the thing you have is an IP address, and the thing you want is context: who runs this network, which country it's registered in, and how it reaches the rest of the internet. That's what an IP ownership / ASN lookup is for — turning a bare number into a network you can name.
How IP addresses get handed out
Address space isn't assigned at random. It flows down a hierarchy. At the top sits IANA, which carves the global pool into large blocks and delegates them to five Regional Internet Registries (RIRs), each covering part of the planet:
| RIR | Region |
|---|---|
| ARIN | North America |
| RIPE NCC | Europe, Middle East, Central Asia |
| APNIC | Asia-Pacific |
| LACNIC | Latin America and the Caribbean |
| AFRINIC | Africa |
The RIR is where an allocation is actually recorded. When you see that a block belongs to RIPE NCC, you're really seeing which registry holds the paperwork — and, usefully, where to go next if you need to contact whoever runs it.
A quick note on the names, since the raw data is full of them: RIPE stands for Réseaux IP Européens. If a lookup ever hands you something like "Réseaux," that's a character-encoding glitch, not a second registry.
Autonomous Systems and their numbers
Owning a big chunk of addresses isn't enough on its own — you also need a way to announce it. That's where an Autonomous System comes in. An AS is a network under a single administrative control, and its RIR assigns it an Autonomous System Number: a unique 16- or 32-bit integer that identifies it on the BGP map.
You'll recognize a few by sight once you start looking. AS13335 is Cloudflare. AS16509 is Amazon. AS15169 is Google. When one of those networks announces a prefix — say 104.16.0.0/12 — every other router on the internet learns that traffic for those addresses should head toward that AS. The ASN, in other words, is the answer to "whose network is this address actually living on right now."
Why any of this is worth your time
Incident response. When a SOC analyst pulls a source IP off an attack, ownership is the first cut. A residential ISP behind the address suggests a compromised home machine in a botnet. A commercial VPN or a hosting provider that keeps showing up in abuse reports tells a different story. Same IP, very different response.
Shutting the attack down for good. Blocking an IP at your firewall buys you an afternoon. Stopping the source means reaching the operator that runs the network. Once the lookup tells you the RIR and the network, you can look up that network's abuse contact at the RIR or via RDAP and file a report there — that's the follow-up step, not something the ownership record hands you directly.
Fraud checks. Risk engines lean on ownership constantly. A card transaction that claims to originate in New York but resolves to a data-center host on another continent is worth a second look before it clears.
Compliance and routing. If your data is supposed to stay in Europe, confirming that a block is registered under RIPE NCC is a concrete way to back that up. And knowing the origin AS of a prefix helps when you're writing or auditing BGP filters.
What the ServerRecords lookup actually returns
Feed the tool an IPv4 or IPv6 address and it queries routing and registry data to build a short profile. Here's the honest list of what comes back:
- ASN and AS name — the number and the registered network name, e.g.
AS15169Google LLC. - Announced CIDR prefix — the block that's actually being advertised, like
172.217.0.0/16, so you know the range around the address if you need to filter it. - Regional Internet Registry — which of the five holds the registration.
- Allocation / organization name — the org the block is registered to (DigitalOcean, Comcast, Hetzner, and so on).
- Registry country — the country on the allocation record.
A worked example: 104.16.123.96 comes back as AS13335 (CLOUDFLARENET), prefix 104.16.0.0/12, RIR ARIN, org Cloudflare, Inc.
Two things it deliberately does not do, so you don't over-read the output. It does not hand you an abuse contact email — for that you take the RIR and network it gives you and query RDAP or the registry's WHOIS. And the country is the registry country, the jurisdiction the allocation was filed under. It is not city-level geolocation, and it won't always match where a given host physically sits, since large networks register a block in one place and light it up across many.
Where to go next
Ownership is usually the first question, not the last. A couple of neighboring lookups pick up where it leaves off:
- Want the registration record in full, including contacts and dates? Run a WHOIS lookup on the address or the org.
- Trying to judge whether an IP is trouble? A blacklist lookup tells you if it's already sitting on a DNSBL.
- Checking whether a host is who it claims to be? A PTR record lookup shows the reverse-DNS name on file for the address.
Start with ownership to learn whose network you're dealing with, then reach for whichever of those answers the specific question in front of you. A number becomes a network, and a network is something you can act on.