How Does an IP to Company Lookup Actually Work?

An IP to company lookup tells you which organization registered or routes a block of IP addresses. It does not tell you who is behind the connection. When a visitor browses from their employer's office network, those two answers match. When they work from home, they almost never do.

Behind every result sit up to three records, and each answers "who owns this IP" differently: the network that carries the traffic, the organization a regional registry gave the address block to, and the customer that organization says it passed the block on to. A visitor report that names a company has picked one of those three.

TL;DR

• An IP to company lookup returns the registered holder of an IP range, built from registry (WHOIS) records, provider reassignment filings, and internet routing data.
• It names a visitor's employer only when that employer holds its own registered IP block and the visitor is on that network.
• Home broadband, cloud servers, VPNs, and Apple's Private Relay resolve to the provider (Comcast, AWS, a VPN host, Akamai), not the visitor's company.
• In June 2026, 52.5% of US workers in financial activities and 47.2% in the information sector teleworked. Those are core B2B buyers, and their home visits show up as an ISP.
• Treat business, education, and government results as candidate organization-level matches. Corroborate them with the record age, network context, your target-account list, and first-party activity before triggering an alert or personalization. Treat ISP and hosting results as unidentified. IP to company data works as an account-level signal for office traffic and fails quietly for everything else. The fix is not a better vendor. It is filtering on the company type field before a match reaches a sales alert or an account report.

What an IP to company lookup actually returns

Ask "who owns this IP?" and the internet has three different answers on file.

The network operator announces the address block to the rest of the internet and carries its traffic. It is identified by an autonomous system number (ASN). The registry holder is the organization one of the five regional internet registries allocated the block to. The customer on record is whoever that holder later reassigned a smaller slice to, if it bothered to file the paperwork.

Visitor identification tools usually call this "reverse IP lookup," and under the hood they are reading the same records. A good IP to company lookup returns at least two of these side by side, plus a type label. Here is what five real addresses returned on October 19, 2026:

None of the five rows identifies a person or proves buying intent. Apple is the cleanest organization-level match because Apple owns the address space, but it still needs first-party context before it becomes a sales signal.

How an IP address gets matched to a company

Registry records: who was given the block

Every public IP address traces back to one of five regional internet registries: ARIN (North America), RIPE NCC (Europe and the Middle East), APNIC (Asia-Pacific), LACNIC (Latin America), and AFRINIC (Africa). Each publishes who holds which block through WHOIS and its structured successor RDAP, which returns the same registration data as JSON (RFC 9083 defines the format).

Blocks are big. The Comcast address above sits inside Comcast's parent 73.0.0.0/8 allocation, but a more-specific 73.162.0.0/16 reassignment exists for Comcast IP Services. Both layers still name Comcast-related entities, not the household or person using the address this afternoon. The registry tracks responsibility and delegation of the space, not the current subscriber.

Reassignment filings: the only place a customer's name appears

When an ISP or hosting provider hands part of its space to a business customer, it can file a reassignment record with the registry. In ARIN's region this is a SWIP or RWHOIS entry, and it is the only step in the whole chain where a customer's company name enters the data.

The rule is narrower than most people assume. ARIN policy 2018-6, implemented in March 2020, requires registration for reassignments of a /29 or larger, meaning eight or more addresses. A provider is not required by that rule to publish a customer-specific reassignment for one to seven static IPs, so a small office may still appear only under the provider's name.

Providers also file reassignments to themselves. ARIN's record for the Comcast address above shows the /16 slice it sits in reassigned to "Comcast IP Services, L.L.C." inside a larger block held by "Comcast Cable Communications, LLC." That filing is where "Comcast IP Services" in the table's company column comes from, and it is why neither column names a customer.

Routing data: who actually carries the traffic

Separately from the registry, every routed block is announced by an ASN. Mapping an ASN back to an organization is its own inference problem. CAIDA's AS-to-organization dataset, a standard reference in network research, rebuilds that mapping from quarterly WHOIS dumps of all five registries plus the Japanese and Korean national registries.

ASN data is reliable for one question: what kind of network is this? A hosting ASN, an ISP ASN, and a business ASN behave differently, which is why the type label matters more than the name. (If you want the field-level detail, I covered classifying an IP by ASN type separately.)

Enrichment: name, domain, and type

Raw registry text reads like CHINANET FUJIAN PROVINCE NETWORK or POMONA-GW-DTI-NET. Data providers clean that into a company name, attach a website domain, and assign a type: ISP, hosting, business, education, or government. That type label is the field marketers should look at first and usually look at last.

Why the company and the network owner disagree

The fifth row in the table is the most useful one to pick apart.

The address 209.73.4.40 is routed by RapidScale (AS63182). ARIN's registration record for the block shows a /28, 16 addresses, reassigned on August 14, 1998 by Logicworks to a customer called Pomona Management Co., with the record last changed in May 2010. The provider contact on file lists a RapidScale email address next to the old Logicworks one, and ARIN notes it has had no response from that contact since March 2026.

So the block is now routed by a different company than the one that filed it, the contact went quiet, and the customer name stayed exactly where it was for 28 years. A visitor report would still say "Pomona Management" with full confidence. It might even be right. Nothing in the data can tell you.

The Amazon row shows a milder version: the network is "Amazon.com, Inc." and the block is registered to "Amazon Technologies Inc." Same corporate family, different legal entity at each layer. Neither tells you which AWS customer's server made the request.

This is also the plain-English answer to "ISP vs ASN vs company." The ISP is who sells the connection. The ASN is who routes the traffic. The company on record is whoever the registry paperwork names for that specific block. For a home user, all three are the ISP. For an enterprise on its own network, all three can be the enterprise. Everywhere in between, they drift apart.

Where IP to company attribution breaks

Remote workers on home internet

This is the big one for B2B. According to the Bureau of Labor Statistics, 52.5% of workers in financial activities teleworked in June 2026, along with 47.2% in information and 41.8% in professional and business services. Banks, insurers, software companies, agencies, and consultancies are exactly the accounts B2B teams put on target lists.

When those people visit your pricing page from home, the lookup returns Comcast, Spectrum, or Verizon. On mobile and on some broadband networks it is worse, because carrier-grade NAT puts many subscribers behind one shared public address (why CGNAT breaks IP geolocation covers the mechanics). Their visits aren't misattributed. They are simply not attributable.

Cloud servers and shared hosting

A match on AWS, Google Cloud, Azure, DigitalOcean, or another hosting provider means the traffic exited cloud-provider address space. It may be server automation, a crawler, a VPN exit, a corporate secure web gateway, remote browser isolation, a cloud desktop, or another hosted workload. The provider name does not identify the tenant, the visitor's employer, or whether the request came from a human buyer.

A cloud provider's address blocks are shared across its customers, so even when the provider is named correctly, the tenant is not in the data. "Amazon visited your site 400 times" usually means "something running on AWS did."

VPNs and privacy relays

Consumer VPNs exit through hosting networks, so a visitor on NordVPN or Surfshark resolves to whatever data center the VPN rents.

Corporate VPNs are the odd exception that can help you. If a company sends remote staff traffic back through its own gateway on its own registered block, those visits resolve to the company even from a home office. If the company uses split tunneling or a cloud-hosted security gateway instead, the traffic leaves through the security vendor's network rather than the employer's, and you lose the match.

Apple's iCloud Private Relay works the same way at a much larger scale. Apple publishes its egress list, and an APNIC analysis of Private Relay counted about 20,000 IPv4 subnets and 202,000 IPv6 /64 subnets, run on Akamai, Cloudflare, and Fastly networks. A Safari user with Private Relay turned on shows up as a CDN, never as an employer.

Old, missing, and moved records

The Pomona record is not unusual. Required reassignments are filed when qualifying blocks are handed out and may remain after the customer leaves. Assignments smaller than eight addresses are not required to have customer-specific registrations under ARIN's rule, so they often have no public customer record. And when providers merge or sell, the routing data updates fast while the registry paperwork lags. The researchers behind as2org+ (PAM 2023) built their method specifically because WHOIS-only mappings carry errors and outdated data, including around mergers and acquisitions.

How to read a company match before you act on it

This is the table I'd put in front of anyone building account reports or sales alerts from company IP lookups:

My position is stricter than any visitor identification vendor will put in its onboarding deck: drop ISP and hosting matches from account-level reporting entirely. A report that lists "Amazon Technologies" and "Comcast IP Services" as top visiting accounts is worse than a shorter report, because it trains the sales team to ignore the whole thing.

One more check worth adding: when the company on record differs from the network owner and the type is business, you are usually looking at a filed reassignment. That is often the most specific answer the data can give. Check the record date before you trust it.

Questions to ask an IP to company vendor

1. Do you return a company type, and can I filter on it? If not, you will be cleaning Comcast out of reports by hand.
2. Where does the name come from? Registry holder, reassignment filing, or your own enrichment. Ask them to show the source for three IPs you pick.
3. How fresh is it, and can I see a record date? ipinfo and ipgeolocation.io both advertise daily updates. Daily refreshes of a 1998 filing still return a 1998 filing.
4. Do you flag VPN, relay, and hosting traffic separately? A hosting flag alone does not tell you whether the visit came from a VPN user or a scraper.
5. What is the match rate on my traffic? Not a benchmark. Send them a week of your own visitor IPs and count how many come back as business, education, or government. ## Where IP to company data is still worth using

Account-based marketing on office-heavy targets is the clean case. In the same BLS telework breakdown, the rate was 17.8% in health care, 19.6% in manufacturing, and 21.4% in public administration, so most of their working hours happen on office networks, which is the only place a company match has a real chance. Sales alerts work when they fire only on business-type matches against a named target list. Security and fraud teams get value from the other end of the table: a hosting or VPN match on a signup form is a signal in itself.

For the examples in this article I used ipgeolocation.io, which returns the company and the network owner as separate fields with a type on each. If you'd rather test against your own traffic without calling an IP to company API on every visit, an IP to company database lets you join a CSV export of visitor IPs offline. ipinfo, ipapi.is, and MaxMind's GeoIP2 ISP database offer comparable data, so test two before you commit.

Before buying anything, export last month's visitor IPs, run them through any IP address company lookup, and count the results by company type. The share that comes back as business, education, or government is the real ceiling on what IP to company data can do for your pipeline. Plan around that number, not the vendor's.