|
The ISP Column
A column on things Internet
|
|
|
Other Formats:
|
|
|
|
|
IP Address to Organistion Name Map
January 2026
Geoff Huston
The Regional Internet Registries (RIRs) each operate a database that records (among other data) the number resource and the details of the entity that currently holds the resource allocation. The data can be queried using individual queries using the whois query tool, by giving an IP Address or an Autonomous System Number in the query and being passed the database excerpts relating to that IP address or AS Number in response.
Whois is a venerable protocol. and it has its idiosyncrasies. The Registration Data Access Protocol (RDAP) is an alternative to WHOIS for accessing Internet resource registration data. RDAP is designed to address a number of shortcomings in the existing Whois service, including the standardization of queries and responses, redirection capabilities to allow seamless referrals to other registries, and internationalization considerations for languages other than English in data objects.
If you start the query process with an IP address, or an AS Number then you can find details about the current holder of that number resource, including its organisation name. But the reverse query is far more challenging in this database query framework. By "reverse" I mean: What if you wanted to list all the resources held by an organisation?
This question was the topic of a presentation by Tijay Chung at NANOG 95 in October 2025 ("IP to Organisation""). The presentation described a process used by researchers at Virginia Tech that harvested data from the Internet Routing Registry, Peering DB and WHOIS queries to gather a list of potential organisation names, then pass these names into a number of resources, including asbdb, PeeringDB, Google and Wikipedia and filter the output to find candidate organisation names, then feed these names into an LLM to find "related" names that refer to the same organisation. Their system can be queried at https://asint.netsecurelab.org.
As an exercise, I have been looking at an alternative approach that is far simpler. This approach uses a feature of the RIRs' "extended daily statistics file" reports, where each record in the report contains an additional field, termed a reg-id, which is an anonymised identifier for the entity holding the resource. All resources recorded as being allocated or assigned to the same entity have the same reg-id value, and this value is constant across each daily report. The reg-id field uniquely identifies a single organisation, an Internet number resource holder, such that all records in the report with the same reg-id are registered by the RIR to the same resource holder.
To take the example of the address prefix 203.10.60.0", the APNIC extended stats file contains the entry:
apnic|AU|ipv4|203.10.60.0|1024|19941118|assigned|A91872ED
The holder of the IP address prefix 203.10.60.22 has the reg-id value of "A91872ED".
If you perform a whois query for this IP address against the APNIC whois server, the output reports on the organisation identifier for this IP address to be "ORG-ARAD1-AP", and the organisation object lists the associated organization name as "APNIC Research and Development". That is, the reg-id identifier "A91872ED" maps to the organisation name "APNIC Research and Development".
A simple way to compile the "reverse list" of all RIR records that map all assigned IP addresses to the names of the organisations that were allocated or assigned these addresses by an RIR is to extracting the reg-id values and perform a whois lookup on any of the number objects listed in this stats file with that reg-id value, extract the organisation name attribute of the whois response.
I've scripted a process to perform this reverse mapping to run every 24 hours, and the combined extended daily statistics report can be found at:
https://www.potaroo.net/bgp/stats/nro/delegated-nro-extended-org.
The format used in this report is to append the organisation name as an additional field appended to each record of an assigned number resource, where the organisation names used in this report are the names recorded in the RIRs' databases.
The first 20 records in this report from 27 January 2026 are:
2|nro|20260127|750808|19700101|20260127|+0000 nro|*|asn|*|111427|summary nro|*|ipv4|*|261998|summary nro|*|ipv6|*|377383|summary iana|ZZ|asn|0|1|19830101|reserved|ietf|iana| arin|US|asn|1|1|20010920|assigned|e5e3b9c13678dfc483fb1f819d70883c|e-stats|Level 3 Parent, LLC arin|US|asn|2|1|19910110|assigned|279fb28df10add3bd7028865951995a6|e-stats|University of Delaware arin|US|asn|3|1|00000000|assigned|d98c567cda2db06e693f2b574eafe848|e-stats|Massachusetts Institute of Technology arin|US|asn|4|1|19840222|assigned|8f5d315929a560376b0b58b40a1932fa|e-stats|University of Southern California arin|US|asn|5|1|19840202|assigned|481404355c401f2604c57a0fda4ee68f|e-stats|WFA Group LLC arin|US|asn|6|1|19840202|assigned|61457436058bce0a6be1a923532a3255|e-stats|ATOS IT Solutions and Services, Inc. ripencc|EU|asn|7|1|19930901|assigned|1aa63224-5b89-4cab-9eea-801e24188478|e-stats|The Defence Science and Technology Laboratory arin|US|asn|8|1|19840326|assigned|5f676a1dae02fc7cb708558c3ff1d122|e-stats|Rice University arin|US|asn|9|1|19840417|assigned|859ff8395a142b506a4aa4425d450e1d|e-stats|Carnegie Mellon University arin|US|asn|10|1|00000000|assigned|3fa2e5aa48f205a7696ea6fbcd437cff|e-stats|CSNET Coordination and Information Center (CSNET-CIC) arin|US|asn|11|1|19840704|assigned|2c8438ff5e93d4a88cf7217faf2d6b5c|e-stats|Harvard University arin|US|asn|12|1|19840705|assigned|0af65ed62b72effd8e2bda180154a5dd|e-stats|New York University arin|US|asn|13|1|19840716|assigned|c096bf755fee3dfb7b9046461595ebd0|e-stats|Headquarters, USAISC arin|US|asn|14|1|00000000|assigned|148b369d3a54363bcd99798b25c1dc23|e-stats|Columbia University arin|US|asn|15|1|00000000|assigned|fe488cec311061dc1e09f54c01946ba8|e-stats|DYNAMICS
Disclaimer
The above views do not necessarily represent the views of the Asia Pacific Network Information Centre.
About the Author
GEOFF HUSTON AM B.Sc., M.Sc., is the Chief Scientist at APNIC, the Regional Internet Registry serving the Asia Pacific region.