IP address to organization name map

Generated with AI.

Each Regional Internet Registry (RIR) operates a database that records Internet number resources and the organizations to which they are allocated. This information can be queried using the whois query tool by submitting an IP address or Autonomous System Number (ASN), which returns the relevant registration details for that resource.

Whois is a venerable protocol, and it has its idiosyncrasies. The Registration Data Access Protocol (RDAP) is an alternative to whois for accessing Internet resource registration data. RDAP is designed to address several shortcomings in the existing whois service, including the standardization of queries and responses, redirection capabilities to allow seamless referrals to other registries, and internationalization considerations for languages other than English in data objects.

If you start the query process with an IP address or an ASN, then you can find details about the current holder of that number resource, including its organization name. But the reverse query is far more challenging in this database query framework. By 'reverse' I mean: What if you wanted to list all the resources held by an organization?

This question was the topic of a presentation by Tijay Chung at NANOG 95 in October 2025 (IP to Organization). The presentation described a process used by researchers at Virginia Tech that harvested data from the Internet Routing Registry, Peering DB, and whois queries to gather a list of potential organization names, then pass these names into several resources, including asndb, PeeringDB, Google, and Wikipedia and filter the output to find candidate organization names, then feed these names into a Large language model (LLM) to see 'related' names that refer to the same organization. Their system can be queried at the AS-to-OrganizationMapping Database.

As an exercise, I explored a much simpler alternative approach based on a feature of the RIRs' extended daily statistics files. In these reports, each record includes an additional field, known as a reg-id, which is an anonymized identifier for the organization holding the resource. All resources allocated or assigned to the same entity share the same reg-id, and this value remains consistent across daily reports. As a result, the reg-id uniquely identifies a single Internet number resource holder, allowing all records with the same reg-id to be associated with the same organisation.

To take the example of the address prefix '', the APNIC extended stats file contains the entry:

The holder of the IP address prefix has the reg-id value of ''.

If you perform a whois query for this IP address against the APNIC whois server, the output reports on the organization identifier for this IP address to be 'ORG-ARAD1-AP', and the organization object lists the associated organization name as 'APNIC Research and Development'. That is, the reg-id identifier '' maps to the organization name 'APNIC Research and Development'.

A simple way to compile a 'reverse list' that maps assigned IP addresses to the organizations to which they were allocated or assigned by an RIR is to extract the reg-id values from the statistics file, perform a whois lookup on any number object associated with each reg-id, and then extract the organization name attribute from the whois response.

I've scripted a process to perform this reverse mapping to run every 24 hours, and the combined extended daily statistics report can be found on my website.

The format used in this report is to append the organization name as an additional field appended to each record of an assigned number resource, where the organization names used in this report are the names recorded in the RIRs' databases.

The first 20 records in this report from 27 January 2026 are:

The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.