IP to Company Lookup: How It Works and Where It Fails

An IP to company lookup takes an IP address and returns the organisation that operates the network it belongs to, such as an office, a university or a cloud host. It works well only when the address sits on a business network. For home broadband, mobile data and VPNs it can only name the provider, not the person behind the connection.

What the lookup actually does

Every public IP address belongs to a block that someone registered. Regional registries such as ARIN and RIPE keep records of who holds each block, and routing data shows which autonomous system (ASN) announces it on the internet. A lookup service joins those records, adds reverse DNS and its own observations, and produces an answer.

The honest framing is that it resolves a network owner, not a visitor. A company with its own office range will show up cleanly. A company whose staff work from home, or whose traffic exits through a security vendor’s cloud, will not.

Here is the path from address to answer in practice:

1. The service receives an IPv4 or IPv6 address.
2. It finds the most specific registered block that contains it.
3. It checks which ASN announces that block and who operates the ASN.
4. It classifies the operator: business, ISP, mobile carrier, hosting, VPN, education, government and so on.
5. Only when the operator is a business that uses the range for its own staff does it return a company name and, ideally, a domain.

Step 5 is where services differ. Registry data tells you who holds a block, which is frequently not who is using it. A thorough service therefore withholds a company name whenever the network class says the range is shared.

Key takeaway: the quality of an IP to company service is the quality of its refusals. A tool that names a company for every address is guessing, and the guesses are mostly internet providers.

The verdict matters more than the name

Teams new to this area tend to look at the company field first. Look at the classification first. BusinessMCP’s IP to company API is a useful reference because it documents a three-way verdict on every lookup.

Verdict	Meaning	What to do with it
company	The network is that company’s own; a domain is set	Treat as an account signal
non_business	ISP, mobile carrier, cloud host or VPN	Treat as unknown; use it to filter traffic
unidentified	The service could not tell	Treat as unknown

The documentation tells you to handle anything other than company as unknown. That rule is worth copying into any integration, whichever vendor you use. If you build only one safeguard, make it this one.

Where the data comes from

There is no secret feed. Sources fall into a few groups.

• Registry records. Whois-style data from the regional internet registries lists holders and sometimes contact organisations. See how to find company IP ranges and ASNs for how to read them yourself.
• Routing data. Public routing tables show which ASN originates each prefix.
• DNS. Reverse DNS names often include a company domain, but they are hints rather than proof.
• First-party confirmations. When a visitor from an address submits a form with a work email, the domain confirms the company for that network. Vendors with their own analytics products can feed those confirmations back into their data.

BusinessMCP states that its graph is built nightly from public registry, routing and DNS data plus confirmations from its own product, and that it is not a resold feed. That is a vendor statement, but it shows the shape of a credible answer: you should be able to ask where the data comes from and get specifics.

Why most addresses name nobody

If you resolve a day of traffic to a typical B2B site, expect the majority of addresses to come back as consumer ISPs, mobile carriers, clouds and VPNs. This is not a flaw in the technique. It reflects how people reach the internet. Remote work has pushed more business activity onto home lines, and many enterprises route staff through secure-access vendors, so the visible egress belongs to the vendor.

BusinessMCP’s guidance puts company-level resolution at roughly 20 to 35 percent of B2B traffic, lower for SMB and consumer-heavy audiences. We dig into what drives that range in the match rate article, and in VPN and proxy traffic we look at one of the biggest reasons the number is not higher.

Lookup is a layer, not the whole stack

IP resolution is probabilistic: it tells you a business network visited. A second, deterministic layer comes when someone gives you an email address, because the domain confirms the company exactly. BusinessMCP’s explanation of how visitor identification works describes both layers and notes that about 98 percent of visitors never fill in a form, which is why the IP layer exists at all. Our own walkthrough of identifying companies visiting your website shows how the two combine.

Using a lookup responsibly

A few rules keep results trustworthy:

• Use the real client IP. Behind a CDN or load balancer, trust forwarded headers only when the request verifiably came through your proxy.
• Label the result as a network, not a person. An employee on home fibre does not make that address the employer’s.
• Re-resolve older data. Ranges change owners, so cached answers should expire.
• Keep a human in the loop for outreach. A named company is a reason to look, not a reason to email.

If you want to see a single result without writing code, try the free reverse IP lookup tool, which shows the company name and domain for corporate networks and a provider label for everything else. For step-by-step use see how to get a company name from one IP.

Quick reference

Term	Plain meaning
ASN	Number identifying a network that routes traffic on the internet
CIDR block	A range of addresses written like 198.51.100.0/24
Registry	Body that records who holds address blocks (ARIN, RIPE and others)
Egress IP	The public address a network’s traffic appears to come from
Verdict	The service’s classification of what the address represents

Once those terms are familiar, the rest of this site is about choosing, testing and integrating a service well.

A worked example, end to end

Imagine four addresses from one afternoon of traffic to a B2B software site. The labels below are illustrative, not real results.

Address type	What the registry shows	What a careful lookup returns	What you should do
Office of a mid-sized firm with its own block	The firm’s name	company plus a domain	Review the account
Home fibre line	A broadband provider	non_business, class ISP	Count the visit, claim nothing
Phone on cellular data	A mobile carrier	non_business, class mobile	Same
Scanner on a rented server	A hosting company	non_business, class hosting	Exclude from account reports

Only the first row creates a lead. The other three are the majority, which is why teams that expect a long list of named companies are often surprised by a short one. Short and accurate is the better outcome.

Common misunderstandings

“It tells me who visited.” It tells you which network the request came from. Several people can share one address at the same moment, and one person can use many addresses in a day.

“A static IP means a company.” Static addresses exist for households and shops as well as enterprises. Class matters more than permanence.

“Reverse DNS gives the answer.” Hostnames are set by whoever controls the range and are often generic or missing. They are a hint, nothing more.

“IPv6 is too new to matter.” A growing share of traffic arrives over IPv6, where blocks are far larger. Check that any service you adopt handles both families; see bulk lookups for batch handling of mixed lists.

“More matches means a better service.” The opposite is often true. A service that stays silent on ranges it cannot attribute is protecting you from false leads. For a structured way to judge this, see how to test an IP to company API.

Where to go next

If you are new to the topic, read reverse IP lookup for company names for a hands-on method, then match rates for expectations. If you are ready to evaluate vendors, start with the pricing breakdown. If your concern is policy, go straight to the GDPR article.