--- title: Who owns this IP address? How to find out with the IP Address Lookup description: An address in your logs is making thousands of requests and says it's Googlebot. To find out who owns an IP address, look up the network that announces it (its ASN and BGP prefix) and its reverse DNS name, then confirm the name points back to the same address. Here's how to do it in one step with the free IP Address Lookup, how to read every field, and the dig and RDAP commands that confirm it. canonical: https://watchfor.io/blog/how-to-look-up-an-ip-address --- # Who owns this IP address? How to find out with the IP Address Lookup 2026-10-04 · WatchFor Team · Guides · guides, networking, security An address in your logs is making thousands of requests and says it's Googlebot. To find out who owns an IP address, look up the network that announces it (its ASN and BGP prefix) and its reverse DNS name, then confirm the name points back to the same address. Here's how to do it in one step with the free IP Address Lookup, how to read every field, and the dig and RDAP commands that confirm it. To find out who owns an IP address, look up which network announces it on the internet (the autonomous system, or ASN, and its BGP prefix) and what the address calls itself in reverse DNS. The ASN tells you the organisation that routes the address: a cloud provider, an ISP, a company. The reverse name, confirmed by a forward lookup back to the same address, tells you what the owner says the machine is. The free [IP Address Lookup](/ip-lookup) shows both for any IPv4 or IPv6 address in one step: network name, AS number, BGP prefix, registry country and the PTR record. No signup. ## What this tool answers *Whose address is this, and what does it claim to be?* Reach for it when an unknown IP shows up in access logs, firewall alerts or a failed-login list, when a crawler claims to be a search engine, when a customer sends you "our server's IP" and you want to know whose cloud it's in, or when you need the range to block or allowlist rather than one address. ## A real example ### Looking up who owns an IP address from your logs A familiar sight in web server logs: one address making requests with the user agent `Googlebot/2.1`. Scrapers copy that user agent all the time, because some sites let Googlebot through rate limits and paywalls. Block it and you might drop out of Google's index. Let it through and you might be feeding a scraper. The user agent proves nothing; the address does. We took `66.249.66.1`, an address that shows up in crawl logs, and entered it in the [IP Address Lookup](/ip-lookup): ![The IP Address Lookup result for 66.249.66.1: AS15169 autonomous system, IPv4 and PTR badges, reverse DNS crawl-66-249-66-1.googlebot.com, network Google LLC, ASN AS15169, BGP prefix 66.249.64.0/20, registry country US, and buttons to ping, traceroute, port check, blocklist check or reverse-DNS the same address](/blog/how-to-look-up-an-ip-address-result.webp) The lookup took 129 ms and returned: - **Reverse DNS:** `crawl-66-249-66-1.googlebot.com` - **Network:** Google LLC, **ASN** AS15169 - **BGP prefix:** `66.249.64.0/20` - **Registry country:** US That's two independent signals pointing the same way. The routing table says Google's own network (AS15169) announces the block, and the reverse name sits under `googlebot.com`, the domain Google uses for its crawler. One more step closes the gap, because anyone who controls an IP block can set its reverse name to anything: look up the name forwards and check you get the same address back. `crawl-66-249-66-1.googlebot.com` resolves to `66.249.66.1` (see the command-line section). This is exactly the check [Google documents](https://developers.google.com/crawling/docs/crawlers-fetchers/verify-google-requests) for verifying its crawlers, and the address also appears in Google's published crawler ranges as part of `66.249.66.0/27`. **The answer:** genuine Googlebot. Let it through and fix the load another way: serve those pages from cache, or, in an emergency, answer `503` or `429` for a while, which Google treats as a signal to crawl more slowly. A fake would have failed at least one test: a reverse name like `ec2-….compute.amazonaws.com` or none at all, a hosting provider's ASN, or a forward lookup that doesn't come back to the same address. Those you can block by address, or by prefix if the whole range is abusive. ## How to read the results | Field | What it means | | --- | --- | | **AS number (hero) / ASN** | The autonomous system that announces this address in BGP: the network that routes it. One organisation can have several ASNs. Amber *not announced* means no network currently routes it. | | **IPv4 / IPv6** | The address family. | | **PTR / no PTR** | Whether the address has a reverse DNS name. Many server and home addresses don't; mail servers must. | | **Reverse DNS** | The PTR name. The owner of the IP block sets it, so it's a claim until a forward lookup confirms it. | | **Network** | The organisation name registered for that ASN. *Name not published* means the ASN exists without a name in the source data. | | **BGP prefix** | The block the address is announced in, the most specific one found. Use it to block or allowlist a whole range, but check its size first: a `/20` is 4,096 addresses. | | **Registry country** | Where the block is registered, not where the machine is. Cloud providers register large ranges in one country and use them worldwide. | | **Check this address** | Opens the [ping test](/ping-test), [traceroute](/traceroute-online), [port checker](/port-checker), [blocklist checker](/blacklist-checker) or [reverse DNS lookup](/reverse-dns-lookup) with the same IP filled in. | There is no city on purpose: we don't run a licensed geolocation database, and a city guessed from the registry country would be wrong more often than not. Routing data and DNS are facts you can check. ## More ways to use it - **Triage a brute-force alert.** An ASN belonging to a hosting provider or VPN service plus no PTR usually means a rented server. Block the address, and report abuse to the network named here. - **Check a vendor's claim.** "Our webhooks come from our own data centre": the ASN shows whether the address is theirs or a cloud provider's. - **Build an allowlist from a range.** Copy the BGP prefix, then confirm the range against the vendor's published list. A prefix can be shared with other customers of the same cloud. - **Check a mail server before sending.** No PTR, or a generic name like `host-203-0-113-7.isp.example`, gets mail rejected or junked by large providers. The [reverse DNS guide](/blog/how-to-do-a-reverse-dns-lookup) covers the fix. - **See whether an address is on a blocklist.** One click on *Blocklists* runs the same IP through the DNSBLs. ## Tips and gotchas - **Reverse DNS is a claim.** Whoever controls the IP block writes the PTR record. Only a forward lookup that returns the same address (forward- confirmed reverse DNS) makes it trustworthy. - **The owner of the ASN isn't always the user.** For cloud addresses the network is AWS, Google Cloud or Azure; the customer renting the machine doesn't show up anywhere. Report abuse to the provider; they can reach the customer. - **Prefixes move.** Blocks get sold, re-announced and withdrawn. A lookup is accurate now; re-check before reusing an old blocklist. - **Private addresses aren't looked up.** `10.x`, `192.168.x`, `172.16–31.x` and other reserved ranges aren't routed on the internet, so there's no owner to find. They belong to whoever runs that local network. - **Your own address?** [What Is My IP](/whats-my-ip) shows it with the same ISP / Network row. The [public IP guide](/blog/how-to-find-your-public-ip-address) explains why it differs from what your computer reports. ## Check it from the command line too Reverse lookup, then the forward lookup that confirms it: ```bash dig +noall +answer -x 66.249.66.1 dig +noall +answer crawl-66-249-66-1.googlebot.com A ``` ```text 1.66.249.66.in-addr.arpa. 1866 IN PTR crawl-66-249-66-1.googlebot.com. crawl-66-249-66-1.googlebot.com. 1866 IN A 66.249.66.1 ``` The name points back to the same address, so the PTR is confirmed. Team Cymru publishes IP-to-ASN mapping over DNS, so `dig` also gives the routing side: ```bash dig +short TXT 1.66.249.66.origin.asn.cymru.com dig +short TXT AS15169.asn.cymru.com ``` ```text "15169 | 66.249.64.0/19 | US | arin | 2004-03-05" "15169 | 66.249.64.0/20 | US | arin | 2004-03-05" "15169 | US | arin | 2000-03-30 | GOOGLE - Google LLC, US" ``` The address sits in two announced prefixes, a `/19` and the more specific `/20`. Registration records live with the regional registry (ARIN here), which answers RDAP over plain HTTPS: ```bash curl -s https://rdap.arin.net/registry/ip/66.249.66.1 | jq -r '.handle, .name, .startAddress, .endAddress' ``` ```text NET-66-249-64-0-1 GOOGLE 66.249.64.0 66.249.95.255 ``` That's the registered allocation, `66.249.64.0`–`66.249.95.255` (a `/19`), registered to Google. For addresses outside North America, use the RDAP server of RIPE, APNIC, LACNIC or AFRINIC, or `whois `, which follows the referral for you. ## FAQ **Can I find the exact location of an IP address?** No. Lookups give you the network that owns the address and, at best, a city from a geolocation database. Only the ISP knows which customer used an address, and it shares that with law enforcement, not with lookup sites. **How do I verify that a request really came from Googlebot?** Run a reverse DNS lookup on the IP, check the name ends in `googlebot.com`, `google.com` or `googleusercontent.com`, then look the name up forwards and confirm it returns the same IP. Google also publishes its crawler IP ranges. **What is an ASN?** An autonomous system number identifies a network that announces its own address blocks to the rest of the internet over BGP: an ISP, a cloud, a large company. [What is BGP?](/blog/what-is-bgp) explains how those announcements work, and [what is an IP address](/blog/what-is-an-ip-address) covers the basics. --- Canonical page: https://watchfor.io/blog/how-to-look-up-an-ip-address · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt