IP to Company Database

IP to Company Database Organization Data Firmographics Data

The IP to Company Database contains the name, domain and type for every company / organization in the Internet that owns an IP address or IP network. IP ownership of companies is obtained by querying the five major WHOIS registries responsible for number resources: ARIN, RIPE, APNIC, LACNIC, and AFRINIC. The IP to Company Database is updated in regular intervals to ensure the correctness of the firmographic data.

The IP to Company Database allows you to accurately classify traffic according to different criteria, such as company name or company type. For instance, when the company type of an organization is hosting, the traffic quality is much worse compared to a visitor originating from a government or education type network.

IP to Company Database

Price 89$ per month
Filesize 498MB
Format CSV and MMDB
Number of Networks 3,100,084
Last Updated December 20, 2024
Download CSV Sample Sample (CSV)
Download MMDB Sample Sample (MMDB)

Demo for IP to Company Database

Enter any IP address to obtain the ip to company data associated with this IP address.

{
  "message": "Please make an API request",
}

# Purchase Database

To purchase the database, you need to create a free account. Database subscriptions are billed monthly and can be canceled at any time. Learn more about the pricing and the terms. If you purchase the database, you will receive a download link to the database file for all formats.

Sign Up for Free

# Company Database Format

The file format of the IP to Company Database is either in CSV or MMDB format and contains the following fields:

  • startIp - The start IP address of the range in string format. Example: 117.200.64.0
  • endIp - The end IP address of the range in string format. Example: 117.200.239.255
  • ipVersion - Either 4 (IPv4) or 6 (IPv6), determining the IP type of the network.
  • company - The name of the company. Example: Broadband Networks
  • abuser_score - The field abuser_score represents the quota of abusive IP addresses of the network belonging to the organization (company). The higher this number is, the more abusive the whole network is. abuser_score = Number of Abusive IPs / Number of Total IPs in the Network
    Example: 0.0183 (Elevated)
    • Very High - More than 20% of all IPs of the network are abusive
    • High - Between 3% to 20% of all IPs of the network are abusive
    • Elevated - Between 0.85% to 3% of all IPs of the network are abusive
    • Low - Between 0.85% to 0.05% of all IPs of the network are abusive
    • Very Low - Less than 0.05% of all IPs of the network are abusive
  • domain - The domain of the Company. Example: bsnl.co.in
  • type - The field type contains the type of the company. The following company types exist:
    • hosting - The company is a hosting provider (Example: 5.161.56.240)
    • education - The company is a university or other kind of educational institution (Example: 129.114.137.255)
    • government - The company is a governmental institution (Example: 137.75.167.171)
    • banking - The company is a banking/financial institution (Example: 199.67.175.0)
    • isp - The company is an Internet Service Provider (ISP) (Example: 117.200.226.44)
    • business - If the type is not one of the above, the type is the generic business type (Example: 17.133.85.230)
  • rir - The Regional Internet Registry responsible for the IP range. Example: APNIC
  • abuseName - The abuse contact name, the name of the identity that receives abuse complaints about the network provided in company.network. The abuse contact name is mostly the same name as in company.name. Example: ABUSE BSNLIN
  • abuseAddress - The abuse contact address. This is the physical address of abuse contact of the entity that owns the network specified in company.network. Example: Internet Cell, Bharat Sanchar Nigam Limited., 8th Floor,148-B Statesman House, Barakhamba Road, New Delhi - 110 001
  • abuseEmail - The abuse contact email. This email address takes abuse complaints about incidents associated with the network specified in company.network. Example: abuse1@bsnl.co.in
  • abusePhone - The abuse contact phone number. This phone number takes abuse complaints about incidents associated with the network specified in company.network. Example: +000000000

The following example contains an small excerpt of the entire database: 

startIp,endIp,ipVersion,company,abuser_score,domain,type,rir,abuseName,abuseAddress,abuseEmail,abusePhone
1.0.0.0,1.0.0.255,4,APNIC Research and Development,0.043 (High),apnic.net,business,APNIC,APNIC Research and
Development,6 Cordelia St,helpdesk@apnic.net,+61-7-38583100
1.0.1.0,1.0.1.255,4,CHINANET FUJIAN PROVINCE NETWORK,0 (Very Low),chinatelecom.cn,isp,APNIC,ABUSE CHINANETCN,"No.31
,jingrong street,beijing, 100032",anti-spam@chinatelecom.cn,+000000000
1.0.2.0,1.0.3.255,4,CHINANET FUJIAN PROVINCE NETWORK,0 (Very Low),chinatelecom.cn,isp,APNIC,ABUSE CHINANETCN,"No.31
,jingrong street,beijing, 100032",anti-spam@chinatelecom.cn,+000000000
1.0.4.0,1.0.4.255,4,Gtelecom Pty Ltd,0 (Very Low),gtelecom.com.au,isp,APNIC,ABUSE WPLAU,"1/18 Deblin drive, Narre
warren, vic 3805, Melbourne victoria 3805",apnic@staff.gtelecom.com.au,+000000000
1.0.4.0,1.0.7.255,4,Gtelecom Pty Ltd,0 (Very Low),gtelecom.com.au,isp,APNIC,Gtelecom Pty Ltd,"1/18 Deblin Drive, Narre
Warren",support@gtelecom.com.au,+61387894999
1.0.5.0,1.0.5.255,4,Gtelecom Pty Ltd,0 (Very Low),gtelecom.com.au,isp,APNIC,ABUSE WPLAU,"1/18 Deblin drive, Narre
warren, vic 3805, Melbourne victoria 3805",apnic@staff.gtelecom.com.au,+000000000
1.0.6.0,1.0.6.255,4,Gtelecom Pty Ltd,0 (Very Low),gtelecom.com.au,isp,APNIC,ABUSE WPLAU,"1/18 Deblin drive, Narre
warren, vic 3805, Melbourne victoria 3805",apnic@staff.gtelecom.com.au,+000000000
1.0.7.0,1.0.7.255,4,Gtelecom Pty Ltd,0 (Very Low),gtelecom.com.au,isp,APNIC,ABUSE WPLAU,"1/18 Deblin drive, Narre
warren, vic 3805, Melbourne victoria 3805",apnic@staff.gtelecom.com.au,+000000000
1.0.8.0,1.0.15.255,4,CHINANET Guangdong province network,0 (Very Low),chinatelecom.cn,isp,APNIC,IPMASTER
CHINANET-GD,"NO.18,RO. ZHONGSHANER,YUEXIU DISTRIC,GUANGZHOU",anti-spam@chinatelecom.cn,+86-20-87189274
1.0.16.0,1.0.16.255,4,"i2ts,inc.",0 (Very Low),,business,JPNIC,,,,
1.0.16.0,1.0.31.255,4,"i2ts,inc.",0 (Very Low),i2ts.com,business,APNIC,IRT-JPNIC-JP,"Uchikanda OS Bldg 4F, 2-12-6
Uchi-Kanda, Chiyoda-ku, Tokyo 101-0047, Japan",hostmaster@nic.ad.jp,+81-3-5297-2311
1.0.32.0,1.0.63.255,4,CHINANET Guangdong province network,0 (Very Low),chinatelecom.cn,isp,APNIC,IPMASTER
CHINANET-GD,"NO.18,RO. ZHONGSHANER,YUEXIU DISTRIC,GUANGZHOU",anti-spam@chinatelecom.cn,+86-20-87189274
1.0.64.0,1.0.79.255,4,"Enecom,Inc.",0.0007 (Low),,business,JPNIC,,,,
1.0.64.0,1.0.127.255,4,"Enecom,Inc.",0 (Very Low),ene.megaegg.ne.jp,business,JPNIC,,,,
1.0.64.0,1.0.95.255,4,"Enecom,Inc.",0 (Very Low),,business,JPNIC,,,,
1.0.80.0,1.0.95.255,4,"Enecom,Inc.",0.001 (Low),,business,JPNIC,,,,

# How to use the IP to Company Database?

This example shows how to work with the IP to Company Database in MMDB format. First, you have to download the database sample:

curl -O https://ipapi.is/data/samples/companySample.mmdb

And then you can read the database with mmdbctl:

mmdbctl read -f json-pretty 1.0.0.0 companySample.mmdb

which outputs:

{
  "abuseAddress": "6 Cordelia St",
  "abuseEmail": "helpdesk@apnic.net",
  "abuseName": "APNIC Research and Development",
  "abusePhone": "+61-7-38583100",
  "abuser_score": "0.0469 (High)",
  "company": "APNIC Research and Development",
  "domain": "apnic.net",
  "ipVersion": "4",
  "network": "1.0.0.0-1.0.0.255",
  "rir": "APNIC",
  "type": "business"
}

# Use Cases of Company Data

The IP to Company database can be used across various industries, providing valuable insights and enabling more informed decision-making. In the realm of marketing, the data can significantly enhance the effectiveness of B2B campaigns. By identifying the organization behind a specific IP address, marketers can tailor their outreach efforts, ensuring that their messages reach the right companies, leading to higher engagement and conversion rates.

In the cybersecurity industry, the IP to Company database is a powerful tool in threat intelligence and mitigation. By tracing suspicious or malicious activities back to their source organizations (using the company attribute), security teams can better understand the nature of the threat, assess the risk, and implement appropriate countermeasures. This is particularly useful in identifying and blocking traffic from known malicious entities.

The type attribute can be used to classify the company type and adjust the security measures accordingly. For instance, traffic from a hosting company might be subject to more stringent scrutiny than traffic from a isp entity. Furthermore, the IP reputation of networks belonging to the banking, education or government sectors is usually higher than that of hosting or isp networks. Thus, the type attribute can be used to prioritize certain traffic or apply specialized security measures based on the company type.

Compliance teams also benefit from access to accurate company data. In industries where regulatory compliance is critical, such as finance and healthcare, ensuring that business interactions are conducted with legitimate and verified entities is essential. Company data helps organizations avoid fraud, minimize legal risks, and adhere to industry regulations. By validating the companies behind IP addresses, businesses can maintain a higher level of trust and integrity in their operations.

In addition to these applications, company data is invaluable in the field of analytics. Understanding the companies behind web traffic allows businesses to gain deeper insights into user behavior and customer journeys. This information can be used to optimize website content, improve user experience, and refine product offerings. For example, a SaaS provider might analyze the IP data to discover which industries or company sizes are most engaged with their platform, enabling them to fine-tune their marketing and sales strategies.

# Data Sources of Company Data

The company data provided by ipapi.is is aggregated from a variety of authoritative sources, ensuring its accuracy and reliability. The foundation of this data comes from the five major WHOIS registries: ARIN, RIPE, APNIC, LACNIC, and AFRINIC. These registries are responsible for managing and distributing IP address allocations across different regions globally. As a result, the data sourced from these registries reflects the most up-to-date and accurate information on IP ownership and company affiliations.

Company data is sourced from specific objects within the records of different WHOIS registries. For example, in RIPE, APNIC, and AFRINIC, the IP to Company Database is built using inetnum and organisation objects. For instance, when querying the IP address 5.59.102.0 with the command whois -h whois.ripe.net 5.59.102.0, the following parts of the WHOIS record are used to source the IP to Company Database for the network 5.59.102.0 - 5.59.103.255: 

inetnum:        5.59.102.0 - 5.59.103.255
netname:        ITGLOBE
descr:          IT Globe s.r.o.
country:        CZ
org:            ORG-ITG9-RIPE
admin-c:        CRA67-RIPE
admin-c:        BART3-RIPE
tech-c:         CRA67-RIPE
tech-c:         BART3-RIPE
mnt-domains:    vissado-mnt
mnt-domains:    BARTOS-MNT
status:         ASSIGNED PA
mnt-by:         COPROSYS-MNT
created:        2023-09-29T19:05:06Z
last-modified:  2023-09-29T19:05:06Z
source:         RIPE

organisation:   ORG-ITG9-RIPE
org-name:       IT Globe s.r.o.
org-type:       OTHER
address:        Rozsocha 30, 562 01 Orlicke Podhuri, Czech Republic
abuse-c:        ACRO52879-RIPE
mnt-ref:        COPROSYS-MNT
created:        2023-05-22T16:08:18Z
last-modified:  2023-05-22T16:08:18Z
source:         RIPE # Filtered
mnt-by:         vissado-mnt

ARIN, on the other hand, uses the NetRange and OrgName objects to associate organization data with IP networks. For example, when querying whois 205.202.161.139, the following parts of the WHOIS record are relevant for the IP to Company Database: 

NetRange:       205.202.0.0 - 205.202.255.255
CIDR:           205.202.0.0/16
NetName:        NETWORK-NEBRASKA
NetHandle:      NET-205-202-0-0-1
Parent:         NET205 (NET-205-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS11714
Organization:   Network Nebraska (NN-108-Z)
RegDate:        1995-03-31
Updated:        2017-07-21

OrgName:        Network Nebraska
OrgId:          NN-108-Z
Address:        14th and R
City:           Lincoln
StateProv:      NE
PostalCode:     68588
Country:        US
RegDate:        2017-06-19
Updated:        2024-04-16

LACNIC has its own format as well, and there are some other minor differences between the registries, but the two formats described above are the most common ways IP addresses are associated with organizations.

Additionally, less well-known national WHOIS registries are used to enrich the data. Some of the lesser-known national registries used for the IP to Company Database include:

  • JPNIC (Japanese Network Information Center), used to enrich the data with Japanese companies.
  • KRNIC (Korean Network Information Center), used to enrich the data with Korean companies.
  • CNNIC (Chinese Network Information Center), used to enrich the data with Chinese companies.
  • TWNIC (Taiwanese Network Information Center), used to enrich the data with Taiwanese companies.

There are also special subsections of WHOIS data that need to be treated differently:

  • RWHOIS (Referral Whois) - A directory services protocol that extends and enhances the Whois concept in a hierarchical and scalable fashion. RWHOIS is mostly used to subdivide IP address space from large ISPs into smaller networks for their customers.
  • ARIN CustName objects are used to provide information about downstream companies in a similar way to how RWHOIS is used.

An example for a CustName object can be obtained by querying whois -h whois.arin.net 209.73.4.32: 

NetRange:       209.73.4.32 - 209.73.4.47
CIDR:           209.73.4.32/28
NetName:        POMONA-GW-DTI-NET
NetHandle:      NET-209-73-4-32-1
Parent:         LOGICWORKS-209-CIDR (NET-209-73-0-0-1)
NetType:        Reassigned
OriginAS:       
Customer:       Pomona Management Co. (C00014589)
RegDate:        1998-08-14
Updated:        2010-05-03

CustName:       Pomona Management Co.
Address:        780 3rd Ave.
City:           New York
StateProv:      NY
PostalCode:     10017
Country:        US
RegDate:        1998-08-14
Updated:        2011-03-19

In summary, IP addresses are assigned in different ways across the various WHOIS registries. The lack of a common format and the presence of numerous idiosyncrasies make it challenging to provide IP to Company data in an updated and standardized format.

One of the most challenging aspects of maintaining the IP to Company Database is determining which networks are allocated or assigned to which registry. It is not trivial to find an accurate list of networks assigned to a specific registry. A good starting point is to consider the delegation files of the different registries. For example, in the case of ARIN, the delegated-arin-extended-latest file contains information about the networks assigned to ARIN. However, this file does not contain information about the downstream networks (RWHOIS, CustName) assigned by ARIN to other companies. Furthermore, the file does not contain all networks assigned to ARIN. Complexities such as those mentioned above make it challenging to maintain an accurate and up-to-date IP to Company Database.

Other Sources

In addition to WHOIS data, we incorporate information from other reputable sources, including public registries, company websites, and industry databases. This comprehensive approach ensures that our dataset is not only extensive but also enriched with details that might not be available through WHOIS registries alone. For instance, domain ownership data and company type classifications are cross-referenced with publicly available resources to provide a more complete picture.

In particular, domain information is not always trivial to obtain from WHOIS records, as many companies choose to keep their domain registration details private. By leveraging additional sources, we can fill in these gaps and provide a more comprehensive view of the companies behind IP addresses.

The type attribute is another example of how we enrich the data beyond WHOIS records. While WHOIS data provides valuable information about IP ownership, it does not always include details about the nature of the organization. By leveraging external sources and proprietary algorithms, we are able to classify companies into different types:

  • hosting - Companies that provide web hosting services.
  • education - Educational institutions such as universities and schools.
  • government - Governmental organizations and agencies.
  • banking - Financial institutions such as banks and credit unions.
  • isp - Internet Service Providers that offer connectivity services.
  • business - Generic classification for companies that do not fall into the above categories.

Update Policy

Regular updates are a critical aspect of maintaining the accuracy of our company data. We perform updates at regular intervals, pulling in fresh data from WHOIS registries and other sources to reflect any changes in IP ownership, company mergers, rebrandings, or other corporate developments. This commitment to data integrity ensures that our users can rely on the information for critical business decisions, whether it be for marketing, security, compliance, or analytics purposes.

By integrating data from these diverse and authoritative sources, we provide our users with a robust and reliable dataset that is indispensable for a wide range of applications. Whether you are looking to enhance your marketing efforts, strengthen your cybersecurity defenses, or ensure compliance with industry regulations, our company data is designed to meet your needs with precision and accuracy.