How IP Address Registries Work
Public IP addresses are distributed through a global registry system. In IP Lens, the Registry field names the Regional Internet Registry (RIR) associated with an address range's registration records.
An IP registry is different from a domain registrar. Domain registrars work with names such as example.com. IP registries manage Internet number resources, including IPv4 blocks, IPv6 blocks, and Autonomous System Numbers (ASNs), which identify networks when they exchange routing information. A registry record identifies the registered holder or other organization listed for a block. It does not establish legal ownership of the addresses or identify the person using one address.
What does the Registry field in IP Lens tell you?
The Registry field identifies the RIR associated with the displayed registration context. It points you toward the registry responsible for records about the block; it does not state how IP Lens obtained the data or mean that the address is physically used inside that registry's service region.
The result page calls the listed organization the Owner. Read that field as the registered holder, registrant, or organization named in the source record, not as a conclusion about legal title or the person using an address. See IP ownership and ASNs.
Who should receive abuse reports?
Send a report to the abuse contact for the most specific current allocation or network operator, not automatically to IANA or the first registry in the allocation chain. Follow the most-specific Registration Data Access Protocol (RDAP) record, then use How to Report Network Abuse Associated With an IP Address for the evidence checklist and report template.
How does the IP registry hierarchy work?
The Internet Assigned Numbers Authority (IANA) sits at the top of the number-resource hierarchy. It allocates large pools of IP addresses and ASNs to Regional Internet Registries (RIRs), which then distribute them within their service regions. Each of the five RIRs maintains records and publishes RDAP and/or WHOIS data for resources in its registry.
| Registry | Service region |
|---|---|
| AFRINIC | Africa and the Indian Ocean region |
| APNIC | Asia-Pacific region |
| ARIN | Canada, the United States, and parts of the Caribbean and North Atlantic |
| LACNIC | Latin America and parts of the Caribbean |
| RIPE NCC | Europe, the Middle East, and parts of Central Asia |
A registry's service region describes its administrative role, not where every address is used. IPv4 blocks can be transferred between organizations, and some legacy space was allocated before the current RIR system. The registered holder can also route or lease a block outside the registry's region, so an ARIN-registered block may serve users in Europe. See IPv4 and IPv6 addresses for how scarcity led to transfers and leasing.
Below the RIRs are National Internet Registries (NIRs) and Local Internet Registries (LIRs), which distribute resources closer to local networks and customers.
What is the difference between WHOIS and RDAP?
WHOIS is the older text-based lookup system for IP address and ASN registry records. RDAP is a newer protocol, or set of rules for exchanging information, that uses HTTP. It returns data in a defined structure that software can read and provides a standard way to find the correct registry service for an IP address or ASN.
These records answer administrative questions: which registry serves the resource, which organization or customer is listed for a prefix, what contact handles are published, and where abuse or network-operations contacts may be found. They do not, by themselves, prove legal ownership, current routing, exact user location, or the person behind a connection.
Why can the registry and announcing ASN disagree?
Registry data identifies the listed holder of an address range. Networks separately announce which ranges they can route traffic to. They exchange these routing announcements using Border Gateway Protocol (BGP), a set of rules for sharing routing information. An observation identifies the network that introduced the route (the origin ASN) for a range (a prefix). These fields often name different organizations. IP ownership and ASNs explains why, with examples such as cloud networks, Bring Your Own IP (BYOIP), and leased address space.
How should I interpret registry data?
Treat registry information as administrative context, not current routing or user location. Compare it with the event time and relevant routing, reverse DNS, location, and tag data before drawing a conclusion.
Where does RPKI fit?
Resource Public Key Infrastructure (RPKI) checks whether a Route Origin Authorization permits an origin ASN and prefix length; it does not validate the full AS path. IP Lens does not currently display RPKI validation. See the complete RPKI result table for the operational distinctions.
Appendix: What are National and Local Internet Registries?
National Internet Registries serve specific countries or economies under a parent RIR. In the APNIC region, APNIC lists seven NIRs that perform Internet number delegations and registrations in line with APNIC policies, often serving their communities in local languages.
| NIR | Country or economy |
|---|---|
| APJII / IDNIC | Indonesia |
| CNNIC | China |
| IRINN | India |
| JPNIC | Japan |
| KISA | South Korea |
| TWNIC | Taiwan |
| VNNIC | Vietnam |
Other regional arrangements also place registration services closer to local communities. For example, organizations in Brazil and Mexico may receive number resources through NIC.br and NIC.MX. The exact terminology and relationship with the parent RIR varies by region.
There are also thousands of Local Internet Registries around the world. These include Internet Service Providers (ISPs), hosting companies, mobile operators, cloud providers, and large enterprises. ISPs supply Internet access. Local registries receive allocations from an RIR or NIR, then assign smaller blocks to their own customers, infrastructure, data centers, or access networks.