IP and ASN Ownership Checks: Confirming Who Really Announces an Address

An IP Address Tells You Less Than You Think

You see an IP address in your logs and run a WHOIS lookup. It says the address belongs to "Example Hosting Corp." Case closed — except it is not. IP addresses are announced by Autonomous Systems (ASNs), not by organizations. A hosting company might own the IP block but lease it to a customer who operates their own ASN. The WHOIS record shows the legal registrant; BGP shows who actually routes the traffic.

Start with OpsCheck WHOIS Lookup to get the registered owner, then cross-reference with OpsCheck IP Geolocation to see the ASN and network operator currently announcing the prefix.

The WHOIS vs BGP Gap

# WHOIS shows the legal registrant
whois 192.0.2.10 | grep -E "^OrgName|^netname|^descr"

# But the actual routing might differ — check the origin AS
# Use a BGP looking glass or the OpsCheck IP Geolocation tool
# which includes ASN data from BGP feeds

# Dig shows the reverse DNS, which is under the operator's control
dig -x 192.0.2.10 +short

# Quick ASN ownership check
whois 198.51.100.10 | grep -iE "^origin|^OriginAS|^Organization"

# Alternative: query by AS number
whois -h whois.ripe.net AS15169 | grep -iE "^as-name|^org-name|^descr"

When Ownership Matters

Checking IP ownership is critical when:

• Investigating a suspicious login to your admin panel
• Verifying a third-party API consumer's claimed identity
• Confirming a vendor's infrastructure claims during a security audit
• Tracing the source of spam or abusive traffic

# Trace the AS path for an IP (requires a BGP looking glass)
# Many public looking glasses available — check AS path for suspicious origins

# Get ASN information
whois -h whois.ripe.net AS15169 | head -20

# Cross-reference: does the AS name match the WHOIS org?
# Mismatch = leased space, resold hosting, or hijacked prefix

Real-World Scenario

A company received a DMCA complaint about content hosted at one of their IPs. The WHOIS record showed the IP belonged to them, so they took the complaint at face value and started an internal investigation. After hours of searching their own infrastructure, they checked the ASN — the IP was being announced by a completely different ISP under a lease arrangement they had forgotten about. The content was on a customer's server at the leasing ISP. Five minutes with an ASN lookup would have saved the investigation.

Verification Checklist

• Check OpsCheck Blacklist Checker — if the IP is blacklisted, the operator might be a spam haven
• Run WHOIS on the IP, then on the ASN — compare the organization names
• Check reverse DNS: does the PTR record match the claimed operator?
• Look up the AS number at peeringdb.com for the real network name
• If the AS is a well-known cloud provider and the IP is in a customer range, you are likely looking at an end user, not the provider itself