What is reverse IP lookup?

How it works

Every block of IP addresses is allocated through one of five Regional Internet Registries: ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC. Registry records say which organisation holds each range. Large companies, universities and public bodies often hold their own ranges, so a visit from inside their network carries an address registered to them.

A reverse IP lookup for a website visit runs roughly like this:

1. A visitor loads your page. Your server or a small script sees the visit's IP address.
2. The address is checked against registry data (and, in commercial tools, enriched IP databases).
3. If the range is registered to an organisation, the visit is attributed to it. If it belongs to a broadband or mobile provider, it cannot be attributed.

A separate technical meaning exists too: in DNS, a "reverse lookup" resolves an IP to a hostname via a PTR record. Mail servers use that to check senders, which is why valid PTR records are part of Gmail's sender rules.

A worked example

Say your site gets 2,000 visits in a month. A realistic breakdown might be:

• 1,500 from home broadband and mobile networks: unidentifiable.
• 300 from cloud providers and bots: not people.
• 200 from organisations that own their network, belonging to 60 distinct companies.

Of those 60, perhaps 15 fit your ideal customer profile, and 4 read the pricing page. Those four are worth a closer look: find the likely buyer at each and contact them about the problem, not about the visit. These figures are illustrative; your own split depends heavily on who your buyers are. Selling to large enterprises gives far higher match rates than selling to small firms.

Common mistakes

• Expecting names. It returns organisations, sometimes, never people.
• Treating the ISP as the company. A visit "from" a national broadband provider is noise.
• Over-reading a single visit. One page view from a 10,000-person company could be anyone, including a job seeker.
• Opening with "I saw you on our site". Use the visit to choose who to contact, not as the message.

Related terms

Website visits are first-party intent data and a weak-to-medium buying signal on their own. Visitor lists are a common input to account-based marketing.

How Sluice does it

Sluice's visitor feature is a one-line snippet. Companies that own their network appear with the pages they read, worked out from who owns the IP range using public registry data. No cookie is set and no IP is stored. Visitors on home broadband or mobile cannot be identified and are not guessed, so most small companies on shared ISPs stay invisible. For how this compares with tools that go further, see Sluice vs Clay.