How to Find the IP, ASN and Owner Behind a Domain (Free)

Behind every domain is an IP address, and behind every IP is a network owned by some organisation. Following that trail — domain → IP → ASN → owner — is one of the most common moves in OSINT and infrastructure research. Here's how to do it for free, using only public data.

Step 1: Domain to IP

Start by resolving the domain's A (IPv4) and AAAA (IPv6) records. That gives you the address(es) the domain currently points to. Note that big sites often sit behind CDNs (Cloudflare, Akamai), so the IP you see may belong to the CDN rather than the origin server.

Step 2: IP to geolocation, ISP and ASN

Once you have an IP, an IP lookup reveals its approximate geolocation, the ISP or hosting provider, the organisation, and the ASN. An ASN (Autonomous System Number) identifies the network operator that announces that block of IP addresses — for example, a cloud provider or a telecom.

Step 3: Pivot on the ASN and owner

The ASN and network owner let you understand the bigger picture: is the site on AWS, on a small VPS provider, or on the company's own network? Knowing the owner helps you distinguish a CDN edge from a real origin, and to spot when many domains share the same infrastructure.

What you can (and can't) conclude

• IP geolocation is approximate — it reflects the network's registration, not a precise physical location.
• A CDN IP tells you the CDN, not the true origin server.
• Shared hosting means one IP can serve thousands of unrelated sites.
• ASN + owner data is reliable for identifying the network operator.

Putting it together

1. Resolve the domain to its IP with a DNS lookup.
2. Run the IP through an IP lookup for geolocation, ISP, org and ASN.
3. Cross-check with WHOIS/RDAP for registration context.
4. Document the chain; infrastructure changes, so re-check over time.

This domain → IP → ASN → owner pivot is the backbone of infrastructure OSINT, and every step here is free and based entirely on public data.