IP WHOIS Lookup
Enter an IP address to fetch its WHOIS registration details from the regional internet registry.
About the IP WHOIS Lookup tool
Every block of IP addresses is allocated by one of the five regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC). A WHOIS lookup queries that registry to show who an address block belongs to. This tool uses RDAP, the modern, structured successor to legacy WHOIS, to return the registry, the network name and CIDR range, the owning organisation, the country and the registration or update dates.
How to use it
- Enter an IP address such as
8.8.8.8in the field. - Submit to query the registry that controls that block.
- Read the network name, organisation, range and abuse contact in the result.
Network admins use this to find the right abuse contact when reporting unwanted traffic, and analysts use it to confirm which company actually owns a server. Note that registration data describes the allocated block, not necessarily the end user behind a single address, and some registries redact organisation details for privacy. The IP you enter is sent to our server only to run the lookup against the registry, and is not stored.
Frequently asked questions
What is the difference between IP WHOIS and domain WHOIS?
IP WHOIS looks up who an IP address block is registered to at a regional internet registry. Domain WHOIS looks up who registered a domain name through a registrar. They query different systems.
What is RDAP and why use it over classic WHOIS?
RDAP (Registration Data Access Protocol) returns the same registry data in a structured, machine-readable format with consistent fields and proper internationalisation, replacing the inconsistent free-text of legacy WHOIS.
How do I find the abuse contact for an IP?
The WHOIS record for the address block usually lists an abuse or technical contact for the owning organisation. That is the address to use when reporting spam, scanning or attacks from that IP.
Why does the WHOIS show a large range, not just my IP?
Registries allocate addresses in blocks (CIDR ranges) to networks, so the record describes the whole block containing your IP, identifying the operator rather than the individual address.