IP & ASN WHOIS Lookup

Query Regional Internet Registries (RIR) for ownership and allocation data of IP addresses or domains.

About IP WHOIS (RDAP)

Unlike Domain WHOIS which queries registrars (like GoDaddy or Namecheap), IP WHOIS queries Regional Internet Registries (RIRs) such as ARIN (North America), RIPE NCC (Europe/Middle East), APNIC (Asia Pacific), LACNIC (Latin America), and AFRINIC (Africa).

This tool uses the Registration Data Access Protocol (RDAP) format, which is the modern JSON-based successor to the traditional port-43 plaintext WHOIS protocol. It provides structured data about IP block allocations, routing entities, and abuse contacts for network administrators.

Our IP WHOIS Lookup queries the regional internet registries to identify who owns an IP address — the organisation, the allocated network range, the responsible registry and the abuse contact you need in order to report malicious activity.

What is IP WHOIS?

IP WHOIS reveals who an IP address block is allocated to. It is distinct from domain WHOIS, which covers domain name registrations, and it is served by different organisations entirely.

Five regional internet registries divide the world between them: ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America and AFRINIC for Africa. Each maintains authoritative records for the address space allocated to its region.

A lookup returns the organisation holding the block, the CIDR range allocated, the registry responsible, and contact addresses including one specifically for abuse reports. Where a provider has sub-allocated space to a customer, the record may show the downstream organisation rather than the provider.

Identifies which organisation an IP block is allocated to
Served by five regional internet registries, not by domain registrars
Returns the CIDR range, not just the single address
Publishes an abuse contact for reporting malicious traffic
Sub-allocations may show a downstream customer organisation

Why IP WHOIS Matters

When you are investigating hostile traffic, IP WHOIS tells you who to contact. Every allocated block has a published abuse address, and reporting to it is the established route for getting a compromised host cleaned up or a malicious customer removed.

It is also how you tell what kind of address you are dealing with. A block allocated to a well-known hosting provider means the traffic came from a rented server. A block allocated to a consumer ISP suggests a residential connection, quite possibly a compromised machine. A block allocated directly to a named corporation tells you the traffic came from that organisation network. Each implies a different response.

Provides the abuse contact for reporting malicious activity
Distinguishes hosting, consumer and corporate address space
Shows the full allocated range, useful for blocking decisions
Reveals the organisation behind an attack source
Helps assess whether traffic is from a datacentre or a home connection

How This IP WHOIS Lookup Works

The tool identifies the responsible registry and queries it for the allocation record.

Validates the IP address input against format and SSRF safety checks
Determines which regional internet registry holds the address space
Queries that registry for the allocation record
Extracts the organisation, CIDR range and allocation details
Returns the published abuse and technical contacts

How to Use the IP WHOIS Lookup

Enter an IPv4 or IPv6 address in the input field
Run the lookup to query the responsible registry
Review the organisation the block is allocated to
Note the CIDR range, which shows how much space is involved
Use the abuse contact if you need to report malicious activity

Understanding Your IP WHOIS Results

The record describes the allocation and who is responsible for it:

Field / Value	Meaning
`Organisation`	The entity the block is allocated to. A hosting provider, an ISP, or a corporation holding its own address space directly.
`CIDR range`	The network block containing this address, such as 203.0.113.0/24. Useful when deciding whether to block a single address or a wider range.
`Registry`	Which regional registry is authoritative — ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC. It indicates the broad geographic region of allocation.
`Abuse contact`	The address for reporting malicious activity from this block. Registries require it to be maintained and responsive.
`Allocation date`	When the block was assigned. Recently allocated space sometimes carries reputation problems inherited from previous holders.
`Sub-allocation`	Where a provider has delegated part of its space to a customer, the record may name that customer rather than the provider.
`Network type`	Whether the allocation looks like hosting, consumer broadband or corporate space. Often the most immediately useful judgement from the record.

Common Problems & How to Fix Them

Most attack traffic originates from rented infrastructure, so the provider appears in WHOIS rather than the person responsible.

This is exactly why the abuse contact exists. Report to the provider with specific evidence — timestamps, log excerpts, the nature of the activity — and they will act against the customer. Providers act considerably faster on reports containing concrete evidence.

Registries require a working abuse address, so a bouncing one is itself reportable.

Escalate to the regional registry, which can act against members that fail to maintain contacts. In the meantime, the upstream provider named in the ASN record is often a more responsive route than the direct allocation holder.

When a provider delegates space, WHOIS may show the downstream organisation, which can be a shell company or an unresponsive reseller.

Look up the ASN to find the upstream provider announcing the route. They have the technical ability to act and a commercial relationship with whoever holds the sub-allocation.

All regional registries limit query volume to prevent bulk harvesting of contact data.

Space out lookups rather than querying in rapid succession. For programmatic use, RDAP is the structured successor to WHOIS and generally has clearer rate limit behaviour and consistent JSON output.

IPv6 allocations are typically much larger and less finely sub-delegated, so records are often coarser and identify only the provider.

Use the ASN data alongside it. For IPv6 the routing information frequently tells you more about who is responsible than the allocation record does.

Best Practices

Use the published abuse contact when reporting malicious activity
Include timestamps, log excerpts and specific evidence in any report
Check the CIDR range before blocking, so you know how much space is affected
Look up the ASN alongside WHOIS for a fuller picture
Distinguish hosting, consumer and corporate space before deciding how to respond
Use RDAP rather than WHOIS for programmatic queries
Respect registry rate limits by spacing out bulk lookups

Security Recommendations

Remember the registered organisation is usually the infrastructure provider, not the attacker
Block at the narrowest effective scope — blocking an entire allocation may exclude many legitimate users
Escalate to the regional registry when an abuse contact is unresponsive, since maintaining one is a membership obligation
Be aware that attackers frequently rent from providers with weak abuse handling, so response times vary enormously
Cross-reference with blacklist and reputation data before acting on WHOIS alone
Treat corporate address space differently from hosting space, since traffic from it may indicate a compromised internal machine

Frequently Asked Questions

Domain WHOIS covers domain name registrations and is served by registrars. IP WHOIS covers IP address allocations and is served by the five regional internet registries. They are entirely separate systems with different data and different operators.

ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America and the Caribbean, and AFRINIC for Africa. Each holds authoritative records for its region address space.

Use the abuse contact published in the IP WHOIS record. Include the exact timestamps, the nature of the activity and supporting log evidence. Reports with concrete evidence are acted on far more quickly than assertions alone.

Because most attack traffic comes from rented servers. The provider holds the address allocation, so they appear in the record. Reporting to their abuse contact is the intended mechanism for reaching the actual customer.

It is the network block containing the address, written as a prefix such as 203.0.113.0/24. It matters because it tells you how much address space the same organisation controls, which informs whether to block one address or a wider range.

The Registration Data Access Protocol, a modern replacement for WHOIS that returns structured JSON with consistent formatting and clearer access control. All the regional registries now support it, and it is preferable for programmatic use.

Not from WHOIS. It identifies the organisation holding the allocation, not an individual subscriber. Linking an address to a person requires the ISP records, which are only disclosed through legal process.