By Debmedia Technologies LLP · Kolkata, India · Updated
What Is an IP WHOIS Lookup?
An IP WHOIS lookup shows who an IP address block is registered to. Every public address belongs to a block that a regional internet registry assigned to an organisation, such as an internet provider, a hosting company or a large business. The lookup reads that registration record.
It is the standard first step when you want to report abuse, understand where traffic comes from or confirm that an address really belongs to a company.
How to Use This IP WHOIS Lookup
- Enter an IPv4 address, for example 8.8.8.8.
- Press Lookup WHOIS. The tool finds the right regional registry and asks it.
- Read the network details, then the public contacts.
- For an IPv6 address, use the IPv6 version of this tool.
What the Result Fields Mean
| Field | Meaning |
|---|---|
| Network name | The name the owner gave to the address block. |
| Address range and CIDR | The first and last address of the block, and its size in CIDR form. |
| Country | The country where the block was registered. It is not always where the servers are. |
| Type | Whether the block is allocated to a provider or assigned to an end user. |
| Registration and last changed | When the record was created and last updated. |
| Contacts | Public organisation, abuse and technical contacts, where the registry shows them. |
The Five Regional Registries
- ARIN: North America.
- RIPE NCC: Europe, the Middle East and parts of Central Asia.
- APNIC: Asia and the Pacific, including India.
- LACNIC: Latin America and the Caribbean.
- AFRINIC: Africa.
The tool reads the official directory of these registries and queries the right one through RDAP, the modern format defined in RFC 9083, the RDAP response format used here.
When to Use It
Reporting abuse
If spam or attacks come from an address, send your report to the abuse contact in the result. Include log lines and time stamps.
Investigating a visitor or a login
The owner tells you whether an address belongs to a home provider, a cloud host or a known service. Combine it with the reverse DNS lookup for more clues.
Checking an email source
After reading the Received lines of a message with the header tracing tool, look up each public address here to see who ran the server.
Remember that WHOIS shows the registered owner of a block, not the individual person using an address.
Keep These Limits in Mind
A single IP WHOIS lookup gives the registered owner of a block, which may be a provider that rents the address to thousands of customers. Cloud and hosting networks show the company, not the tenant. Addresses behind a content delivery network show the network operator. Always combine the result with logs, time stamps and the abuse contact before you draw conclusions about who is behind a connection.
Frequently Asked Questions
Disclaimer: results come from live requests and can change as records and servers change. We cannot guarantee that every answer matches what every visitor sees.