IP WHOIS lookup
IP WHOIS Lookup
Look up which network an IP address belongs to — the block, the organisation it is registered to, the regional registry and the abuse contact — queried over RDAP, straight from the registry.
What This Tool Does
Every public IP address belongs to a block, and every block was issued to an organisation by one of five regional internet registries. This tool asks the responsible registry what it holds for the block containing your address.
The registry is not guessed. IANA publishes which registry each range of address space was delegated to, and the query goes to that one. It uses RDAP, the structured successor to port-43 WHOIS, so fields arrive named and typed and nothing depends on parsing free text.
Five things are reported: the network block, the organisation it is registered to, the registry that holds the record, the type and date of the allocation, and the abuse contact. IPv4 and IPv6 addresses are both supported.
How to Read Your Results
Network
The block your address sits in, in CIDR notation such as 8.8.8.0/24. The number after the slash is how many leading bits are fixed: a /24 is 256 addresses, a /16 is 65,536. The registry answers with the most specific block it has a record for, so a small block inside a larger one is reported as the small one.
The network name alongside it is a label the holder chose. It is often an abbreviation and carries no formal meaning.
Registered to
The organisation the registry records as holding the block. This is the network operator, not the user of the address. For a website it is almost always the hosting company or CDN. For a home or office connection it is the internet provider.
Where the registry names no organisation, the row says not published. That is reported as it is and not filled in from elsewhere.
Registry
Which of the five regional registries holds the record, and the country code the block is registered under where one is published. The country is an administrative fact about the registration. It is not a measurement of where the address is in use.
Allocation
The type of block in the registry’s own terminology, and the year it was registered. The wording differs by registry — DIRECT ALLOCATION at ARIN, ASSIGNED PA at RIPE NCC — but the distinction underneath is the same. An allocation is space issued to an operator to distribute. An assignment is space in use by a single network.
A status other than active is flagged. It is rare, and usually means the block is being transferred or has been reclaimed.
Abuse contact
The email address the operator publishes for reports of spam, scanning and attacks. A block with no abuse address is flagged as a warning, because it leaves nowhere to send a report.
Common Problems and Fixes
The result names my host, not me
That is correct. You rent the address; the host holds it. If you need to show which site is on an address, the DNS Checker shows which address a domain points to, and the WHOIS Lookup shows who registered the domain.
The address belongs to a CDN
A site behind a CDN or proxy answers from the CDN’s addresses, so the lookup names the CDN and says nothing about the server behind it. The origin is hidden by design. An abuse report still goes to the CDN, which forwards it to its customer.
The address is private or reserved
Addresses beginning 10., 192.168. and 172.16. through 172.31. are private and are reused inside millions of networks. No registry holds a record for them. In a server log, a private address means the request came through a proxy or load balancer, and the real client address is in a forwarded header.
The country does not match where the server is
The country code is where the holder registered the block. Large providers register space in one country and announce it from data centres in many. If you need to know where a server responds from, measure it: the Website Speed Test reports response time by region.
An abuse report got no answer
Check that the report carried the address, a timestamp with timezone, and evidence. If it did, try the block’s other contacts listed in the transcript. The parent handle shown there identifies the larger block this one was carved from, and the provider holding that block has an abuse desk of its own.
The registry returned no record
The address is in space a registry is responsible for but has not issued, or has taken back. Traffic claiming to come from such an address is worth treating with suspicion, since nobody is entitled to be using it.
What This Tool Cannot Tell You
- Who is using the address. Only the operator knows which customer holds it, and it will not say without a legal request.
- Where the address is. There is no geolocation here. A registered country is not a location.
- Which websites are on it. Many sites can share one address, and the registry has no record of any of them.
- Who announces the block on the internet. Routing and autonomous system data are a separate system from registration, and are not queried.
- Previous holders. Only the current record is published.
- Anything about a domain. Enter a domain and you are pointed to the WHOIS Lookup, which is the right tool for it.
Frequently Asked Questions
What is an IP WHOIS lookup?
It asks the regional internet registry responsible for an address what it holds on record: the block the address sits in, the organisation that block was issued to, when it was registered, and who to contact about abuse.
This tool queries over RDAP, the structured protocol that replaced port-43 WHOIS. The registry is found from IANA's published delegations, so the answer comes from the authoritative source for that address and not from a third-party database.
Does this show who owns an IP address?
It shows who the block is registered to, which is the network operator. For most addresses that is a hosting company, a cloud provider or an internet provider.
It does not show who is using the address. A website on rented hosting shows its host here. A home connection shows the internet provider. The person or company at the end of the line is known only to that operator, and the registry does not hold it.
Can I find the location of an IP address with this?
No, and nothing here should be read as a location. Some registries publish a country code for a block, which is the country the holder registered it in. A provider registered in one country routinely uses addresses in another.
Maps that place an IP address in a city come from commercial geolocation databases built on inference. Those are estimates. This tool reports what the registry holds and does not estimate.
How do I report abuse from an IP address?
Send the report to the abuse contact shown in the result. That address belongs to the network operator's abuse desk, which is the only party able to act against their customer.
Include the IP address, the date and time with its timezone, and the log lines or message headers that show what happened. A complaint without evidence is normally discarded, and the operator will not tell you who their customer is.
Why does my own website's IP address show a hosting company?
Because the hosting company holds the address and lends it to you while you are a customer. Addresses are issued to network operators in blocks, and a block stays registered to the operator however many customers pass through it.
That is also why an address can change hands without the record changing: the next customer on that address gets the same lookup result you did.
What is the difference between a domain WHOIS and an IP WHOIS?
They are separate systems that share a name. A domain lookup asks a domain registry who registered a name, through which registrar, and when it expires. An IP lookup asks an address registry which network a number belongs to.
The two records for one website usually name different companies: the domain record names the registrar, and the IP record names the host. Neither is wrong.
Why is there no result for 192.168.1.1 or 10.0.0.1?
Those are private addresses. The ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are reserved for use inside private networks, and every home router and office network reuses them.
No registry holds a record for a private address because it is not allocated to anyone. If you see one in a log, the traffic came from inside your own network or through a proxy that recorded its internal address.
Which regional registry will answer?
One of five. ARIN covers the United States, Canada and parts of the Caribbean. RIPE NCC covers Europe, the Middle East and Central Asia. APNIC covers Asia and the Pacific. LACNIC covers Latin America and the Caribbean. AFRINIC covers Africa.
The registry reflects where the block was issued, not where it is used today. Address space is transferred between regions, and where that has happened the query is redirected and the transcript names the service that finally answered.