IP WHOIS Lookup

An IP WHOIS lookup shows which organisation an address block is registered to, not where a person is. Enter an IPv4 or IPv6 address and this page reads the record from the regional internet registry over RDAP: the network name, address range, organisation, country and abuse contact.

The five regional internet registries
RegistryRegion
ARINUnited States, Canada, parts of the Caribbean
RIPE NCCEurope, the Middle East, parts of Central Asia
APNICAsia Pacific
LACNICLatin America and parts of the Caribbean
AFRINICAfrica

Updated

Enter an address such as 8.8.8.8 or 2001:4860:4860::8888. Your browser asks rdap.org, which forwards the question to whichever of the five registries manages that block. Nothing is stored on our side.

What the fields mean

The network name and handle identify the record inside the registry. The range and CIDR show every address the record covers; a small block usually means a customer assignment, a very large one means the provider's own allocation.

Type values such as direct allocation or assigned PA show how the block was handed out. They help tell a provider's own space from space it lent to a customer.

Using it with your own website

Look up the address your domain's A record points to with the DNS lookup tool, then check it here to confirm which host or CDN actually serves the site. That is useful when you take over a site and nobody remembers where it is hosted.

How it works

  1. Type an IPv4 or IPv6 address.
  2. The page asks rdap.org for the IP's RDAP record and follows its redirect to the registry that holds the block.
  3. It reads the network name, start and end address, CIDR prefix, country and the contacts listed on the record.
  4. It shows the abuse email when the registry lists one, which is the right place to report spam or attacks from that address.

Tips

  • The organisation is usually the hosting company or internet provider, not the website or person using the address. To report a site, write to the abuse contact.
  • The country on the record is where the block is registered, which can differ from where a server sits.
  • Cloud providers and CDNs own huge blocks. A Cloudflare or AWS result means the real server is behind that provider.
  • Private ranges such as 10.x.x.x, 172.16-31.x.x and 192.168.x.x are not registered to anyone and return no record.

Frequently asked questions

Can an IP WHOIS lookup find a person's address?

No. Registry records name the organisation that holds the address block, typically an internet provider or hosting company. Only that provider can connect an address to a customer, and it will normally do so only for law enforcement.

How do I report abuse from an IP address?

Email the abuse contact shown on the record with the date, time and time zone, the IP address and evidence such as log lines or email headers. Providers act faster on reports with exact timestamps.

What is a CIDR prefix?

A compact way to write an address range. 8.8.8.0/24 means the first 24 bits are fixed, which covers 256 addresses from 8.8.8.0 to 8.8.8.255.

Why does the record show a different country from a geolocation site?

The registry records where the block was assigned. Geolocation databases estimate where an address is used from other signals, and large networks often use addresses away from where they were registered.

Related: What an IP address is, Reverse DNS lookup, DNS lookup, A record vs CNAME, Email header analyzer.

Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.

More in Free Tools

Product

Who It's For

Features

Resources

Company

View Sitemap