IP WHOIS

Regional registry information for any IP address — which of the five Regional Internet Registries (RIRs) allocated it, its network block, and operator.

What is an IP WHOIS lookup?

An IP WHOIS lookup shows registry information about the block of addresses an IP belongs to. Every public IP address is distributed by one of five regional internet registries, and the IP WHOIS record tells you which registry it is, which network operates the block, its ASN, the registered country and when the block was allocated.

It answers the question "who is responsible for this network?", which is the starting point for reporting abuse or understanding unfamiliar traffic.

How IP address registration works

The Internet Assigned Numbers Authority (IANA) hands large pools of addresses to five regional internet registries (RIRs). Each RIR serves one part of the world:

  • ARIN: the United States, Canada and parts of the Caribbean.
  • RIPE NCC: Europe, the Middle East and Central Asia.
  • APNIC: the Asia-Pacific region.
  • LACNIC: Latin America and parts of the Caribbean.
  • AFRINIC: Africa.

The registries then allocate blocks to internet providers, hosting companies and large organisations, which may divide them further for their customers.

How to use the IP WHOIS tool

  1. Enter a public IPv4 or IPv6 address, for example 8.8.8.8.
  2. Press Lookup IP WHOIS.
  3. Read the registry, country, network block, operator, ASN and allocation date.
  4. For the complete record, including abuse contacts, query the registry WHOIS server shown at the bottom of the table.

What the IP WHOIS results mean

Regional registry and country

The registry shows which RIR the block came from. The country is the one recorded for the allocation, which is not necessarily where a server physically sits.

Network block, operator and ASN

The network block is the routed range that contains the address, written in CIDR notation. The operator is the registered name of the network that announces it, identified by its ASN.

Allocation date

The date the registry first allocated the block. Older blocks are common for long-established providers, while recent dates often belong to newer networks or to blocks that were transferred.

Full registry WHOIS

This summary comes from Team Cymru's routing-based service, which is fast and consistent. The full record, with organisation details and abuse contacts, lives on the registry's own WHOIS server, which the result names, for example whois.ripe.net.

Reading the full registry record

When you query a registry's WHOIS server yourself, the field names depend on the registry. ARIN records use fields such as NetRange, OrgName and OrgAbuseEmail, while RIPE NCC records use inetnum, netname and abuse-mailbox. The abuse contact is the right place to report spam, scanning or attacks from an address.

All five registries also publish their records through RDAP, the structured successor to WHOIS, which returns the same information in a consistent format.

Common uses

  • Finding the network to contact about abuse coming from an address.
  • Checking which provider owns a range before allowing it through a firewall.
  • Understanding traffic in server logs during an investigation.
  • Finding out when a network block was first allocated, for example when reviewing an unfamiliar provider.

Common problems and fixes

"Non-public address". Private and reserved ranges are not registered with any RIR, so there is nothing to look up.

The operator is a large cloud provider. The address belongs to a customer of that provider. Report abuse to the provider, which can act on its customer.

Some fields say "Not available". The routing data did not include them. Query the registry's WHOIS server for the full record.

Related tools

Frequently asked questions

What is the difference between IP WHOIS and domain WHOIS?

Domain WHOIS describes the registration of a domain name: its registrar, dates and nameservers. IP WHOIS describes the registration of a block of IP addresses: the regional registry, the network operator and its ASN. They come from different registries and answer different questions.

Which regional internet registry handles an IP address?

It depends on where the block was first allocated. ARIN covers North America, RIPE NCC Europe and the Middle East, APNIC the Asia-Pacific region, LACNIC Latin America and AFRINIC Africa. The tool shows the registry for each address, together with its registry WHOIS server.

How do I report abuse from an IP address?

Use the IP WHOIS result to find the operator and registry, then query the registry's WHOIS server for the abuse contact listed on the record. Send a clear, factual report with timestamps, including the time zone, and relevant log lines. Large providers usually have an abuse form on their website as well.

Does IP WHOIS show who is using an address?

It shows the network operator responsible for the block, such as an internet provider or hosting company, not the individual customer using the address. Providers keep customer assignments private. Contact the operator if you need action taken about specific traffic.

Why does the country differ from where the server is?

The country is the one recorded when the registry allocated the block. Global networks often register blocks in one country and use them in data centres around the world, and blocks can also be transferred between regions. Treat the country as registration data, not a physical location.

Why is this not the full WHOIS record?

The summary uses Team Cymru's routing-based data, which is fast and consistent across all five registries. Each registry's full record contains more fields, such as organisation contacts and abuse addresses. The tool shows which registry WHOIS server to query for the complete, authoritative record.

Can I look up an IPv6 address with IP WHOIS?

Yes. Enter the IPv6 address in its normal form, for example 2001:4860:4860::8888. The same registry information is shown: registry, country, network block, operator, ASN and allocation date. Private and reserved IPv6 ranges, like their IPv4 equivalents, have no registry record.