IP WHOIS Lookup
Find out who owns any public IPv4 address - the organisation it is allocated to, the network range it sits in, and the abuse contact to report problems to.
About IP WHOIS Lookup
An IP WHOIS lookup answers a simple question with an authoritative source: which organisation is responsible for a given IPv4 address. Every routable address is allocated by a Regional Internet Registry (RIR), and those registries publish ownership records. This tool starts its query at IANA, then follows the referral chain to the RIR that actually holds the record - ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America, or AFRINIC for Africa - so you always land on the registry with the current data.
Two data sources are returned side by side. The classic WHOIS response is the free-form text served over TCP port 43, showing fields like the network range (inetnum/NetRange), the network name, and the registered organisation. Alongside it you get RDAP (Registration Data Access Protocol), the modern replacement that returns the same registry data as structured JSON with consistent, machine-readable fields. Having both lets you skim the human-friendly text or parse the exact field you need.
It is important to read the result for what it is: IP WHOIS identifies the network operator or the organisation the block is registered to, not the individual person browsing from that address, and not the content of any website hosted on it. For large providers you will often see the hosting company or ISP rather than their downstream customer. The abuse contact (abuse-c or OrgAbuseEmail) is the field to use when you need to report scanning, spam, or an attack coming from that address.
The lookup runs from our EU-based servers, so the outbound registry queries originate in Europe. There is no account, no tracking, and no third-party API in the path - you type an address, we query the registries, and we hand you the raw and structured results.
How to use it
- 1Enter the IPv4 address you want to investigate in dotted-quad form (for example 203.0.113.42).
- 2Run the lookup - the query begins at IANA and is referred automatically to the RIR that holds the record.
- 3Read the owning organisation and the allocated network range (the inetnum or NetRange / CIDR block).
- 4Note the abuse contact if you need to report activity from the address, and the technical contact for operational questions.
- 5Cross-check the raw WHOIS text against the structured RDAP fields to pull exactly the data you need.
Common use cases
- -Investigating the source of suspicious traffic, a brute-force login attempt, or an unexpected entry in your server logs.
- -Finding the correct abuse contact to report spam, port scanning, or an attack to the responsible network.
- -Confirming which ISP, hosting provider, or ASN is behind an address before adding it to an allow-list or deny-list.
- -Checking the size and boundaries of a network block so you know how many addresses a WHOIS record actually covers.
- -Doing due diligence on an IP range you are about to lease, peer with, or accept mail from.
Frequently asked questions
- What is an IP WHOIS lookup?
- An IP WHOIS lookup queries the internet's registration databases to reveal which organisation a public IP address is allocated to, the network range it belongs to, the responsible Regional Internet Registry, and the contacts for abuse and technical issues.
- What information does an IP WHOIS reveal?
- It reveals the registered organisation, the allocated network range (inetnum/CIDR), the network name, the responsible RIR, and the abuse and technical contact details. It does not reveal the individual end user or the content of any site hosted on the address.
- What is the difference between WHOIS and RDAP?
- WHOIS is the legacy protocol that returns free-form text over port 43, while RDAP is its modern replacement that returns the same registration data as structured JSON with standardised fields and queries. This tool returns both so you can read the text or parse the fields.
- Which registry holds an IP address record?
- It depends on the region: ARIN (North America), RIPE NCC (Europe and the Middle East), APNIC (Asia-Pacific), LACNIC (Latin America and Caribbean), or AFRINIC (Africa). The lookup starts at IANA and is referred to the correct RIR automatically.
- Can I find out who owns an IP address for free?
- Yes. Enter any public IPv4 address and this tool returns the owning organisation, network range, and abuse contact from the official registries at no cost and without an account.
- Does an IP WHOIS show the exact person behind the address?
- No. WHOIS identifies the organisation the address block is registered to - usually an ISP, hosting provider, or company - not the specific individual using it at any moment.