IP WHOIS Lookup

Find the registered holder of an IP address block — organization, network name, allocated range and registry — together with the network that routes it.

Try: 8.8.8.8 · 1.1.1.1 · 2001:4860:4860::8888 · AS15169

WHOIS and RDAP

Public IP address space is allocated by five regional internet registries: ARIN (North America), RIPE NCC (Europe, Middle East and Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America and the Caribbean) and AFRINIC (Africa). Each keeps a public record of who holds every block.

Those records were traditionally queried with the text-based WHOIS protocol. Registries now also serve them through RDAP, a structured, standardized replacement. IPDebrief uses registration data to fill in the ownership section of each profile.

Reading the result

Organization — the legal holder of the block, often an ISP, cloud provider or enterprise.
Network name — a short handle the holder chose for the range.
Allocated block — the CIDR range the address falls in; sub-allocations to customers are common, so a smaller, more specific block may name the actual user.
Registry — which of the five RIRs holds the record.
ASN — the network that routes the block, which can differ from the holder.

Reporting abuse

To report abuse from an address, contact the network that operates it — usually the organization or ASN shown in its profile — through the abuse contact published in the registry record. Include timestamps with time zones and log excerpts.

When registration data changes

IPv4 addresses are scarce, so blocks are bought, sold, leased and transferred between organizations and even between registries. After a transfer, the registration record, the announcing ASN and the geolocation can change at different times, and older reputation data may describe the previous holder rather than the current one.

IPDebrief tracks ownership changes over time. When an address has recently changed hands, treat old blocklist listings with caution and expect geolocation to catch up over the following weeks. Frequent ownership churn — a block that moves between holders repeatedly — is itself a signal sometimes associated with leased address space used for spam or bulletproof hosting.

Frequently asked questions

Does IP WHOIS show the person using the address?

No. It shows the organization holding the address block, typically the internet provider or hosting company, not the individual customer.

Why is the WHOIS owner different from the company I expected?

Addresses are often sub-allocated: a hosting provider or ISP holds the block and assigns parts of it to customers who may not be listed.

What is the difference between domain WHOIS and IP WHOIS?

Domain WHOIS covers domain name registrations held by registrars. IP WHOIS covers address blocks held by the regional internet registries.

How current is the registration data?

Profiles refresh registration data periodically and show when the profile was last updated.