IP Whois lookup

Who owns this IP address, and where do I report abuse from it?

Pass

No problems found for 104.16.0.0 - 104.31.255.255.

0 fail · 0 warning · 0 pass · 1 note

Report abuse

The contact this network registered for abuse reports. Include timestamps with the time zone, the address itself and the log lines that show the activity.

Note
F1Report abuse to abuse@cloudflare.com
This is the contact the network operator registered for abuse reports. Include timestamps (with time zone), the IP and log excerpts.
FixSend the report to abuse@cloudflare.com.
Why this matters and how to fix it →

Registration

Field	Value
Network	104.16.0.0 - 104.31.255.255
CIDR	104.16.0.0
Network name	CLOUDFLARENET
Network type	DIRECT ALLOCATION
Registry	ARIN
IP version	v4
Registered	2014-03-28T11:30:55-04:00
Last changed	2024-09-04T06:51:26-04:00
registrant	Cloudflare, Inc.
abuse	Abuse — abuse@cloudflare.com — +1-650-319-8930
technical	Admin — rir@cloudflare.com — +1-650-319-8930
noc	NOC — noc@cloudflare.com — +1-650-319-8930

Raw data

{
  "found": true,
  "summary": {
    "name": "CLOUDFLARENET",
    "handle": "NET-104-16-0-0-1",
    "updated": "2024-09-04T06:51:26-04:00",
    "created": "2014-03-28T11:30:55-04:00",
    "status": [
      "active"
    ],
    "network": "104.16.0.0 - 104.31.255.255",
    "cidr": [
      "104.16.0.0"
    ],
    "ipVersion": "v4",
    "networkType": "DIRECT ALLOCATION",
    "entities": [
      {
        "role": [
          "registrant"
        ],
        "name": "Cloudflare, Inc.",
        "lastChanged": "2024-11-25T11:09:46-05:00"
      },
      {
        "role": [
          "abuse"
        ],
        "name": "Abuse",
        "email": "abuse@cloudflare.com",
        "phone": "+1-650-319-8930",
        "lastChanged": "2024-09-04T13:14:53-04:00"
      },
      {
        "role": [
          "technical"
        ],
        "name": "Admin",
        "email": "rir@cloudflare.com",
        "phone": "+1-650-319-8930",
        "lastChanged": "2026-06-12T04:48:05-04:00"
      },
      {
        "role": [
          "noc"
        ],
        "name": "NOC",
        "email": "noc@cloudflare.com",
        "phone": "+1-650-319-8930",
        "lastChanged": "2026-04-30T05:15:18-04:00"
      }
    ],
    "remarks": [
      "All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse",
      "Geofeed: https://api.cloudflare.com/local-ip-ranges.csv"
    ],
    "notices": [
      "By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use",
      "If you see inaccuracies in the results, please visit: ",
      "Copyright 1997-2026, American Registry for Internet Numbers, Ltd."
    ],
    "registry": "ARIN"
  },
  "raw": {
    "arin_originas0_originautnums": [],
    "cidr0_cidrs": [
      {
        "v4prefix": "104.16.0.0",
        "length": 12
      }
    ],
    "endAddress": "104.31.255.255",
    "entities": [
      {
        "entities": [
          {
            "events": [
              {
                "eventAction": "last changed",
                "eventDate": "2026-08-23T22:28:37-04:00"
              },
              {
                "eventAction": "registration",
                "eventDate": "2021-07-01T14:10:58-04:00"
              }
            ],
            "handle": "CLOUD146-ARIN",
            "links": [
              {
                "href": "https://rdap.arin.net/registry/entity/CLOUD146-ARIN",
                "rel": "self",
                "type": "application/rdap+json",
                "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
              },
              {
                "href": "https://whois.arin.net/rest/poc/CLOUD146-ARIN",
                "rel": "alternate",
                "type": "application/xml",
                "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
              }
            ],
            "objectClassName": "entity",
            "port43": "whois.arin.net",
            "roles": [
              "noc",
              "routing"
            ],
            "status": [
              "validated"
            ],
            "vcardArray": [
              "vcard",
              [
                [
                  "version",
                  {},
                  "text",
                  "4.0"
                ],
                [
                  "adr",
                  {
                    "label": "101 Townsend St\nSan Francsico\nCA\n94107\nUnited States"
                  },
                  "text",
                  [
                    "",
                    "",
                    "",
                    "",
                    "",
                    "",
                    ""
                  ]
                ],
                [
                  "fn",
                  {},
                  "text",
                  "Cloudflare-NOC"
                ],
                [
                  "org",
                  {},
                  "text",
                  "Cloudflare, Inc"
                ],
                [
                  "kind",
                  {},
                  "text",
                  "group"
                ],
                [
                  "email",
                  {},
                  "text",
                  "noc@cloudflare.com"
                ],
                [
                  "tel",
                  {
                    "type": [
                      "work",
                      "voice"
                    ]
                  },
                  "text",
                  "+1-650-319-8930"
                ]
              ]
            ]
          },
          {
            "events": [
              {
                "eventAction": "last changed",
                "eventDate": "2024-09-04T13:14:53-04:00"
              },
              {
                "eventAction": "registration",
                "eventDate": "2011-02-14T19:00:47-05:00"
              }
            ],
            "handle": "ABUSE2916-ARIN",
            "links": [
              {
                "href": "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN",
                "rel": "self",
                "type": "application/rdap+json",
                "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
              },
              {
                "href": "https://whois.arin.net/rest/poc/ABUSE2916-ARIN",
                "rel": "alternate",
                "type": "application/xml",
                "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
              }
            ],
            "objectClassName": "entity",
            "port43": "whois.arin.net",
            "remarks": [
              {
                "description": [
                  "All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse"
                ],
                "title": "Registration Comments"
              },
              {
                "description": [
                  "ARIN has attempted to validate the data for this POC, but has received no response from the POC since 2025-09-04"
                ],
                "title": "Unvalidated POC"
              }
            ],
            "roles": [
              "abuse"
            ],
            "vcardArray": [
              "vcard",
              [
                [
                  "version",
                  {},
                  "text",
                  "4.0"
                ],
                [
                  "adr",
                  {
                    "label": "101 Townsend Street\nSan Francisco\nCA\n94107\nUnited States"
                  },
                  "text",
                  [
                    "",
                    "",
                    "",
                    "",
                    "",
                    "",
                    ""
                  ]
                ],
                [
                  "fn",
                  {},
                  "text",
                  "Abuse"
                ],
                [
                  "org",
                  {},
                  "text",
                  "Cloudflare, Inc."
                ],
                [
                  "kind",
                  {},
                  "text",
                  "group"
                ],
                [
                  "email",
                  {},
                  "text",
                  "abuse@cloudflare.com"
                ],
                [
                  "tel",
                  {
                    "type": [
                      "work",
                      "voice"
                    ]
                  },
                  "text",
                  "+1-650-319-8930"
                ]
              ]
            ]
          },
          {
            "events": [
              {
                "eventAction": "last changed",
                "eventDate": "2026-06-12T04:48:05-04:00"
              },
              {
                "eventAction": "registration",
                "eventDate": "2011-04-19T16:11:36-04:00"
              }
            ],
            "handle": "ADMIN2521-ARIN",
            "links": [
              {
                "href": "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN",
                "rel": "self",
                "type": "application/rdap+json",
                "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
              },
              {
                "href": "https://whois.arin.net/rest/poc/ADMIN2521-ARIN",
                "rel": "alternate",
                "type": "application/xml",
                "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
              }
            ],
            "objectClassName": "entity",
            "port43": "whois.arin.net",
            "remarks": [
              {
                "description": [
                  "All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse"
                ],
                "title": "Registration Comments"
              }
            ],
            "roles": [
              "administrative",
              "technical"
            ],
            "status": [
              "validated"
            ],
            "vcardArray": [
              "vcard",
              [
                [
                  "version",
                  {},
                  "text",
                  "4.0"
                ],
                [
                  "adr",
                  {
                    "label": "101 Townsend Street\nSan Francisco\nCA\n94107\nUnited States"
                  },
                  "text",
                  [
                    "",
                    "",
                    "",
                    "",
                    "",
                    "",
                    ""
                  ]
                ],
                [
                  "fn",
                  {},
                  "text",
                  "Admin"
                ],
                [
                  "org",
                  {},
                  "text",
                  "Cloudflare, Inc."
                ],
                [
                  "kind",
                  {},
                  "text",
                  "group"
                ],
                [
                  "email",
                  {},
                  "text",
                  "rir@cloudflare.com"
                ],
                [
                  "tel",
                  {
                    "type": [
                      "work",
                      "voice"
                    ]
                  },
                  "text",
                  "+1-650-319-8930"
                ]
              ]
            ]
          }
        ],
        "events": [
          {
            "eventAction": "last changed",
            "eventDate": "2024-11-25T11:09:46-05:00"
          },
          {
            "eventAction": "registration",
            "eventDate": "2010-07-09T14:10:42-04:00"
          }
        ],
        "handle": "CLOUD14",
        "links": [
          {
            "href": "https://rdap.arin.net/registry/entity/CLOUD14",
            "rel": "self",
            "type": "application/rdap+json",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          },
          {
            "href": "https://whois.arin.net/rest/org/CLOUD14",
            "rel": "alternate",
            "type": "application/xml",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          }
        ],
        "objectClassName": "entity",
        "port43": "whois.arin.net",
        "roles": [
          "registrant"
        ],
        "vcardArray": [
          "vcard",
          [
            [
              "version",
              {},
              "text",
              "4.0"
            ],
            [
              "fn",
              {},
              "text",
              "Cloudflare, Inc."
            ],
            [
              "adr",
              {
                "label": "101 Townsend Street\nSan Francisco\nCA\n94107\nUnited States"
              },
              "text",
              [
                "",
                "",
                "",
                "",
                "",
                "",
                ""
              ]
            ],
            [
              "kind",
              {},
              "text",
              "org"
            ]
          ]
        ]
      },
      {
        "events": [
          {
            "eventAction": "last changed",
            "eventDate": "2024-09-04T13:14:53-04:00"
          },
          {
            "eventAction": "registration",
            "eventDate": "2011-02-14T19:00:47-05:00"
          }
        ],
        "handle": "ABUSE2916-ARIN",
        "links": [
          {
            "href": "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN",
            "rel": "self",
            "type": "application/rdap+json",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          },
          {
            "href": "https://whois.arin.net/rest/poc/ABUSE2916-ARIN",
            "rel": "alternate",
            "type": "application/xml",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          }
        ],
        "objectClassName": "entity",
        "port43": "whois.arin.net",
        "remarks": [
          {
            "description": [
              "All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse"
            ],
            "title": "Registration Comments"
          },
          {
            "description": [
              "ARIN has attempted to validate the data for this POC, but has received no response from the POC since 2025-09-04"
            ],
            "title": "Unvalidated POC"
          }
        ],
        "roles": [
          "abuse"
        ],
        "vcardArray": [
          "vcard",
          [
            [
              "version",
              {},
              "text",
              "4.0"
            ],
            [
              "adr",
              {
                "label": "101 Townsend Street\nSan Francisco\nCA\n94107\nUnited States"
              },
              "text",
              [
                "",
                "",
                "",
                "",
                "",
                "",
                ""
              ]
            ],
            [
              "fn",
              {},
              "text",
              "Abuse"
            ],
            [
              "org",
              {},
              "text",
              "Cloudflare, Inc."
            ],
            [
              "kind",
              {},
              "text",
              "group"
            ],
            [
              "email",
              {},
              "text",
              "abuse@cloudflare.com"
            ],
            [
              "tel",
              {
                "type": [
                  "work",
                  "voice"
                ]
              },
              "text",
              "+1-650-319-8930"
            ]
          ]
        ]
      },
      {
        "events": [
          {
            "eventAction": "last changed",
            "eventDate": "2026-06-12T04:48:05-04:00"
          },
          {
            "eventAction": "registration",
            "eventDate": "2011-04-19T16:11:36-04:00"
          }
        ],
        "handle": "ADMIN2521-ARIN",
        "links": [
          {
            "href": "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN",
            "rel": "self",
            "type": "application/rdap+json",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          },
          {
            "href": "https://whois.arin.net/rest/poc/ADMIN2521-ARIN",
            "rel": "alternate",
            "type": "application/xml",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          }
        ],
        "objectClassName": "entity",
        "port43": "whois.arin.net",
        "remarks": [
          {
            "description": [
              "All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse"
            ],
            "title": "Registration Comments"
          }
        ],
        "roles": [
          "technical"
        ],
        "status": [
          "validated"
        ],
        "vcardArray": [
          "vcard",
          [
            [
              "version",
              {},
              "text",
              "4.0"
            ],
            [
              "adr",
              {
                "label": "101 Townsend Street\nSan Francisco\nCA\n94107\nUnited States"
              },
              "text",
              [
                "",
                "",
                "",
                "",
                "",
                "",
                ""
              ]
            ],
            [
              "fn",
              {},
              "text",
              "Admin"
            ],
            [
              "org",
              {},
              "text",
              "Cloudflare, Inc."
            ],
            [
              "kind",
              {},
              "text",
              "group"
            ],
            [
              "email",
              {},
              "text",
              "rir@cloudflare.com"
            ],
            [
              "tel",
              {
                "type": [
                  "work",
                  "voice"
                ]
              },
              "text",
              "+1-650-319-8930"
            ]
          ]
        ]
      },
      {
        "events": [
          {
            "eventAction": "last changed",
            "eventDate": "2026-04-30T05:15:18-04:00"
          },
          {
            "eventAction": "registration",
            "eventDate": "2011-04-19T16:25:31-04:00"
          }
        ],
        "handle": "NOC11962-ARIN",
        "links": [
          {
            "href": "https://rdap.arin.net/registry/entity/NOC11962-ARIN",
            "rel": "self",
            "type": "application/rdap+json",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          },
          {
            "href": "https://whois.arin.net/rest/poc/NOC11962-ARIN",
            "rel": "alternate",
            "type": "application/xml",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          }
        ],
        "objectClassName": "entity",
        "port43": "whois.arin.net",
        "remarks": [
          {
            "description": [
              "All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse"
            ],
            "title": "Registration Comments"
          }
        ],
        "roles": [
          "noc"
        ],
        "status": [
          "validated"
        ],
        "vcardArray": [
          "vcard",
          [
            [
              "version",
              {},
              "text",
              "4.0"
            ],
            [
              "adr",
              {
                "label": "101 Townsend Street\nSan Francisco\nCA\n94107\nUnited States"
              },
              "text",
              [
                "",
                "",
                "",
                "",
                "",
                "",
                ""
              ]
            ],
            [
              "fn",
              {},
              "text",
              "NOC"
            ],
            [
              "org",
              {},
              "text",
              "Cloudflare, Inc."
            ],
            [
              "kind",
              {},
              "text",
              "group"
            ],
            [
              "email",
              {},
              "text",
              "noc@cloudflare.com"
            ],
            [
              "tel",
              {
                "type": [
                  "work",
                  "voice"
                ]
              },
              "text",
              "+1-650-319-8930"
            ]
          ]
        ]
      }
    ],
    "events": [
      {
        "eventAction": "last changed",
        "eventDate": "2024-09-04T06:51:26-04:00"
      },
      {
        "eventAction": "registration",
        "eventDate": "2014-03-28T11:30:55-04:00"
      }
    ],
    "handle": "NET-104-16-0-0-1",
    "ipVersion": "v4",
    "links": [
      {
        "href": "https://rdap.arin.net/registry/ip/104.16.0.0",
        "rel": "self",
        "type": "application/rdap+json",
        "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
      },
      {
        "href": "https://whois.arin.net/rest/net/NET-104-16-0-0-1",
        "rel": "alternate",
        "type": "application/xml",
        "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
      }
    ],
    "name": "CLOUDFLARENET",
    "notices": [
      {
        "description": [
          "By using the ARIN RDAP/Whois service, you are agreeing to the RDAP/Whois Terms of Use"
        ],
        "links": [
          {
            "href": "https://www.arin.net/resources/registry/whois/tou/",
            "rel": "terms-of-service",
            "type": "text/html",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          }
        ],
        "title": "Terms of Service"
      },
      {
        "description": [
          "If you see inaccuracies in the results, please visit: "
        ],
        "links": [
          {
            "href": "https://www.arin.net/resources/registry/whois/inaccuracy_reporting/",
            "rel": "inaccuracy-report",
            "type": "text/html",
            "value": "https://rdap.arin.net/registry/ip/104.21.9.234"
          }
        ],
        "title": "Whois Inaccuracy Reporting"
      },
      {
        "description": [
          "Copyright 1997-2026, American Registry for Internet Numbers, Ltd."
        ],
        "title": "Copyright Notice"
      }
    ],
    "objectClassName": "ip network",
    "parentHandle": "NET-104-0-0-0-0",
    "port43": "whois.arin.net",
    "rdapConformance": [
      "nro_rdap_profile_0",
      "rdap_level_0",
      "cidr0",
      "arin_originas0"
    ],
    "remarks": [
      {
        "description": [
          "All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse",
          "Geofeed: https://api.cloudflare.com/local-ip-ranges.csv"
        ],
        "title": "Registration Comments"
      }
    ],
    "startAddress": "104.16.0.0",
    "status": [
      "active"
    ],
    "type": "DIRECT ALLOCATION"
  }
}

How this lookup works

The lookup starts at ARIN's RDAP service, the registration database for North America. If the address belongs to another region, ARIN answers with a referral, and we follow it to RIPE NCC, APNIC, LACNIC or AFRINIC. The result shows the registry that answered. RDAP returns structured data, so fields are labelled consistently whichever registry holds the record. Only the five registries' RDAP servers are ever contacted.

How to read the results

Registered to is the organisation on the record: usually an ISP, cloud provider or hosting company, rarely the end user.
Network and Range give the block the address belongs to, with its CIDR and the registry's network name.
Allocation shows how the block was handed out. A direct allocation went from the registry to an ISP; a reassignment went from an ISP to its customer, which is the closest you'll get to the actual user.
Parent network is the larger block above this one. Check it if the specific record has no contacts.
Abuse contact is where the operator wants reports of spam, attacks or other abuse sent.
Contacts lists every role on the record, such as technical, administrative and NOC.
Raw RDAP response shows the full JSON, including remarks and links the summary leaves out.

When results are surprising

It shows a cloud provider, not the company I expected. Cloud and hosting providers register their ranges once and rent addresses to customers dynamically. The tenant is never in Whois.

The record was updated very recently. Address blocks are bought, sold and transferred between organisations. A recent change can mean the block changed hands, and older reputation data may be out of date.

There's no abuse contact. Try the parent network's contacts, or the abuse address on the organisation's website. The guide to reading IP Whois explains how to write an abuse report that gets acted on.

Private addresses are refused. Addresses such as 10.x.x.x, 192.168.x.x and 100.64.x.x aren't registered to anyone publicly; they come from inside a network.

Updated 26 October 2026

Related checks

What Is My IP?
Which public address does the internet see for me, and what does its reverse DNS say?
Reverse DNS Lookup
Which hostname does this IP address claim, and does that name point back?
BGP Route Lookup
Which network announces this address block, and who is responsible for it?

Guides for this check

Reading IP Whois and RDAP results: owner, network and abuse contact
How IP addresses are allocated through the regional registries, what each field in an IP Whois/RDAP record means, and how to report abuse so it gets acted on.

FAQ

What's the difference between RDAP and WHOIS?

RDAP delivers the same registration data as WHOIS but in structured JSON over HTTPS, with standardized fields, built-in referrals, and international character support. Traditional WHOIS sends free-form text over TCP port 43.

Why does the owner show as an ISP instead of a person?

IP addresses are allocated to providers, who sub-assign them to customers. Those sub-assignments usually aren't published publicly, so the registered owner remains the provider.

How do I report abuse from an IP address?

Use the abuse contact shown at the top of the results. That's the address the network operator registered to receive complaints about traffic from their network.

F1Report abuse to abuse@cloudflare.com