IP Whois

IP Whois lookup

Who owns this IP address, and where do I report abuse from it?

How this lookup works

The lookup starts at ARIN's RDAP service, the registration database for North America. If the address belongs to another region, ARIN answers with a referral, and we follow it to RIPE NCC, APNIC, LACNIC or AFRINIC. The result shows the registry that answered. RDAP returns structured data, so fields are labelled consistently whichever registry holds the record. Only the five registries' RDAP servers are ever contacted.

How to read the results

  • Registered to is the organisation on the record: usually an ISP, cloud provider or hosting company, rarely the end user.
  • Network and Range give the block the address belongs to, with its CIDR and the registry's network name.
  • Allocation shows how the block was handed out. A direct allocation went from the registry to an ISP; a reassignment went from an ISP to its customer, which is the closest you'll get to the actual user.
  • Parent network is the larger block above this one. Check it if the specific record has no contacts.
  • Abuse contact is where the operator wants reports of spam, attacks or other abuse sent.
  • Contacts lists every role on the record, such as technical, administrative and NOC.
  • Raw RDAP response shows the full JSON, including remarks and links the summary leaves out.

When results are surprising

It shows a cloud provider, not the company I expected. Cloud and hosting providers register their ranges once and rent addresses to customers dynamically. The tenant is never in Whois.

The record was updated very recently. Address blocks are bought, sold and transferred between organisations. A recent change can mean the block changed hands, and older reputation data may be out of date.

There's no abuse contact. Try the parent network's contacts, or the abuse address on the organisation's website. The guide to reading IP Whois explains how to write an abuse report that gets acted on.

Private addresses are refused. Addresses such as 10.x.x.x, 192.168.x.x and 100.64.x.x aren't registered to anyone publicly; they come from inside a network.

Updated 26 October 2026

Related checks

  • What Is My IP?

    Which public address does the internet see for me, and what does its reverse DNS say?

  • Reverse DNS Lookup

    Which hostname does this IP address claim, and does that name point back?

  • BGP Route Lookup

    Which network announces this address block, and who is responsible for it?

Guides for this check

FAQ

What's the difference between RDAP and WHOIS?

RDAP delivers the same registration data as WHOIS but in structured JSON over HTTPS, with standardized fields, built-in referrals, and international character support. Traditional WHOIS sends free-form text over TCP port 43.

Why does the owner show as an ISP instead of a person?

IP addresses are allocated to providers, who sub-assign them to customers. Those sub-assignments usually aren't published publicly, so the registered owner remains the provider.

How do I report abuse from an IP address?

Use the abuse contact shown at the top of the results. That's the address the network operator registered to receive complaints about traffic from their network.