IP WHOIS Lookup.
Look up the registry record of any IPv4 or IPv6 address, or the address behind a domain: network name, owner, address range, CIDR, AS number, dates and the abuse contact.
100% free, no sign-up. To stop automated scanning, each browser can run up to 10 scans per tool every 3 hours; only that count is kept (privacy).
What Is an IP WHOIS Lookup?
An IP WHOIS lookup shows the registry record for an IP address. Instead of a domain's registrar and expiry date, it shows who holds the block of addresses the IP belongs to: the network name, the organisation, the range and CIDR, the allocation type, the dates and the abuse contact.
IP addresses are handed out by the five regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC) to internet providers and hosting companies, who may pass blocks on to customers. Each registry publishes its records through RDAP, the modern replacement for the WHOIS text service, and this tool asks the right registry for you.
We add the autonomous system (AS) number, AS name and announced prefix from public routing data, and a WHOIS-style text record you can copy. To check a domain name instead, use the domain WHOIS lookup.
The Full Registry Record of an IP.
The record comes from the regional internet registry that holds the address block, with routing data added so you can see who announces it.
Network and owner
The network name, handle and the organisation the block is registered to, with the allocation type and status.
Range and CIDR
The first and last address of the block and its CIDR notation, such as 8.8.8.0/24, plus the parent network it was cut from.
Dates and registry
When the block was registered and last changed, and which regional registry holds it (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC).
AS number and routing
The origin AS number and name that announce the address, with the prefix it announces and its registry.
Abuse contact
The abuse mailbox of the network, where you send reports of spam, attacks or other misuse.
WHOIS-style record
A plain-text version of the result that you can copy into a ticket, a report or an email.
Common Problems and Fixes.
What to do with the result.
I want to report spam or an attack
Copy the abuse contact from the result and send your evidence to it: log lines with the time and time zone, the address and what happened. Use the network's abuse mailbox, not personal addresses.
The owner is a provider, not the person
The registry lists the company that holds the block. Only that provider can tell who used an address at a given time, so report the problem to them.
No abuse contact is shown
Some registries hide it or list it on a parent network. Look up the parent network, or write to the provider's main support.
The range is very large
Big providers hold large blocks and the record shows the whole block. A smaller customer block may be listed separately in the registry.
The AS name is not the owner
The AS is the network that announces the address on the internet. It can differ from the owner of the block when the block is leased or hosted at another provider.
The address is private or reserved
Addresses such as 10.x.x.x, 172.16.x.x to 172.31.x.x and 192.168.x.x are not public, so no registry record exists for them.
Related Free Tools.
Frequently Asked Questions
Quick answers about this tool.
Run Your Own Network Tools?
KVM VPS with full root access and your own IPv4 address, so you can run monitoring, mail and network tools yourself.