How to use IP WHOIS Lookup
The IP WHOIS tool looks up the registration details of an IP address: which organisation owns the address block, the regional internet registry that allocated it, the network range it belongs to, and the abuse contact for reporting problems. Unlike domain WHOIS, which describes a name, IP WHOIS describes the network itself, making it the right tool for identifying who is responsible for an address. Use it to find the hosting provider behind a server, to locate the abuse contact for an address attacking you, or to understand the size and owner of a network range.
- Enter the IP address you want to research.
- Click Lookup to query the regional internet registry.
- Read the owning organisation and network range.
- Note the registry (ARIN, RIPE, APNIC, etc.) responsible.
- Use the abuse contact to report malicious activity.
What IP WHOIS reveals
Every public IP belongs to a block allocated by one of the five regional internet registries to an organisation — a hosting company, an ISP, a university or a business. IP WHOIS returns that organisation, the start and end of the allocated range, and usually an abuse contact intended for reporting spam or attacks originating from the block. This is how network operators trace the responsible party for any address, and how you find out, for instance, that a suspicious IP in your logs belongs to a particular cloud provider.
| Registry | Region |
|---|---|
| ARIN | North America |
| RIPE NCC | Europe, Middle East, Central Asia |
| APNIC | Asia-Pacific |
| LACNIC | Latin America |
| AFRINIC | Africa |
Using the abuse contact effectively
When an IP is the source of spam, brute-force attempts or other abuse, the WHOIS abuse contact is the proper channel to report it — the network owner can act where you cannot. A good report includes the offending IP, timestamps with the time zone, and concise log evidence. Bear in mind that the address you see may be a shared host or a compromised machine rather than the attacker’s own, so reporting to the network owner, who can investigate internally, is more effective than trying to identify an individual yourself.
Glossary
- IP WHOIS
- A lookup of which organisation owns and is responsible for an IP block.
- Regional internet registry
- One of five bodies allocating IP ranges by region.
- Abuse contact
- The address for reporting malicious activity from a network.
- Network range
- The block of addresses allocated together to one organisation.
- Allocation
- The assignment of an IP range from a registry to an organisation.
Related reading
Frequently Asked Questions
Why use IP WHOIS Lookup?
- Look up the organisation and network range that owns any public IP address
- Find the correct abuse contact to report spam or attacks originating from an IP
- Identify the regional internet registry responsible for an address block
- Understand the full CIDR allocation behind a single address
Common use cases
- Find the abuse contact for an IP that is hammering your server with requests
- Identify the cloud provider behind a suspicious inbound connection
- Confirm which ISP owns an address range before writing geo-based firewall rules
- Research the network registration of an IP found in a security incident log
- Verify the owner of an IP block before allowing it through a corporate network filter
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Network & DNS
WHOIS Lookup
Look up WHOIS registration data for any domain. Find the registrar, creation date, expiry, and nameservers instantly — free, fast, and accurate.
IP Geolocation Lookup
Find the geographic location of any IP address. Look up the city, country, ISP, timezone, and ASN for any IP — free, instant, and accurate.
Reverse DNS Lookup
Look up the hostname linked to any IP address using reverse DNS (PTR record lookup). Free and instant — useful for email and server diagnostics.
Domain to IP Lookup
Find the IP address of any domain name. Look up both IPv4 and IPv6 addresses for any website or hostname instantly — free, fast, and accurate.
ASN Lookup
Find the autonomous system number, network name, route prefix, registry, and country behind any IP address or AS number with this free ASN lookup.
DNS Lookup Tool
Look up DNS records for any domain — A, AAAA, MX, NS, TXT, CNAME, SOA, and CAA records. Free, instant results pulled from authoritative nameservers.
Explore all Network & DNS.