IP WHOIS Lookup

IP WHOIS lookup queries the Regional Internet Registry (RIR) database to return the organization, network block (CIDR), IP range, country, and abuse contact registered to any IPv4 or IPv6 address. The lookup uses RDAP (RFC 7480) as the primary protocol, with automatic fallback to legacy WHOIS on port 43 (RFC 3912). Data is sourced live from the five global RIRs — ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC — covering every publicly routable IP address on the internet.

Each field in the result comes directly from the RIR's registration database. Understanding what each field represents helps you identify the responsible party for any IP address and take appropriate action — whether that is filing an abuse report, confirming a mail server's legitimacy, or auditing inbound traffic.

• RDAP-first, port 43 fallback. The tool queries the RDAP endpoint at rdap.org using the Registration Data Access Protocol (RFC 7480). RDAP replaced the legacy WHOIS protocol (RFC 3912) as the IANA-recommended standard in 2015. RDAP returns structured JSON with standardized field names, which enables reliable data extraction. When an RDAP endpoint is unavailable, the tool automatically falls back to querying port 43 WHOIS (whois.ripe.net) and returns the raw plain-text response.
• Automatic RIR routing via IANA bootstrap registry. IP address space is divided among five Regional Internet Registries: ARIN (North America), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America and Caribbean), and AFRINIC (Africa). The rdap.org bootstrap layer follows the IANA RDAP bootstrap file (RFC 7484) to route each query to the correct RIR automatically — no manual server selection is needed.
• CIDR extraction from RDAP cidr0 extension. CIDR blocks are extracted from the cidr0_v4 or cidr0_v6 fields in the RDAP response, which follow the CIDR0 extension format. For IPv4, the block is assembled as v4prefix/length; for IPv6, as v6prefix/length. The IP range (start and end addresses) is taken from the startAddress and endAddress fields in the RDAP network object.
• Private and reserved IP ranges return no data. IP ranges defined in RFC 1918 — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — are private address space and are not registered in any public RIR database. Loopback addresses (127.0.0.0/8, RFC 5735) and link-local addresses (169.254.0.0/16) are similarly unregistered. The tool returns no result for any of these ranges.

Investigating suspicious inbound traffic. A security analyst reviewing firewall logs notices repeated connection attempts from an unfamiliar IP address block. Running IP WHOIS reveals the owning organization, country of registration, and the abuse contact email. The analyst submits a formal abuse report directly to the registered contact with timestamp evidence from the logs.

Verifying mail server registration for deliverability. A mail server administrator whose outbound email is being rejected by Gmail or Microsoft uses IP WHOIS to confirm that the server's IP block is registered to their organization, with a valid abuse contact. Misconfigured or unregistered IP blocks are a common cause of email delivery failures and spam filter rejections. The next step is checking the Reverse DNS Lookup to verify the PTR record matches the sending domain.

Mapping external traffic to organizations during a network audit. A network engineer auditing egress traffic logs needs to identify which external organizations are communicating with internal servers. IP WHOIS maps each external IP address to its owning organization and country, enabling accurate traffic classification for compliance reporting — particularly for identifying unexpected connections to foreign-registered network blocks.