WHOIS Lookup
Find who owns an IP: organization, network range and abuse contact.
About WHOIS and RDAP
WHOIS (and its structured successor RDAP) tells you who an internet address is registered to: the organisation, the size of the block it belongs to, its country, and the contact for reporting abuse. It is the starting point whenever you need to know who is behind traffic you did not expect.
The network range matters as much as the name: it tells you whether the address is one machine or part of a block a hosting provider assigns to thousands of customers. The abuse contact is the address that actually gets read when you report a problem, far more effective than a generic support form. Note that registration data describes the allocation holder, not necessarily whoever is using the address today.
Frequently asked questions
- What is the difference between WHOIS and RDAP?
- RDAP returns the same registration data as structured JSON, with predictable fields and proper internationalisation. It is the current standard; WHOIS is the legacy text format.
- Why is the owner a hosting provider and not the actual site?
- Because they hold the allocation. Registration identifies who was assigned the block, not their customer. To reach the customer, use the provider's abuse contact.
- Can I look up who owns a domain here?
- This tool covers IP addresses. Domain ownership is a separate registry, and most personal details there are redacted under data-protection rules.
- The data looks out of date. Is that normal?
- Registries only update when the holder does. Contact details in particular go stale for years, which is exactly why the abuse contact is the field worth trusting most.
Related tools
Go further
Network glossary: ASN, Reverse DNS