IP Whois lookup
Owner, ASN, and allocation details for IPv4 or IPv6.
| Abuse email? | [email protected] |
| Abuse phone? | +1-408-525-0560 |
What does each field mean?
Field reference
Organization
Name of the organization that registered this IP block with the regional registry. Could be an ISP (Comcast, Deutsche Telekom), a cloud provider (Amazon Technologies, Google LLC), or a corporate AS for an enterprise network.
ASN (Autonomous System)
BGP routing identifier (e.g., <code>AS15169</code> = Google). Every IP on the public internet is reachable through one or more ASNs. ASN tells you the network operator regardless of who owns the IP block beneath it.
CIDR
Classless Inter-Domain Routing notation. <code>192.168.1.0/24</code> means the first 24 bits are the network prefix — 256 addresses (.0 to .255). Smaller numbers = larger blocks: /16 = 65k, /8 = 16M.
Net name
Free-form name the registrant assigned to this allocation — examples: <code>GOOGLE</code>, <code>AMAZON-AES</code>, <code>HETZNER-NBG1-DC1</code>. Useful for spotting customer-vs-provider boundary inside a large network.
Net range
Explicit range covering the allocation, e.g., <code>8.8.8.0 – 8.8.8.255</code>. Equivalent to the CIDR notation, but easier to read when checking whether a specific IP is inside the range.
Registry (RIR)
The Regional Internet Registry that manages this address space: ARIN (North America), RIPE (Europe / Middle East), APNIC (Asia-Pacific), LACNIC (Latin America), AFRINIC (Africa). Determines which WHOIS server is authoritative.
Registered
When the regional registry first assigned this block. A very recent date on a "well-known" IP usually means recent transfer or sub-allocation rather than fresh-from-IANA.
Updated
Timestamp of the last WHOIS change — contacts, name, status. Frequent updates can indicate reassignments, mergers, or abuse-list cleanups.
Abuse email
Mandatory channel for abuse reports per RFC 7485 / RIR policies. The operator must respond within a few business days. Report scanning, brute-force, spam, DDoS — never private grievances.
Abuse phone
Backup channel for time-critical abuse (live attack, DDoS in progress). Less commonly used than email; some smaller operators do not list one.
About this tool
A whois lookup reveals who owns an IP address and which organization operates the network it belongs to. Every IPv4 and IPv6 address on the public internet is allocated through one of five Regional Internet Registries — ARIN, RIPE, APNIC, LACNIC, and AFRINIC — and they maintain public databases of these allocations.
Our tool queries the correct registry automatically based on the address you enter, then parses the response into structured data: organization name, ASN (autonomous system number), CIDR range, country, abuse contact, and registration dates. The raw registry response is also available if you need the unprocessed output.
When to use this tool
- Investigating suspicious traffic. Identify which organization owns an IP that appeared in your server logs.
- Reporting abuse. Find the correct abuse contact to report spam, brute-force attempts, or DDoS traffic.
- Geolocation verification. Cross-reference an IP's declared country with its registry allocation.
- Network planning. Check ASN ownership when evaluating transit providers or peering relationships.
How whois data stays accurate
Registries require IP holders to keep contact details current, but enforcement varies. Smaller allocations under a corporate umbrella may show the parent organization rather than the actual operator. For the most accurate picture, combine whois data withrDNS lookups and ASN routing information — all three perspectives together tell a clearer story than any single one.