IP WHOIS Lookup

Domain names are managed by registries and registrars under ICANN, one authority per TLD. IP addresses and AS numbers are managed by five Regional Internet Registries (RIRs): ARIN (North America), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America and the Caribbean), and AFRINIC (Africa). Each RIR allocates blocks to ISPs and organizations in its region and publishes the registration data through WHOIS and RDAP.

A domain WHOIS answer describes ownership of a name. An IP WHOIS answer describes a delegation: which registry holds the block, which organization it was assigned to, and which autonomous system currently announces it on the internet's routing table (BGP). The same IP can show a registrant address in one country and a routing origin in another, because the address holder and the network operator running the routes are not always the same entity, especially with hosting providers and CDNs.

• Regional registries: ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC - each authoritative for its own address space
• IANA delegates blocks to the RIRs; RIRs sub-delegate to ISPs, hosting providers and end users
• RDAP (RFC 9082 / RFC 9083) is replacing legacy port-43 WHOIS as the structured, machine-readable query protocol

A netblock record ties a CIDR range to a registered organization. The CIDR notation (e.g. 192.0.2.0/24) states the network address and the prefix length: the number after the slash is how many leading bits are fixed for the network, leaving the rest for hosts. A /24 fixes 24 bits and leaves 8 for host addressing, an IPv4 block of 256 addresses.

An autonomous system number identifies a network that runs its own routing policy on the internet. ASNs are 16-bit (1-65534, with private ranges reserved) or, since the pool ran short, 32-bit (up to 4294967295) per RFC 6793. An ASN record lists the registered holder, the announced prefix count, and how many other networks peer with it upstream or downstream.

A high announced-prefix count usually means a large ISP or cloud provider; a handful of prefixes with few peers usually means an end-user network or a small hosting company multihomed for redundancy. Peering counts are a rough proxy for how central a network is in the routing mesh, not a measure of its traffic volume.

RIRs require each allocated block to carry an abuse contact - an email address (and sometimes phone number) the registry expects to reach a real operations team, not a shared inbox that goes unread. This is the correct channel for reporting spam, scanning, DDoS traffic, or compromised hosts traced to that netblock; contacting the registrant's domain WHOIS abuse address is the wrong path when the complaint is about network behavior rather than a website.

Abuse contacts sit at the netblock level, so a large hosting provider often shows one abuse address covering thousands of customer IPs. That is expected: it routes the report to the provider's abuse desk, which then locates the specific customer internally.

Traditional WHOIS (RFC 3912) is a plain-text protocol over TCP port 43 with no standard output format - each registry formats fields differently, which makes automated parsing brittle. RDAP (RFC 9082 for the query protocol, RFC 9083 for the JSON response format) replaces it with structured, self-describing JSON and a proper bootstrap mechanism (RFC 9224) that tells a client which authoritative server to query for a given address block. Most RIRs now serve RDAP as the primary interface, with legacy WHOIS kept for compatibility.