Validate the address
Only a literal public IPv4 or IPv6 address is accepted; hostnames are resolved with the DNS tools instead.
Direct answer: An IP WHOIS lookup identifies the published address allocation or assignment containing a public IP, its Regional Internet Registry source and the registration details that source exposes.
The server sends the public IP address to the RDAP service used for number-resource registration data. Result responses are private, uncached and excluded from search indexing. Do not enter passwords or secrets. Read the lookup privacy policy.
What this ip whois lookup tells you
Use IP WHOIS to identify the Regional Internet Registry and the published allocation or assignment containing an address. It describes number-resource registration; it does not identify a particular end user behind a shared, translated or cloud address.
- The published IP range, country code, status and registration events
- Which RDAP endpoint supplied the response and any service notices it returned
- The complete RDAP response for entity and contact details that are actually public
To separate registration evidence from a provider's network mapping, compare the result with the IP to ASN lookup.
If the address also publishes a PTR record, compare it with a PTR hostname check without treating the hostname as proof of the end user.
How the evidence is collected
Route by registry
The lookup follows number-resource registration data toward the responsible RIR.
Read the containing range
The returned network can be broader than the exact address and may describe an ISP, cloud platform or downstream allocation.
Read the fields without overclaiming
| Signal | What it can establish | What it does not prove |
|---|---|---|
| IP range | The start and end addresses returned for the registered network object. | That every address in the range has one user. |
| Status | Registry status values attached to the network object. | A reputation or security verdict. |
| Country | A registration or allocation code, depending on registry practice. | Current device geolocation. |
| Entities in raw RDAP | Public role and contact structures supplied by the responding service. | A guarantee that an abuse address or end-user identity will be disclosed. |
The result names a cloud provider
Conclude only that the address sits inside a network registered to or routed through that provider. Shared hosting, proxies and customer assignments mean the provider name cannot be substituted for the site publisher. Include timestamps, logs and the exact address in any abuse report.
Common mistakes
- Calling an RIR country code precise geolocation
- Treating an allocation holder as the individual user
- Ignoring carrier-grade NAT, proxies and shared hosting
- Reporting an entire network when one address and timestamp are known
IP WHOIS Lookup FAQ
Does IP WHOIS reveal a home address?
Normally it describes an ISP or network allocation. Subscriber attribution requires provider records and appropriate legal process.
Why is the registered country unexpected?
Registration location, network operations and device location are different concepts, and resources can be reassigned or used globally.
What should an abuse report contain?
Provide the exact IP, UTC timestamps, relevant logs or URLs and a concise description. Do not infer an identity the record does not provide.