Skip to content
LookupOwl

IP WHOIS lookup

See which network owns an IP address, where it's registered and how to reach their abuse desk.

IPv4 or IPv6, like 8.8.8.8 or 2606:4700::/32.

More options

Include the raw RDAP JSON from the Regional Internet Registry in the result. Large; off by default.

Try:

Results for 192.168.1.1

Checked live lookup2 ms

JSONCheck again

Reserved

A reserved address or name

This is a special-purpose value, so no public registry holds a record for it.

  • 192.168.1.1 is in a special-purpose range: Private-Use (RFC 1918).
Structured result (JSON) · 1.1 KB
{
  "query": {
    "kind": "ip",
    "key": "192.168.1.1",
    "display": "192.168.1.1",
    "input": "192.168.1.1",
    "ip": {
      "version": 4,
      "address": "192.168.1.1",
      "prefixLength": 32,
      "isCidr": false,
      "canonical": "192.168.1.1",
      "special": {
        "kind": "private",
        "name": "Private-Use",
        "range": "192.168.0.0/16",
        "rfc": "RFC 1918"
      }
    },
    "notices": [
      {
        "code": "SPECIAL_PURPOSE",
        "message": "192.168.1.1 is in a special-purpose range: Private-Use (RFC 1918).",
        "data": {
          "kind": "private",
          "range": "192.168.0.0/16",
          "rfc": "RFC 1918"
        }
      }
    ]
  },
  "status": "special_purpose",
  "source": "none",
  "provenance": {
    "trace": [
      {
        "step": "input",
        "label": "Special-purpose range: Private-Use (RFC 1918)",
        "status": "SPECIAL_PURPOSE",
        "ms": 0,
        "note": "192.168.0.0/16"
      }
    ],
    "totalMs": 0,
    "fetchedAt": "2026-11-14T17:46:40.136Z",
    "cache": "miss"
  }
}

What an IP WHOIS lookup tells you

It tells you which organisation an IP address was handed to. Every address in use on the public internet is registered to someone. Five regional internet registries (RIRs) give blocks of addresses to internet providers, hosting companies and large organisations, and each handout goes into a public database. A lookup finds the most specific record that covers your address and shows who holds it.

Regional registryRegion
ARINUnited States, Canada and parts of the Caribbean
RIPE NCCEurope, the Middle East and parts of Central Asia
APNICAsia and the Pacific
LACNICLatin America and parts of the Caribbean
AFRINICAfrica

The result lists the network's start and end address and its CIDR blocks (the 8.8.8.0/24 way of writing a network), its name and handle, the allocation type, the country, the registration and update dates, the origin AS numbers when the registry publishes them, and the technical and abuse contacts it makes public.

How to use it

  1. Enter an address or blockType an IPv4 or IPv6 address, or a network such as 8.8.8.0/24. Brackets, ports and URLs around an address are stripped, so 8.8.8.8:53 and http://8.8.8.8/ both work. To find the address behind a hostname, run a DNS lookup first.
  2. Check the covering networkRead the range and CIDR notation first, then the organisation name. If a smaller assignment sits inside a larger allocation, the most specific one is shown, with a pointer to its parent.
  3. Report abuse to the right placeUse the abuse mailbox on the result. It belongs to the network owner, who can act on spam, scanning or attacks. The website host, or whoever is behind the address, often cannot.

Reading the result

  • Owner is a provider, not a person. Residential and mobile addresses belong to the ISP. The registry does not know who is using the address at a given moment.
  • Hosting and cloud addresses. The holder is the hosting company or cloud provider. The customer behind a server is not public.
  • Name and handle. Both are labels. The holder chooses the name and the registry assigns the handle. They often hint at the company or service, but treat them as clues, not proof.
  • Allocation type. Terms such as Direct allocation (ARIN), Assigned PA (RIPE NCC) or Assigned portable (APNIC) say how the block was handed out. A more specific record usually means a more specific holder.
  • Country. The country on the record, or in the holder's postal address, not where the device is.
  • Dates. Registration shows when the block was first recorded, and last changed shows the latest edit.
  • Origin AS. The number of the network that announces the address. It only appears when the registry publishes it, and few do, so a missing one is normal.

Special cases and common problems

  • Private and special addresses. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, loopback 127.0.0.0/8, link-local 169.254.0.0/16 and carrier-grade NAT 100.64.0.0/10 have no owner on the public internet. LookupOwl names the range and its RFC instead of showing an error.
  • Documentation ranges. 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 are reserved for examples (RFC 5737) and should never appear on the public internet.
  • Old legacy blocks. Addresses allocated before the RIR system sit under whichever registry took over the records, often ARIN, so the holder name may look dated.
  • Transferred or delegated blocks. Blocks can move from one registry to another, and LACNIC hands some ranges to national registries such as Brazil's registro.br. The answer may come after a redirect, and from a different server than you expect.
  • Missing contact details. Registries limit personal data, and some require a web form instead of showing an email address. Some records publish no abuse contact at all, and the result says so.
  • Rate limits. Registries throttle automated queries. If you see a limit message, wait and retry.

How the lookup works

LookupOwl matches your address against the IANA IPv4 or IPv6 bootstrap file to find which registry holds the covering block, then asks that registry's RDAP server for /ip/<address>. RDAP is the modern, JSON replacement for WHOIS. It replies with an ip network object holding the range, status, dates and contacts. If a registry redirects to another, we follow it. Private and other reserved addresses are recognised locally and explained without any request.

If a registry does not answer, you get an error you can retry, or a recent stored copy that is labelled as one. Nothing is guessed.

Shell
# The same query from a terminal
curl -sL https://rdap.org/ip/8.8.8.8 | jq '{handle, name, startAddress, endAddress, type}'

# Classic WHOIS
whois 8.8.8.8

Standards and registries

  • RFC 9083: the RDAP ip network object and its fields. RFC 9082: the /ip/ query path.
  • RFC 9224: the IANA bootstrap files that map address blocks to registries.
  • RFC 4632: CIDR notation. RFC 1918, RFC 6598, RFC 5737, RFC 6890: private, shared, documentation and special-purpose ranges.
  • RFC 3912: the WHOIS protocol the registries still offer on port 43.

Questions people ask

Can an IP WHOIS lookup tell me who a person is?

No. It identifies the organisation holding the address block, usually an ISP, a hosting company or an enterprise. Only that organisation can match an address at a particular moment to a customer, and normally it will do so only for a legal request.

How do I report an abusive IP address?

Send the evidence to the abuse mailbox shown in the result. That means timestamps with the time zone, log lines and email headers. Use the contact of the most specific network, and keep the report short and factual so the team can act on it quickly.

Is IP WHOIS the same as IP geolocation?

No. WHOIS shows who registered a block. Geolocation estimates where an address is used from several other signals, and it can be off by tens or hundreds of kilometres. The two answers often disagree, because a company can register a block in one country and use it in another.

Why does the address belong to a company far from me?

Providers and VPNs route traffic over large networks, and CDNs announce the same range from many cities, so the registered holder can be headquartered anywhere. The registry records who holds the block, not where your traffic travels or where the servers sit.

What does a CIDR block like /24 mean?

The number after the slash is how many leading bits identify the network, and the rest identify hosts inside it. A /24 is 256 addresses and a /16 is 65,536. Use the subnet calculator to work out the first and last address, the masks and the usable hosts.

Why does it say my IP address can't be looked up?

It is probably a private or other special address, which has no public owner. An address like 192.168.1.1 only works inside one home or office network, so no registry lists it. LookupOwl names the range and the RFC that defines it instead of showing an owner. To see the public address your connection uses, open What is my IP.

Does it work for IPv6 too?

Yes. Paste an IPv6 address or prefix into the box above and it works the same way. The IPv6 WHOIS lookup page runs the same lookup and also explains the special IPv6 ranges you may run into, such as link-local and documentation addresses.

Use it from AI, the API or the command line

Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is ip_whois. Please be kind to the rate limits.

curl
curl "https://lookupowl.com/api/v1/tools/ip-whois?q=8.8.8.8"
MCP
claude mcp add --transport http lookupowl https://lookupowl.com/mcp

Description for AI agents · OpenAPI · llms.txt