# IP WHOIS Lookup

Find the registered owner of an IPv4 or IPv6 address or CIDR block through RDAP, from the Regional Internet Registry that holds it (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC). Returns the most specific registered network: address range and CIDRs, network name and handle, type, country, parent network, status, registration and last-changed dates, origin AS numbers when published, contacts and the abuse mailbox. Private, loopback, documentation and other reserved addresses return status "special_purpose" without any lookup. This is registration data, not geolocation or reputation.

**Not for:** Locating a user (it is a registry record, not a position), reverse DNS (use reverse_dns), domain names (use whois_lookup) or AS numbers (use asn_lookup).

- Tool id: `ip-whois`
- Category: ip
- Execution: network
- MCP tool `ip_whois` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/ip-whois` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `q` | string | yes |  | IPv4 or IPv6 address, or a CIDR block, e.g. 8.8.8.8, 2606:4700:4700::1111 or 1.1.1.0/24. Brackets, ports and URLs around an address are removed. min length 1, max length 512 |
| `includeRaw` | boolean | no | `false` | Include the raw RDAP JSON from the Regional Internet Registry in the result. Large; off by default. |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `query` | object |  |
| `status` | "found" \| "not_found" \| "special_purpose" \| "no_rdap_service" | found: a record exists. not_found: the registry says there is none. special_purpose: reserved address space or AS number, nothing to look up. no_rdap_service: no RDAP (and for domains no WHOIS) service exists. |
| `source` | "rdap" \| "whois" \| "none" | Where the record came from. |
| `availability` | object | Domains only. "likely-available" is a registry saying there is no record; premium or reserved names can still be unavailable. |
| `registrar` | object | Outcome of asking the registrar after the registry. The merged data is in domain. |
| `whois` | object | Raw WHOIS reply, only when the TLD has no RDAP service. |
| `error` | object |  |
| `provenance` | object | How the answer was obtained: which bootstrap entry, which servers, timings. |
| `raw` | object | Raw upstream RDAP JSON. Only with includeRaw. |
| `ip` | object |  |

## Examples

### Google Public DNS (8.8.8.8)

```json
{"q":"8.8.8.8","includeRaw":false}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/ip-whois?includeRaw=false&q=8.8.8.8'
```

Web page: https://lookupowl.com/ip-whois-lookup?q=8.8.8.8

### Cloudflare DNS over IPv6

```json
{"q":"2606:4700:4700::1111","includeRaw":false}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/ip-whois?includeRaw=false&q=2606%3A4700%3A4700%3A%3A1111'
```

Web page: https://lookupowl.com/ip-whois-lookup?q=2606%3A4700%3A4700%3A%3A1111

### A /24 block

```json
{"q":"1.1.1.0/24","includeRaw":false}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/ip-whois?includeRaw=false&q=1.1.1.0%2F24'
```

Web page: https://lookupowl.com/ip-whois-lookup?q=1.1.1.0%2F24

### A private address has no owner to look up

```json
{"q":"192.168.1.1","includeRaw":false}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/ip-whois?includeRaw=false&q=192.168.1.1'
```

Web page: https://lookupowl.com/ip-whois-lookup?q=192.168.1.1

## Web pages

- https://lookupowl.com/ip-whois-lookup
- https://lookupowl.com/ipv6-whois-lookup

## Limits and caching

- Cost: 1 unit for a live lookup, 1 unit for a cached one. Budgets are per network and published in the `RateLimit` response headers.
- Cache: the lifetime follows the data (for DNS, the record TTL, within a few minutes). Add `fresh=true` (MCP argument or query parameter) to look again; it costs 3 units per unit and is limited to 10 per hour.
- Timeout: 15 s.

## Related tools

- [IP Location Lookup](https://lookupowl.com/tools/ip-location.md): Where an IP address is: city, region, country and the network that runs it, from DB-IP, with an honest accuracy note.
- [ASN Lookup](https://lookupowl.com/tools/asn-lookup.md): Who holds an Autonomous System number: name, country, registry, dates and abuse contact, from RDAP.
- [Reverse DNS Lookup](https://lookupowl.com/tools/reverse-dns.md): Find the host name (PTR record) of an IPv4 or IPv6 address and check that it resolves back to the same address.
- [IP and Domain Blacklist Checker](https://lookupowl.com/tools/blacklist-checker.md): Check an IP address, a mail server or a domain against live spam blocklists, with how to get delisted.
- [IP Subnet Calculator](https://lookupowl.com/tools/subnet-calculator.md): Network, broadcast, usable range, masks and exact host counts for any IPv4 or IPv6 subnet.
- [WHOIS Lookup](https://lookupowl.com/tools/whois-lookup.md): Registrar, creation and expiry dates, status codes, nameservers and DNSSEC for any domain, from RDAP with WHOIS fallback.

## Guide: IP WHOIS lookup

See which network owns an IP address, where it's registered and how to reach their abuse desk.

### What an IP WHOIS lookup tells you

It tells you which organisation an IP address was handed to. Every address in use on the public internet is registered to someone. Five regional internet registries (RIRs) give blocks of addresses to internet providers, hosting companies and large organisations, and each handout goes into a public database. A lookup finds the most specific record that covers your address and shows who holds it.

| Regional registry | Region |
|---|---|
| ARIN | United States, Canada and parts of the Caribbean |
| RIPE NCC | Europe, the Middle East and parts of Central Asia |
| APNIC | Asia and the Pacific |
| LACNIC | Latin America and parts of the Caribbean |
| AFRINIC | Africa |

The result lists the network's start and end address and its CIDR blocks (the `8.8.8.0/24` way of writing a network), its name and handle, the allocation type, the country, the registration and update dates, the origin AS numbers when the registry publishes them, and the technical and abuse contacts it makes public.

### How to use it

1. **Enter an address or block**: Type an IPv4 or IPv6 address, or a network such as `8.8.8.0/24`. Brackets, ports and URLs around an address are stripped, so `8.8.8.8:53` and `http://8.8.8.8/` both work. To find the address behind a hostname, run a [DNS lookup](https://lookupowl.com/dns-lookup) first.
2. **Check the covering network**: Read the range and CIDR notation first, then the organisation name. If a smaller assignment sits inside a larger allocation, the most specific one is shown, with a pointer to its parent.
3. **Report abuse to the right place**: Use the abuse mailbox on the result. It belongs to the network owner, who can act on spam, scanning or attacks. The website host, or whoever is behind the address, often cannot.

> **Need the announcing network too?** The organisation an address is registered to and the network that announces it on the internet can differ. A BGP service such as bgp.tools or RIPEstat shows the AS number for an address. Paste it into the [ASN lookup](https://lookupowl.com/asn-lookup) to see who runs that network.

> **In Claude, ChatGPT or Cursor** Connect the LookupOwl MCP server and ask: “Who owns 8.8.8.8, and where do I send an abuse report?” The assistant calls `ip_whois` and gets the covering network, the organisation and registry behind it and the abuse contact, with a link to the result on this page. IPv6 addresses and CIDR blocks work the same way.

### Reading the result

- **Owner is a provider, not a person.** Residential and mobile addresses belong to the ISP. The registry does not know who is using the address at a given moment.
- **Hosting and cloud addresses.** The holder is the hosting company or cloud provider. The customer behind a server is not public.
- **Name and handle.** Both are labels. The holder chooses the name and the registry assigns the handle. They often hint at the company or service, but treat them as clues, not proof.
- **Allocation type.** Terms such as Direct allocation (ARIN), Assigned PA (RIPE NCC) or Assigned portable (APNIC) say how the block was handed out. A more specific record usually means a more specific holder.
- **Country.** The country on the record, or in the holder's postal address, not where the device is.
- **Dates.** Registration shows when the block was first recorded, and last changed shows the latest edit.
- **Origin AS.** The number of the network that announces the address. It only appears when the registry publishes it, and few do, so a missing one is normal.

### Special cases and common problems

- **Private and special addresses.** `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, loopback `127.0.0.0/8`, link-local `169.254.0.0/16` and carrier-grade NAT `100.64.0.0/10` have no owner on the public internet. LookupOwl names the range and its RFC instead of showing an error.
- **Documentation ranges.** `192.0.2.0/24`, `198.51.100.0/24` and `203.0.113.0/24` are reserved for examples (RFC 5737) and should never appear on the public internet.
- **Old legacy blocks.** Addresses allocated before the RIR system sit under whichever registry took over the records, often ARIN, so the holder name may look dated.
- **Transferred or delegated blocks.** Blocks can move from one registry to another, and LACNIC hands some ranges to national registries such as Brazil's registro.br. The answer may come after a redirect, and from a different server than you expect.
- **Missing contact details.** Registries limit personal data, and some require a web form instead of showing an email address. Some records publish no abuse contact at all, and the result says so.
- **Rate limits.** Registries throttle automated queries. If you see a limit message, wait and retry.

### How the lookup works

LookupOwl matches your address against the IANA IPv4 or IPv6 bootstrap file to find which registry holds the covering block, then asks that registry's RDAP server for `/ip/<address>`. RDAP is the modern, JSON replacement for WHOIS. It replies with an `ip network` object holding the range, status, dates and contacts. If a registry redirects to another, we follow it. Private and other reserved addresses are recognised locally and explained without any request.

If a registry does not answer, you get an error you can retry, or a recent stored copy that is labelled as one. Nothing is guessed.

```bash
# The same query from a terminal
curl -sL https://rdap.org/ip/8.8.8.8 | jq '{handle, name, startAddress, endAddress, type}'

# Classic WHOIS
whois 8.8.8.8
```

### Standards and registries

- **RFC 9083**: the RDAP `ip network` object and its fields. **RFC 9082**: the `/ip/` query path.
- **RFC 9224**: the IANA bootstrap files that map address blocks to registries.
- **RFC 4632**: CIDR notation. **RFC 1918, RFC 6598, RFC 5737, RFC 6890**: private, shared, documentation and special-purpose ranges.
- **RFC 3912**: the WHOIS protocol the registries still offer on port 43.

### Frequently asked questions

**Can an IP WHOIS lookup tell me who a person is?**

No. It identifies the organisation holding the address block, usually an ISP, a hosting company or an enterprise. Only that organisation can match an address at a particular moment to a customer, and normally it will do so only for a legal request.

**How do I report an abusive IP address?**

Send the evidence to the abuse mailbox shown in the result. That means timestamps with the time zone, log lines and email headers. Use the contact of the most specific network, and keep the report short and factual so the team can act on it quickly.

**Is IP WHOIS the same as IP geolocation?**

No. WHOIS shows who registered a block. Geolocation estimates where an address is used from several other signals, and it can be off by tens or hundreds of kilometres. The two answers often disagree, because a company can register a block in one country and use it in another.

**Why does the address belong to a company far from me?**

Providers and VPNs route traffic over large networks, and CDNs announce the same range from many cities, so the registered holder can be headquartered anywhere. The registry records who holds the block, not where your traffic travels or where the servers sit.

**What does a CIDR block like /24 mean?**

The number after the slash is how many leading bits identify the network, and the rest identify hosts inside it. A /24 is 256 addresses and a /16 is 65,536. Use the [subnet calculator](https://lookupowl.com/subnet-calculator) to work out the first and last address, the masks and the usable hosts.

**Why does it say my IP address can't be looked up?**

It is probably a private or other special address, which has no public owner. An address like 192.168.1.1 only works inside one home or office network, so no registry lists it. LookupOwl names the range and the RFC that defines it instead of showing an owner. To see the public address your connection uses, open [What is my IP](https://lookupowl.com/what-is-my-ip).

**Does it work for IPv6 too?**

Yes. Paste an IPv6 address or prefix into the box above and it works the same way. The [IPv6 WHOIS lookup](https://lookupowl.com/ipv6-whois-lookup) page runs the same lookup and also explains the special IPv6 ranges you may run into, such as link-local and documentation addresses.