IP WHOIS Lookup

What is an IP WHOIS Lookup?

An IP address is the numeric identifier assigned to every device that connects to a network. When you go online, your ISP allocates an IP address to your connection, and that address is recorded in public registration databases maintained by regional internet registries around the world.

An IP WHOIS lookup queries those databases to retrieve the registration data behind any address. The results include the owning organization, the geographic region associated with the network block, the ISP or upstream provider, the Autonomous System Number used for routing, and the abuse contact for reporting malicious activity. Accuracy varies by field: ASN and network block assignments are precise by design because the routing system depends on them. City-level coordinates are estimates, usually accurate within a country but sometimes off by hundreds of kilometers for mobile, satellite or VPN connections.

This tool also handles domain WHOIS lookups and ASN queries, covering all the main identifiers you encounter when investigating network activity. If you are mainly after the location, ISP or hostname behind an address rather than its registry records, the dedicated IP address lookup tool presents those results in more detail.

What WHOIS Actually Is (and What It Isn't)

WHOIS is one of the oldest protocols still in daily use, its roots go back to the early 1980s, before the web existed, when the entire internet directory fit in one file at a single research institute. The idea has not changed since: ask a registry "who is behind this identifier" over port 43 and get a plain-text answer. No login, no API key, no encryption. That simplicity is why every network engineer's muscle memory still types whois into a terminal forty years later.

For IP addresses, the authoritative answers come from the five Regional Internet Registries that divide the world between them: ARIN (North America), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America) and AFRINIC (Africa). A raw WHOIS query often has to follow a referral chain, IANA points to the right RIR, the RIR sometimes points to a national registry or the ISP's own server. Our lookup does that chain-following for you and normalises the result, because the five registries format their answers five different ways.

What WHOIS is not: a person-finder. The record describes the network block and the organisation responsible for it, typically an ISP or hosting company, not the individual subscriber using one address out of thousands. That distinction matters legally and practically, and it's the single most common misunderstanding we see.

WHOIS Is Slowly Handing Over to RDAP

If you've noticed WHOIS results looking different lately, you're not imagining it. The registries have spent the last decade moving to RDAP (Registration Data Access Protocol), a JSON-over-HTTPS replacement that fixes WHOIS's old sins: no standard format, no authentication, no internationalisation, no rate-limit signalling. ICANN formally sunset the old port-43 service for gTLD domain data in January 2025, and the RIRs increasingly treat RDAP as the primary interface for IP data too.

For most people this transition is invisible plumbing, and that's the point. Our lookups query RDAP where it's authoritative and fall back to classic WHOIS where it still rules, then present one consistent result either way. If you're building software against registration data, though, target RDAP directly, new tooling written against port-43 WHOIS in the 2020s is technical debt on day one.

How to Read a WHOIS Result

A registry answer is a wall of key-value pairs, and a handful of them do most of the work. inetnum (or NetRange at ARIN) is the address block the record covers, which tells you how big the allocation is, a /24 belongs to someone small, a /12 to a giant. netname is the registry's internal label for the block, often more revealing than the organisation field, ISPs name blocks after products, cities or acquisitions. org and descr identify the responsible organisation. abuse-c or the abuse mailbox is where complaints should actually go, and it's the field most people need and can't find. country is the registration country of the block, which is not necessarily where any given address in it is used, that's why WHOIS country and geolocation country sometimes disagree, and why we show both.

Dates deserve a glance too: created and last-modified reveal whether a block changed hands recently, which in abuse investigations is frequently the interesting part of the story.

Why You Can't Look Up 192.168.1.1 (or 10.0.0.1)

A steady stream of lookups here are for addresses like 192.168.1.1, 192.168.0.1 or 10.0.0.1, and they all return the same answer: private range, no owner, no location. That's not a database gap. RFC 1918 reserves those blocks for use inside local networks, so the same address exists in hundreds of millions of homes simultaneously, there is nothing global to look up. WHOIS shows only the IANA reservation itself.

If you searched one of these because you're trying to reach your router's admin panel, that's a different job than a lookup: you type the address into the browser while connected to your own network. Step-by-step guides for every brand and every default gateway address are at 19216811.org, our companion site dedicated to router logins.

Common Use Cases

IPv4 and IPv6

IPv4 addresses are 32-bit numbers written in dotted-decimal notation, for example 203.0.113.1. The total pool of roughly 4.3 billion addresses reached exhaustion at the global registry level in 2011, and most regional registries ran out of their allocations in the years that followed. New allocations to operators now come primarily through transfers and auctions rather than direct registry assignment.

IPv6 addresses are 128-bit, written in hexadecimal groups, for example 2001:db8::1. The available space is so large that exhaustion is not a practical concern. Adoption has been growing steadily and IPv6 now carries a significant share of global internet traffic, particularly on mobile networks and in regions where IPv4 space is expensive. This tool supports lookups for both address versions, and the subnet calculator handles the very different arithmetic that IPv6 requires.

Frequently Asked Questions

Our IP Database

IPWhois.net operates its own geolocation database built from multiple authoritative sources. We cross-reference data from regional internet registries, BGP routing tables and proprietary geolocation feeds to produce a unified dataset that covers the entire routable IPv4 and IPv6 address space.

The database is refreshed weekly through automated pipelines. VPN and proxy detection combines multiple commercial and open-source intelligence feeds. ISP speed data is derived from independent network measurement platforms. MAC address vendor records are compiled from official hardware registration authorities.

All lookups on this site query our own databases first, with no external API calls for the core result. This keeps response times under 50ms for most queries and means the service works even when third-party APIs are down.

We actively work with ISPs and network operators worldwide to keep our records accurate. If you are an ISP and would like to update or verify your data in our database, get in touch.