WHOIS IP Lookup — Who Owns This IP Address
Enter an IP address to see who it is registered to: the organisation, the netblock it sits in, its ASN, the abuse contact and when the allocation was last changed.
Who this is for: People filing abuse reports, vetting a hosting provider before buying, or investigating unexpected traffic.
What an IP WHOIS record contains
For an IP address, a WHOIS record answers 'who is responsible for this block', not 'who is using it'. The useful fields are: the allocating registry (ARIN, RIPE, APNIC, LACNIC, AFRINIC), the organisation the block is assigned to, the netblock range and its name, the ASN that announces it, the abuse contact, and the registration and last-modified dates.
If the organisation is a hosting company, the block is a datacenter range. If it is a consumer ISP, the address is likely residential or mobile. That single distinction changes how you should interpret everything else about the IP.
WHOIS or RDAP?
WHOIS is the original protocol from the 1980s: plain text, no standard format, and nearly impossible to parse reliably across registries. RDAP is its replacement: structured JSON, a defined schema, and proper support for internationalised data.
All five regional registries now run RDAP. Legacy WHOIS still works on many of them but is being retired. PureIP queries RDAP first and falls back to WHOIS only where RDAP is unavailable — which means the output you get is structured and consistent instead of a wall of text.
Reading the record without guessing
- Netblock (inetnum / NetRange): the range of addresses owned by one organisation. If your IP sits in a /16 owned by a hosting provider, the whole range is datacenter space.
- ASN: the autonomous system announcing the block. Checking the ASN is often faster than reading the netblock, because one ASN usually means one operator.
- Abuse contact: where to send reports. Using the registry's recorded address is far more effective than emailing a support page.
- Registration and modification dates: old blocks belong to large incumbents; recently allocated ones are often new hosting resellers.
What it is useful for
- Abuse and spam reports. The registry-recorded abuse contact is the address that actually gets acted on.
- Judging an IP before you buy a hosting plan. If the block belongs to a reseller rather than the provider you think you are buying from, you now know that in advance.
- Investigating suspicious traffic. An IP registered to a bulletproof host in a permissive jurisdiction deserves a different response from one registered to a national telecom.
- Reconciling geolocation oddities. When a location lookup gives a surprising answer, the WHOIS record usually explains why.
What WHOIS will not tell you
It will not tell you the end user, the website hosted on the IP, or whether the IP is currently malicious. An IP can be registered to a reputable company and be hosting compromised traffic at the same time. WHOIS describes ownership, not behaviour — for behaviour you need a reputation check.
Frequently asked questions
Can I find out who owns an IP address for free?
Yes. Registry data is public. RDAP endpoints are open, and PureIP queries them without requiring an account.
Why does the WHOIS record show a hosting provider instead of a person?
IPs are allocated to organisations, not individuals. Consumer ISPs hold large blocks and assign addresses to subscribers dynamically, so the record shows the ISP. Hosting providers hold blocks for their customers' servers.
What is the difference between WHOIS and RDAP?
RDAP is the structured, standardised successor to WHOIS. It returns JSON with a defined schema, supports internationalisation and works over HTTPS. WHOIS returns free-form text and is being phased out.
Is it legal to look up WHOIS data?
Yes. It is public registry data. What you do with it — for example contacting an abuse address, or processing personal data from domain records — is where local rules such as GDPR apply.
Related tools
PureIP — free IP lookup and network diagnostics: IP location, WHOIS, reverse DNS, reputation, blacklists, AI service reachability and global ping.