Skip to main content
CaptainDNS

Whois IP Lookup

Identify the owner of any IP address

Need to know who owns an IP address? Enter an IPv4 or IPv6 and instantly get the owning organization, country, registry, and CIDR block. The abuse contact, allocation dates, and raw WHOIS come with the full report (free account).

Key features

IPv4 and IPv6

Works with both address formats. Identify legacy addresses and new IPv6 allocations alike.

Global registries

Automatic queries to RIPE, ARIN, APNIC, LACNIC, and AFRINIC based on the IP range searched.

Abuse contact

Find the abuse email in the full report (free account) to report spam, attacks, or suspicious behavior from this IP.

CIDR range

View the complete network block assigned to the organization. Useful for firewall rules.

100% free

Free to use. Create a free account to reveal the full report (abuse contact, allocation dates, raw WHOIS).

What is IP Whois lookup used for?

IP Whois helps identify the organization responsible for an IP address and find the right contacts when needed.

Common use cases:

  • Abuse reporting: Find the abuse email to report spam, DDoS attacks, or port scanning
  • Security investigation: Identify the source of suspicious connections in your logs
  • Firewall configuration: Get the complete CIDR range to block or allow a network
  • Partner verification: Confirm that a vendor's IP actually belongs to their organization

How to interpret Whois results

Organization and netname

The organization field shows the legal entity that owns the IP block. The netname is the technical identifier for the network range.

Examples:

  • Google LLC → Block owned by Google
  • OVH SAS → Server hosted at OVH
  • CLOUDFLARENET → IP behind Cloudflare CDN

AS number

The AS number (e.g., AS15169) identifies the autonomous system that routes the block across the internet, usually the network operator. It is the same identifier used in BGP routing, so it lets you attribute an IP to its real operator even when the organization name is generic or resold.

CIDR range and address range

The tool shows the CIDR range (e.g., 203.0.113.0/24) directly, along with the address range (first and last address of the block). Use the CIDR notation to block or allow the whole network:

# Block entire range on Linux firewall
iptables -A INPUT -s 203.0.113.0/24 -j DROP

Abuse contact

With a free account, the abuse email appears directly in the results, so there is no need to dig through the raw record. This is the address dedicated to reporting spam, attacks, or abuse coming from the IP. Send your report there rather than to the generic admin or technical contacts.

Allocation status and dates

The results also show the allocation status (for example ALLOCATED or ASSIGNED) plus the registration and last updated dates of the block. A recent update date suggests the record is actively maintained; an old one may signal stale information.

The 5 regional internet registries (RIRs)

IP addresses are managed by 5 regional registries that delegate blocks to operators and organizations:

RegistryRegionExample range
RIPE NCCEurope, Middle East, Central Asia193.0.0.0/8
ARINNorth America74.0.0.0/8
APNICAsia-Pacific1.0.0.0/8
LACNICLatin America, Caribbean200.0.0.0/8
AFRINICAfrica41.0.0.0/8

The tool automatically identifies the correct registry based on the IP address searched.

Limitations of IP Whois

What WHOIS does NOT show

  • End user: Behind a residential IP, Whois shows the ISP, not the subscriber
  • Exact location: The country shown is the organization's, not the physical server's
  • Real-time activity: Whois describes ownership, not current BGP state or routing

Potentially outdated data

Whois databases are updated by the organizations themselves. Some information may be dated. When in doubt, cross-reference with RDAP (modern standardized format).

FAQ - Frequently asked questions

Q: What's the difference between domain Whois and IP Whois?

A: Domain Whois identifies the owner of a domain name (e.g., captaindns.com) and its registrar. IP Whois identifies the organization that owns a block of IP addresses and the network operator responsible.

Q: How do I find the abuse contact for an IP address?

A: Perform a Whois lookup on the IP, then create a free account to reveal the abuse email in the full report. It comes from the 'abuse-mailbox' or 'abuse-c' field and is dedicated to reporting spam, attacks, or abuse from this IP.

Q: Why is some Whois information hidden?

A: Some organizations use privacy protection services or WHOIS proxies. Cloud operators and CDNs often hide their end customers' details for privacy reasons.

Q: How accurate is Whois geolocation?

A: Whois shows the country of the owning organization, not the exact server location. For more precise geolocation, use specialized databases (MaxMind, IP2Location).

Q: How can I tell if an IP belongs to a VPN or proxy?

A: Look for the organization name in the Whois results. Known VPN providers (NordVPN, ExpressVPN) and proxy services typically appear in the organization or netname field.

Q: Can I block an entire IP range using Whois information?

A: Yes. Whois provides the CIDR range (e.g., 203.0.113.0/24) assigned to the organization. You can use this notation to configure blocking rules on your firewall.

Complementary tools

ToolPurpose
Reverse DNS (PTR)Find the hostname associated with an IP
My IP AddressDisplay your current public IP
IP blacklistCheck if an IP is blocklisted
RDAP LookupQuery domain registration data (registrar, dates, EPP status)

Useful resources