IP Impala
If you've ever seen a suspicious IP in your server logs, a strange login on your account, or an unfamiliar address contacting your network, a WHOIS IP lookup is how you find out who's behind it. It won't name the individual person — but it will tell you which ISP or organization controls that address, and exactly who to contact about it.
This guide explains what an IP WHOIS record actually contains, how it differs from a domain WHOIS, which registry holds the answer, and how to read the record to find the ISP, organization, and abuse contact behind any public IP.
What a WHOIS IP lookup actually tells you
Every public IPv4 and IPv6 address is part of a larger block that has been allocated to an organization. WHOIS is the public record of those allocations. When you look up an IP, the record typically includes:
| Field | What it means |
|---|---|
| Organization / NetName | The ISP, hosting company, or enterprise the block is registered to. |
| Network range (CIDR) | The full block the IP belongs to, e.g. 203.0.113.0/24. |
| ASN | The Autonomous System Number that routes the block, e.g. AS15169. |
| Allocation date | When the RIR assigned the block to the organization. |
| Country | The registered country of the resource holder. |
| Abuse contact | The email address for reporting spam, attacks, or misuse. |
IP WHOIS vs. domain WHOIS — they're not the same thing
People often conflate the two, but they query completely separate systems:
- Domain WHOIS looks up a domain name like
example.comand returns the registrar, name servers, creation/expiry dates, and (where not redacted) the registrant. This data lives with domain registries and registrars. For that, use our sister tool WHOIS Wolf. - IP WHOIS looks up an IP address like
203.0.113.42and returns the network allocation — org, CIDR range, ASN, and abuse contact. This data lives with the five Regional Internet Registries.
A domain and its server's IP can belong to entirely different organizations. A site registered through one registrar might be hosted on a cloud provider whose name appears in the IP WHOIS — so you often need both lookups to get the full picture.
The five RIRs: where IP allocation data lives
There is no single global WHOIS database for IP addresses. Instead, IANA delegates blocks to five Regional Internet Registries (RIRs), each responsible for a part of the world. To read an IP's record, you (or your tool) query the registry for its region:
| RIR | Region covered |
|---|---|
| ARIN | United States, Canada, and parts of the Caribbean |
| RIPE NCC | Europe, the Middle East, and Central Asia |
| APNIC | Asia-Pacific |
| LACNIC | Latin America and the Caribbean |
| AFRINIC | Africa |
Query the wrong registry and it will usually return a referral pointing to the correct one. IP Impala handles this routing for you, so you get the right record without guessing which RIR to ask.
How to find the ISP or organization behind an IP
- Start with the IP. Copy the address from your logs, email headers, or firewall alerts. Make sure it's a public address — private ranges like
10.0.0.0/8and192.168.0.0/16have no public WHOIS record. - Run the lookup. Paste it into IP Impala's free IP lookup. You'll get the organization, ISP, ASN, and approximate geolocation instantly.
- Read the org and ASN. The organization name tells you who runs the block. The ASN tells you the network operator — useful for spotting hosting providers, VPNs, and datacenters versus residential ISPs.
- Note the abuse contact. If the IP is doing something it shouldn't, this is where you report it.
Reading it from the command line
If you prefer the terminal, the classic port-43 protocol still works, and the modern RDAP equivalent returns clean JSON:
# Legacy WHOIS (port 43)
whois 203.0.113.42
# Modern RDAP (JSON, works across all RIRs)
curl https://rdap.arin.net/registry/ip/203.0.113.42RDAP (Registration Data Access Protocol) is the structured, JSON-based successor to legacy WHOIS. It's what most modern tooling uses under the hood, though "WHOIS lookup" remains the everyday term for both.
Finding and using the abuse contact
One of the most practical reasons to run an IP WHOIS is to report abuse — brute-force attempts, spam, scraping, or DDoS traffic. The record publishes a dedicated contact for exactly this:
- On ARIN records, look for
OrgAbuseEmail. - On RIPE records, look for
abuse-corabuse-mailbox.
When you send a report, include the offending IP, timestamps in UTC, and a few relevant log lines. A precise, well-documented report is far more likely to get action than a vague complaint. IP Impala surfaces the responsible organization so you always know where to send it.
Looking up IPs at scale? Go Pro or Business.
The free plan covers 50 lookups a day — perfect for the occasional investigation. Need to check thousands of IPs, automate lookups, or flag proxies and VPNs? Pro ($9/mo) adds API access, VPN/proxy detection, and 2,000 lookups a day. Business ($19/mo) adds unlimited lookups, bulk 100+ IP batches, and CSV/JSON export.
Compare Plans →Common use cases for IP WHOIS
- Security investigation: identify whether a suspicious IP belongs to a residential ISP, a datacenter, or a known hosting provider.
- Abuse reporting: find the right contact to report attacks or spam originating from an address.
- Fraud & risk: flag traffic from hosting/VPN ranges that shouldn't be coming from a "residential" user (VPN/proxy detection is a Pro feature).
- Network troubleshooting: confirm which provider owns an upstream block when diagnosing routing or peering issues.
- Due diligence: verify the hosting organization behind a service before trusting it.
Frequently asked questions
What is a WHOIS IP lookup?
A WHOIS IP lookup queries the databases run by the Regional Internet Registries (RIRs) to reveal who an IP address block is allocated to. It returns the owning organization or ISP, the network range (CIDR block), the Autonomous System Number (ASN), the allocation date, and an abuse contact for reporting misuse. It does not reveal the identity of an individual person using that IP.
How is IP WHOIS different from domain WHOIS?
Domain WHOIS returns the registration details of a domain name (registrar, name servers, and sometimes the registrant) and is served by domain registries and registrars. IP WHOIS returns the allocation details of an IP address block and is served by the five Regional Internet Registries. They are separate systems with separate databases, so you query them differently.
Which RIR should I query for an IP address?
It depends on the region the IP was allocated in: ARIN for North America, RIPE NCC for Europe, the Middle East and Central Asia, APNIC for Asia-Pacific, LACNIC for Latin America and the Caribbean, and AFRINIC for Africa. If you query the wrong RIR, it usually returns a referral pointing you to the correct one. Tools like IP Impala route the query automatically.
Can a WHOIS lookup tell me the name of the person using an IP?
No. WHOIS shows the organization the IP block is registered to — usually an ISP, hosting provider, or company — not the individual subscriber. Only the ISP can map an IP to a specific customer, and they generally release that information only in response to a valid legal request.
How do I find the abuse contact for an IP address?
The abuse contact is published in the WHOIS record for the IP block, usually as an OrgAbuseEmail (ARIN) or abuse-c / abuse-mailbox (RIPE) field. Report spam, attacks, or misuse to that address, including timestamps in UTC and relevant log lines. IP Impala surfaces the responsible organization so you know where to send the report.
What is RDAP and how does it relate to WHOIS?
RDAP (Registration Data Access Protocol) is the modern, JSON-based successor to the legacy port-43 WHOIS protocol. It returns structured, machine-readable data and supports standardized queries across all RIRs. New tooling increasingly uses RDAP, but the term "WHOIS lookup" is still commonly used for both.