How to Do a WHOIS Lookup on an IP Address or Domain

Every IP address block and every domain name has a public paper trail — who registered it, which organisation operates it, and who to contact about abuse. WHOIS is the protocol (and the family of databases) that lets anyone look this up.

What a WHOIS lookup reveals

For an IP address:

• The organisation the block is allocated to (an ISP, cloud provider, or company)
• The address range it belongs to, e.g. 203.0.112.0/22
• The regional registry (ARIN, RIPE, APNIC, LACNIC, AFRINIC) and country of registration
• Abuse and technical contact emails
• The ASN announcing the range

For a domain: registrar, creation and expiry dates, nameservers, and registrant details (nowadays usually redacted for privacy).

How to run one

Web: the registries' own lookups are authoritative — ARIN's search, RIPE's database query, or aggregate tools. For IPs, our homepage already shows the owning organisation and ASN of your own address instantly.

Command line (Mac/Linux):

whois 8.8.8.8
whois example.com

Windows users can use PowerShell alternatives or any web lookup.

Reading IP results correctly

Common misunderstandings to avoid:

• WHOIS shows the network operator, not the user. A lookup of a home user's IP returns their ISP's corporate details — never the subscriber's name or address.
• The registered country isn't always the usage country. Blocks get deployed wherever the operator needs them — one reason geolocation misses.
• Cloud IPs name the cloud, not the customer. An abusive server on a cloud IP traces to the provider's abuse desk, which is exactly where to send complaints.

Practical uses

1. Reporting abuse — find the abuse contact for an attacking or spamming IP.
2. Vetting a connection — is that login from a residential ISP or a datacenter range?
3. Domain due diligence — check a site's age and registrar before trusting it; freshly registered domains are a phishing red flag.
4. Buying a domain — see when it expires and through whom.

Related: reverse DNS answers a different question — what hostname an IP presents — and pairs well with WHOIS when investigating an address.

Frequently asked questions