IP WHOIS Lookup — Who Owns This IP Address?

Looks up the registration record for an IP address via RDAP — the organization it's allocated to, the full address block it belongs to, which regional registry manages it, and the abuse contact to report it to. This is a different question from geolocation: geolocation estimates roughly where an address is; WHOIS/RDAP tells you who it actually belongs to on paper.

Domain WHOIS vs IP WHOIS

Both are RDAP lookups and both are queried the same way here, but they answer different questions. Domain WHOIS tells you who registered a name and through which registrar. IP WHOIS tells you which organization was allocated a block of address space by a Regional Internet Registry (RIR) — ARIN for North America, RIPE NCC for Europe/Middle East/Central Asia, APNIC for Asia-Pacific, LACNIC for Latin America, AFRINIC for Africa — and that allocation can be decades old and completely disconnected from whoever is actually using the address today, especially for large cloud and hosting providers who sub-allocate constantly.

Why the "organization" field is often a big company, not the culprit

A lookup on almost any residential IP will often show the ISP as the registered organization, not the actual subscriber — ISPs don't register individual customer addresses with the RIR, only the block they were allocated. Similarly, a lookup on a cloud provider's IP shows the cloud provider (AWS, Google, Microsoft, DigitalOcean, etc.), not whichever customer's VM happens to be using that address right now. The registration record tells you who to send an abuse report to, not who's personally responsible for the traffic.

The parent block and CIDR fields

The address range and CIDR shown here is the specific sub-block this IP falls within, and the parent block reference is the larger allocation it was carved out of — useful when you're trying to understand how a large provider's address space is organized, or confirming that a range genuinely belongs to who it claims to.

Where this actually gets used

• Reporting abuse (spam, scanning, attacks) to the correct contact instead of guessing
• Confirming a suspicious IP genuinely belongs to the cloud provider or ISP it claims to be from
• Working out whether an address is part of a residential, hosting, or enterprise-allocated range before deciding how to treat it
• Tracing which RIR and country an allocation falls under during an investigation