WHOIS provides ownership and registration information for IP addresses. It's an essential tool for network administrators, security researchers, and anyone dealing with IP addresses.
What is WHOIS?
WHOIS is a query-response protocol for accessing registration information about IP addresses and domain names. For IP addresses, Regional Internet Registries (RIRs) maintain WHOIS databases.
Each RIR operates its own WHOIS service: RIPE (Europe), ARIN (Americas), APNIC (Asia-Pacific), AFRINIC (Africa), and LACNIC (Latin America).
WHOIS Information Includes
A typical WHOIS lookup reveals key information.
- Organization name and address
- IP range and CIDR block
- Allocation date and RIR
- Abuse contact information
- Associated ASN (if applicable)
- Network name and status
How to Perform WHOIS Lookups
There are several ways to look up IP WHOIS information.
Command Line
Run: whois 192.0.2.1
RIR Databases
RIPE Database, ARIN WHOIS, etc.
Web Tools
MXToolbox, WhoisXML API, IPinfo
WHOIS for Leased IPs
When you lease IP addresses, the WHOIS registration typically remains with the original owner. IP Market provides documentation (LOA) proving your authorization to use the addresses.