What this lookup does
WHOIS is the public directory of who holds which slice of internet number resources — IP ranges, Autonomous System numbers, and domain names. RDAP (Registration Data Access Protocol) is the modern, structured replacement for the original 1980s-era WHOIS text protocol. It returns JSON, supports internationalised text, and standardises the redirect path between the five regional internet registries (RIRs): ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America, and AFRINIC for Africa.
IPFerret bootstraps the query against ARIN and follows the cross-RIR redirect transparently — so you can paste in any IP and get the responsible registry's answer without first working out which RIR owns it. The block above shows the live record exactly as the registry returned it.
How RDAP resolves the right registry
The address space is partitioned: each RIR is delegated large blocks by IANA and then sub-allocates them to networks. Because the blocks are non-overlapping, a single starting point can hand any query off to the right place. When IPFerret asks ARIN about an address that actually belongs to, say, RIPE, ARIN replies with an HTTP redirect to the RIPE RDAP endpoint, and we follow it. The end result is one consistent JSON document regardless of which registry ultimately answered. That document is what powers the allocation, contact, and routing sections above.
Reading the record
- Allocation block — the CIDR range the IP falls in, the organisation that holds it, the registration date, and when the record was last changed. The start and end addresses bound the whole assignment, which is often much larger than the single IP you searched.
- Registrant — the organisation listed as holding the allocation. For cloud and CDN ranges this is the provider (Amazon, Google, Cloudflare, OVH), not the individual customer running a site on that address.
- Abuse contact — where to file a complaint. If an IP is sending spam, scraping aggressively, or probing your systems, this is the email to use. RIRs require networks to keep this address working.
- Technical contact — the operational point of contact, when the network lists one separately from the registrant.
- Origin AS — which Autonomous System(s) announce this prefix in BGP. The CIDR ranges link straight into the CIDR calculator so you can expand any block into its address range.
Common pitfalls
The biggest misconception is treating IP WHOIS as a way to find a website's owner. It is not. An allocation record describes the network that holds the address, and most sites live behind shared hosting, a reverse proxy, or a CDN — so the “owner” you see is infrastructure, not the operator of any one domain. To attribute a specific site, pair this with a DNS lookup and a reverse DNS check, and remember that geolocation derived from an allocation is approximate — registries record the holding organisation's country, which can differ from where the server physically sits.
Records also vary in completeness. Some registries redact personal contact details for privacy or legal reasons, and smaller assignments may inherit their abuse contact from a parent block rather than listing their own. A missing field usually means the registry simply did not publish it, not that the lookup failed.
Frequently asked questions
What is the difference between WHOIS and RDAP?
WHOIS is the original text protocol, where every registry formatted output differently and reliable parsing was painful. RDAP returns the same data as structured JSON with a standard schema, consistent field names, and a defined redirect path between registries. This page queries RDAP and renders the structured result.
Why does the registrant show a hosting provider, not the site owner?
IP records describe who holds the address allocation, not who runs a particular site on it. Shared hosting, cloud platforms, and CDNs mean the registrant is usually the infrastructure company. Identify a domain's operator from its DNS and the site itself, not from the IP allocation.
How do I report abuse from an IP address?
Use the abuse contact shown above. Email it with timestamps in UTC, the offending IP, and relevant log excerpts. Networks holding allocations are required by their RIR to keep a working abuse contact, so this is the correct first stop.
JSON API
Everything above is machine-readable: GET /api/whois/104.16.0.0. Use it to script bulk lookups or feed allocation data into your own tools.
Related tools
Combine this with the DNS lookup to see where a name resolves, the CIDR calculator to expand any allocation block, and reverse DNS to map an IP back to a hostname. For IP-reputation context, see how IP reputation works.