What is a WHOIS IP lookup?
Quick answer
A WHOIS (“who is”) lookup shows who an IP address or domain name is registered to. For an IP address, it usually reveals the internet provider or organization that owns the block of addresses, its country and an abuse contact, not the name or home address of an individual user.
What a WHOIS IP lookup shows
| Usually shows | Usually doesn’t show |
|---|---|
| The organization that owns the IP range, such as an ISP, cloud host or company | The person using the IP |
| The country and sometimes region | A street address of a home user |
| The IP range (block) | Browsing history |
| An abuse contact for reporting spam or attacks | Passwords or account details |
Who keeps the records?
IP addresses are handed out by five Regional Internet Registries:
| Registry | Region |
|---|---|
| ARIN | North America |
| RIPE NCC | Europe, Middle East, Central Asia |
| APNIC | Asia-Pacific |
| LACNIC | Latin America, Caribbean |
| AFRINIC | Africa |
Each has a free lookup on its website.
WHOIS for domain names
For a website domain, WHOIS shows the registrar, creation and expiry dates and name servers. Since data-protection laws like Europe’s GDPR (2018), most owners’ personal details are hidden. WHOIS is also gradually being replaced by RDAP, a newer protocol that delivers the same kind of data in a more structured way.
How to run a lookup
- Use the lookup on a regional registry website, or a trusted WHOIS/RDAP tool.
- On Mac or Linux, open Terminal and type whois followed by the IP or domain.
Why people use it
- To see which company is behind suspicious traffic or emails
- To report abuse to the right network
- To check when a domain expires or who registered it
Want to see your own address first? Here’s what your IP address is. Got an unknown call instead? See who called me.
Still curious?
Jump to a random question from the archive.