Reading IP Whois and RDAP results: owner, network and abuse contact

Reading IP Whois and RDAP results: owner, network and abuse contact

By James Bayliss · Updated · Reviewed

In this guide
  1. Who hands out IP addresses
  2. WHOIS vs RDAP
  3. Reading the record
  4. Reporting abuse
  5. When the record is unhelpful
  6. Sources

Who hands out IP addresses

IANA allocates large blocks to five Regional Internet Registries (RIRs). Each runs registration records for its region:

RegistryRegion
ARINUnited States, Canada, parts of the Caribbean
RIPE NCCEurope, the Middle East, parts of Central Asia
APNICAsia-Pacific
LACNICLatin America and parts of the Caribbean
AFRINICAfrica

RIRs allocate blocks to ISPs and large organizations, which may reassign smaller blocks to customers. Whether a reassignment appears in Whois depends on its size, the registry's policy, and whether the ISP bothered to register it.

WHOIS vs RDAP

Classic WHOIS returns free-form text over TCP port 43, in a different layout at each registry. RDAP (Registration Data Access Protocol; RFC 9082 and RFC 9083) returns structured JSON over HTTPS, with consistent field names and referrals between registries. Our IP Whois starts at ARIN's RDAP service and follows its referral to whichever registry holds the record.

Reading the record

FieldWhat it tells you
Range / CIDRThe block the record covers, e.g. 203.0.113.0/24. The address you looked up is somewhere inside it.
Network name and handleThe registry's identifiers, useful when contacting the registry or the ISP
Allocation typeARIN shows types such as Direct Allocation (from the RIR to an ISP) and Reassigned (from an ISP to a customer). RIPE uses statuses such as ALLOCATED PA and ASSIGNED PA.
Parent networkThe larger block this one was carved from; useful when the specific record has no abuse contact
organizationWho registered the block: often an ISP, cloud provider or hosting company
Abuse contactWhere the operator wants abuse reports sent
Registered / updated datesWhen the record was created and last changed. A very recent change can mean the block was just transferred.

Why the owner may not be who you expect

  • Cloud and hosting providers register huge ranges and rent addresses minute by minute. Whois shows the provider, never the tenant.
  • ISPs rarely register individual home or small-business customers.
  • Mobile carriers use carrier-grade NAT, so thousands of users share one address.

For a closer clue about who uses an address, check its reverse DNS on What Is My IP? (it shows your own) or in the Email Blacklist Check (for any IP). Then look at the ASN: the network that announces the route.

Reporting abuse

  1. Use the abuse contact from the record. If the most specific record has none, use the parent network's. RIPE records use a dedicated abuse-c contact, and providers monitor these mailboxes.
  2. Make it actionable. Include the IP, the exact date and time with time zone (UTC is best), what happened, and relevant log lines or full email headers. Reports without timestamps are usually ignored, because the address may have changed hands.
  3. Send one report per incident, not a stream of automated ones, unless the provider asks for automated feeds.
  4. Don't expect a reply. Large providers act on reports without responding individually.
  5. For phishing or malware hosting, also report to the hosting provider's dedicated form if they have one, and to the brand being impersonated.

When the record is unhelpful

  • No abuse contact anywhere: contact the organization's general support, or the upstream network found through its ASN.
  • Record looks stale: RIRs run accuracy processes. ARIN, for example, lets you report inaccurate Whois data.
  • Address is in a reserved range (private 10.0.0.0/8, 192.168.0.0/16, carrier-grade NAT 100.64.0.0/10, and so on): there is no public owner, and the traffic came from inside a network. Our tool refuses these ranges for that reason.

From the field: Utilizing IPWhois to find who owns an IP block is essential to combating phishing and other forms of abuse, as an IT admin or Engineer.

Sources

Check it now

IP Whois Who owns this IP address, and where do I report abuse from it?

Related guides