WHOIS / RDAP Lookup
Look up registration data for any IP address. Find the network holder, RIR allocation, abuse contact, and registration dates - enriched with BGP routing and threat intelligence.
RIR Registration
Allocation and assignment data from ARIN, RIPE, APNIC, LACNIC, and AFRINIC
Network Holder
Organization name, registration country, and network range for any IP
Abuse Contact
Find the responsible abuse contact email for reporting incidents
Full Context
Combined with BGP routing, geolocation, and threat intelligence
Example: WHOIS for 1.1.1.1
| IP Address | 1.1.1.1 |
| Network | 1.1.1.0/24 |
| Netname | APNIC-LABS |
| Organization | APNIC Research and Development |
| RIR | APNIC |
| Country | AU |
| Abuse Contact | [email protected] |
| Registration Date | 2011-08-10 |
This is a static example. Enter any IP above to see live WHOIS data with BGP routing context.
Popular WHOIS Lookups
How It Works
Enter IP
Type any IPv4 or IPv6 address into the search bar.
Aggregated Data
We query RIR databases and combine with BGP routing, RPKI validation, and threat intelligence.
Full Context
See registration data alongside geolocation, ASN, threat score, and BGP routes on the IP detail page.
Regional Internet Registries
IP address space is allocated by five RIRs, each covering a geographic region. WHOIS data originates from the RIR that allocated the address block.
| RIR | Region |
|---|---|
| ARIN | North America |
| RIPE NCC | Europe, Middle East, Central Asia |
| APNIC | Asia-Pacific |
| LACNIC | Latin America, Caribbean |
| AFRINIC | Africa |
Frequently Asked Questions
What is WHOIS?
WHOIS is a protocol for querying registration databases to find who is responsible for an IP address, domain name, or ASN. For IP addresses, WHOIS data comes from the five Regional Internet Registries (RIRs): ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC. It includes the network range, organization name, country, and abuse contact information.
What is RDAP?
RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS. It returns structured JSON responses instead of free-text, supports HTTPS and authentication, and provides standardized data formats. ipctl uses RDAP where available and falls back to WHOIS for legacy data.
How does ipctl WHOIS differ from other tools?
ipctl combines WHOIS/RDAP registration data with BGP routing information, RPKI validation, geolocation, and threat intelligence in a single query. Most WHOIS tools only show registration data - ipctl shows the full network context including which ASN originates the prefix, its RPKI status, and any threat indicators.
Can I look up WHOIS via API?
Yes. The GET /v1/whois/{ip} endpoint returns structured WHOIS data including network range, organization, RIR, abuse contact, and registration dates. The GET /v1/ip/{ip} endpoint also includes RIR allocation data. Free tier includes 1,000 requests/day.
Is WHOIS data always accurate?
WHOIS data is maintained by the RIRs and the organizations that hold allocations. While registration data is generally accurate for network ranges and responsible organizations, some entries may be outdated. ipctl refreshes RIR data regularly to stay current.
Programmatic Access
Query WHOIS data via the REST API. Returns structured JSON with network range, organization, RIR, abuse contacts, and registration dates.