WHOIS IP Lookup
Ownership and allocation details for an IP address.
Enter an IP address to see who it is allocated to. We query the live RDAP registry data for the address, so you can find the network owner, the address range and the country it sits in. Nothing is stored.
This tool queries RDAP and WHOIS data for an IP address and returns who it is allocated to: the owning organisation, the network range, the Regional Internet Registry that issued it, and abuse-contact details. It is the quickest way to find out which provider or company actually controls an address that appears in your mail logs or DMARC reports.
What the ownership data tells you
Every public IP is allocated by one of five Regional Internet Registries (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC), and the result shows which registry holds the record, the CIDR block the address belongs to, and the named organisation. Modern lookups use RDAP (the structured JSON successor to plain-text WHOIS defined for IP allocations), which gives consistent fields and an abuse contact you can use to report misuse. The allocation tells you whether an address is a known ESP, a cloud host, a residential ISP, or an unfamiliar network.
How this helps email authentication
When you read a DMARC aggregate report, each source IP that sent mail claiming to be your domain is listed. Looking up an unexpected IP tells you whether it is a legitimate service you forgot to authorise (a marketing platform, a CRM, a helpdesk) or a genuine spoofer. Legitimate sources should be added to your SPF record or aligned through DKIM before you tighten your DMARC policy; unauthorised sources are exactly what enforcement is meant to block. The ownership data also helps when investigating a poor sender reputation or checking the host behind your own MX. Note that WHOIS reflects allocation, not real-time trust: an address allocated to a reputable cloud provider can still be abused by one of its customers. Pair this with a blacklist check for a fuller picture.
Frequently asked questions
What is the difference between WHOIS and RDAP?
WHOIS is the older plain-text query protocol; RDAP is its modern replacement that returns structured JSON with consistent fields, standardised contacts, and better internationalisation. For IP allocations the registries now serve RDAP, and this tool uses it where available, falling back to WHOIS data.
Why would I look up an IP from my DMARC reports?
Aggregate reports list every IP that sent mail using your domain. Looking up an unfamiliar one tells you whether it belongs to a legitimate service you need to authorise in SPF or DKIM, or to an attacker spoofing you, which is what enforcement blocks.
Does the registry record prove the sender is trustworthy?
No. WHOIS shows who an address is allocated to, not how it is being used right now. A reputable cloud or ESP range can host both legitimate senders and abusive customers, so combine ownership data with reputation and blacklist checks.
What are the five Regional Internet Registries?
They are ARIN (North America), RIPE NCC (Europe and the Middle East), APNIC (Asia-Pacific), LACNIC (Latin America and the Caribbean) and AFRINIC (Africa). The relevant one depends on where the address block was allocated, and the result shows which registry holds the record.
How do I report abuse from an IP address?
The lookup returns an abuse contact, usually an email address, published by the network owner for exactly this purpose. Send your evidence (log lines with timestamps and the offending IP) to that address rather than to a general support queue.
Can I look up IPv6 addresses as well as IPv4?
Yes. RDAP and WHOIS cover both. IPv6 allocations are returned with their network prefix and owning organisation in the same way, which matters because many cloud providers and mail platforms now send over IPv6.