WHOIS IP Lookup: How to Trace an Address Back to Its Real Owner

Start here: WHOIS answers "which organisation was allocated this address block, and who do I report abuse to?" It does not answer "who was using this address?" That second question is answerable only by the ISP, only from their internal logs, and in almost every country only under legal process.

Who hands out addresses in the first place

The registry system is a three-tier hierarchy, and understanding it makes every record readable.

At the top, IANA allocates large blocks to five Regional Internet Registries, each covering a part of the world: ARIN (North America), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America and the Caribbean), and AFRINIC (Africa). Each RIR sub-allocates to ISPs, hosting companies and large organisations. Those in turn assign smaller ranges to their own customers.

WHOIS is the public database of that chain. Query an address and you get the current custodian of the block containing it — and, if the ISP has documented a sub-assignment, sometimes the business it was assigned to.

Reading a record, field by field

The fields that matter, and what each actually means:

• inetnum / NetRange — the address range this record covers. Note the size: a /24 is 256 addresses and often one customer; a /16 is 65,536 and is almost certainly the ISP itself.
• netname — a short label. Frequently the most informative field, since ISPs often encode the city or the customer name here.
• org / OrgName / descr — the organisation holding the block. A telecom name means a residential or mobile subscriber. A hosting company name means a server, which matters enormously for interpreting traffic.
• country — the country the holder registered, which is not necessarily where the address is physically routed. A block registered in the Netherlands may be announced in Brazil.
• abuse-c / OrgAbuseEmail — the address to send complaints to. This is the field most people are actually looking for and most people never find.
• origin / AS number — the autonomous system announcing the route. Ties the address to a real network on the global routing table.
• mnt-by, created, last-modified — who maintains the record and when it last changed. A recently modified record on a block sending you traffic is worth noting.

WHOIS is being replaced by RDAP

Classic WHOIS returns unstructured text in a format that varies by registry, which makes it awkward to parse and inconsistent to read. Its replacement, RDAP (Registration Data Access Protocol), returns structured JSON over HTTPS, supports internationalised text properly, and — importantly — supports authenticated access, so registries can show more detail to verified requesters than to the anonymous public.

All five RIRs run RDAP today and it is the direction of travel for tooling. If you are automating lookups, target RDAP rather than scraping WHOIS text. If you are doing it by hand, either works; the RDAP output is simply easier to read.

What GDPR changed, and what it did not

People often report that WHOIS "stopped working" after 2018. What actually happened is narrower than that.

Domain WHOIS was heavily redacted. Registrant names, addresses, phone numbers and emails for domains held by individuals are now largely replaced by privacy-service placeholders, because that data is personal data under GDPR.

IP WHOIS was mostly unaffected. Address blocks are allocated to organisations, not to natural persons, and the registries treat allocation records as operational data that must stay public for the internet to function — you cannot report abuse to a network you cannot identify. Organisation names, ranges and abuse contacts remain visible. What you will not find is the individual subscriber, and that was never in WHOIS to begin with.

Reading the result correctly

The single most useful thing a WHOIS lookup tells you is what kind of connection you are looking at.

A residential ISP — Comcast, Vivo, BT, Deutsche Telekom — means a home or mobile user. Treat the geolocation as approximate, and remember that under carrier-grade NAT the address may be shared by hundreds of subscribers.

A hosting or cloud provider — AWS, OVH, Hetzner, DigitalOcean — means a server, not a person browsing. Traffic from these ranges hitting a consumer site is disproportionately automated: scrapers, scanners, proxies and VPN exit nodes. This is the signal most fraud systems weight heaviest.

A corporate or educational allocation means the traffic came from inside that organisation's network. The abuse contact here is a real security team that will usually act on a well-documented report.

A range flagged as bogon or unallocated should never appear as a source on the public internet. If it does, the address is spoofed or the route is hijacked.

Filing an abuse report that gets read

Abuse desks receive enormous volumes of low-quality mail. A report that gets acted on has a specific shape:

1. Timestamps with a timezone, ideally UTC. Without this the provider cannot map the address to a subscriber, because under CGNAT and DHCP the same address belonged to different people at different moments. A report without a precise timestamp is unactionable no matter how serious the incident.
2. Raw log lines, not screenshots and not a summary. Include the source port where you have it — under CGNAT the port is what distinguishes one subscriber from another.
3. A plain description of what happened: port scanning, credential stuffing, a denial-of-service attempt.
4. Send it to the abuse contact from the WHOIS record, not to sales, not to a web form, not to a social account.

Expect an automated ticket number and, usually, no detail about the outcome — privacy law prevents them telling you what they did to their customer. Silence does not mean nothing happened.

The limits, stated plainly

WHOIS will not give you a person's name. It will not give you a street address. Geolocation attached to an IP is an inference from a commercial database, not a fact from the registry, and it is routinely wrong at city level and sometimes wrong at country level for mobile and satellite ranges.

If an address is behind a VPN, a proxy or Tor, WHOIS tells you about the exit node's owner and nothing whatsoever about the user behind it. That is the entire design goal of those services, and no lookup tool defeats it.

For anything requiring actual attribution — harassment, fraud, a crime — the path is a report to law enforcement, who can compel the ISP to produce subscriber records. There is no shortcut, and services claiming to offer one are selling you nothing.

Running a lookup

Our IP lookup tool resolves any address or domain to its network owner, ASN, and approximate location in one query. For the route itself — which networks the traffic crosses and where they exchange it — see our explainer on ASNs, peering and internet exchange points.