Look up the RIR record for an IP — network range, owner, and abuse contact
• Enter an IPv4 or IPv6 literal — domains are rejected (use the WHOIS tool for domains)
• Shows the RIR-registered network range, netname, owning organization, and country
• The abuse contact email is where you report abuse originating from this address
IP WHOIS queries the Regional Internet Registry (ARIN, RIPE, APNIC, LACNIC, or AFRINIC) that allocated an address block and returns who the block belongs to. Unlike domain WHOIS, the answer describes a network — the allocated range, its CIDR, the assigned netname, the owning organization, the registered country, and the abuse contact for reporting malicious traffic.
It is commonly used to identify the operator behind an IP seen in server logs, find the correct abuse address to report spam or attacks, confirm which provider or datacenter hosts a service, and check the size and country of a network allocation.
Domain WHOIS describes a registered domain name and its registrar. IP WHOIS describes a block of addresses and the network operator the Regional Internet Registry allocated it to — different databases, different fields.
It is the address the network operator publishes for reporting abuse (spam, attacks, scanning) originating from that IP range. Reports usually reach the hosting provider or ISP responsible for the address.
Large providers allocate sub-ranges to customers. The RIR record may show the upstream holder rather than the end customer, especially for cloud and hosting ranges that are reassigned frequently.