Guide
Overview
Every device on the internet has an IP address, and the registration data behind it is public. A WHOIS lookup shows which organization holds the address block, which regional registry covers it and where to send abuse reports. The registries publish this information for free.
Each regional registry runs its own free WHOIS search on its website. To report hacking, fraud or other internet crime, use the FBI and CISA forms listed below.
Guide
Regional Internet Registries (RIRs)
Five Regional Internet Registries split the world by geography. Start with the one that covers the IP you are researching.
- ARIN Whois/RDAP SearchCanada, the United States and some Caribbean islands
- RIPE NCC Database QueryEurope, the Middle East and Central Asia
- APNIC Whois SearchAsia Pacific region
- LACNIC QueryLatin America and some Caribbean islands
- AFRINIC WHOIS LookupAfrica
ARIN covers Canada, the United States and many Caribbean and North Atlantic countries, so most IP addresses used in the United States are found in its WHOIS search.
Guide
WHOIS & Domain Lookup
Registration data for a domain name is held by the registry and the registrar for that name. Names ending in .gov are registered only by U.S. governments, through the .gov registrar.
Guide
Reporting Abuse and Internet Crime
To report abuse from an IP address, email the abuse contact in its WHOIS record. To report a crime, use the federal forms below.
Guide
IP Geolocation
Geolocation services estimate the country, city and network provider of an IP address. The estimate is approximate and differs from one database to another, so treat it as a hint, not an address.
Guide
How to Read an IP Lookup
An IP lookup gives you four things: the network owner (the organization assigned the IP block), the parent block (the larger range the IP belongs to), the assigned region (which RIR covers it), and the abuse contact (who to email about misuse). The owner is usually a hosting provider, ISP, university, or large company. The abuse contact is required by RIR policy on every assigned block.
Geolocation data is separate from registration data. A WHOIS lookup tells you who owns the IP. A geolocation lookup estimates where the IP is being used right now. The two often disagree, especially for large hosting providers serving customers worldwide. For fraud or abuse work, the WHOIS owner is what matters legally. For traffic analysis, geolocation matters more.
Straight answers
Questions about IP address lookups
Can I find out who is behind an IP address?
You can find the organization that holds the IP block (usually a hosting provider or ISP) through WHOIS. You generally cannot find the individual person using a specific IP without legal process, such as a subpoena or court order served on that ISP. WHOIS shows the network holder, not the end user.
How accurate is IP geolocation?
IP location databases are often right about the country but much less reliable about the city, and VPN, mobile and company networks can place a user far from where they are. A location from an IP address is rarely precise enough to find a building, and often points to the center of a city or to the provider's network.
How do I report an IP for abuse?
Run a WHOIS lookup at the regional registry that holds the address; ARIN results list an abuse contact for the network, and the other registries publish similar fields. Email the network holder with the IP, the date and time with time zone, and what happened. For hacking, fraud or other internet crime, also file a report with the FBI's IC3.
Are these tools really free?
Yes. The five regional internet registries, ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC, each run a free WHOIS search on their own websites, and IANA lists which registry covers each part of the world.