How to look up who owns an IP
- Type or paste the address. IPv4 (
203.0.113.7) and IPv6 (2001:db8::1) both work. The tool starts with your own public IP, so it doubles as a “what is my IP” WHOIS check and an IPv6 WHOIS too. - Read the network and IP range. Addresses are handed out in blocks, so the record covers a range, shown both as first–last address (the NetRange) and in CIDR form, so it also works as a CIDR lookup.
- Check the contacts. The table lists the organizations attached to the record and their role: registrant, administrative, technical or abuse. The IP abuse contact is where to report misuse.
Whether you search for IP WHOIS, WHOIS IP, “who is” IP or ipwhois, this free IP WHOIS lookup does the same job: the public registration record for an IP address. It is also an IP owner lookup and ISP lookup, the quickest way to find the IP owner and answer “who owns this IP?”
What the WHOIS IP result means
| Field | What it tells you |
|---|---|
| Network name | The registry’s name for the block, often a short code for the owner |
| IP range (NetRange) | The first and last address in the block the IP belongs to |
| CIDR | The same range in network notation, such as 8.8.8.0/24 |
| Country | Where the block is registered, usually the owner’s head office |
| Allocation type | Whether the block was allocated to a provider or assigned to an end user |
| Registry | Which of the five regional internet registries issued it |
| Registered / Last changed | When the record was created and last updated |
| Abuse contact | Where to report spam, attacks or other misuse from the IP |
Who hands out IP addresses
The global pool is managed by IANA, which gives large blocks to five regional internet registries (RIRs). They assign smaller blocks to internet providers, hosting companies and other organizations, and keep the public WHOIS record of who holds each one.
| Registry | Region it manages |
|---|---|
| African Network Information Centre (AFRINIC) | The African continent |
| American Registry for Internet Numbers (ARIN) | The United States, Canada, and many Caribbean and North Atlantic islands |
| Asia-Pacific Network Information Centre (APNIC) | Asia, Australia, New Zealand and surrounding countries |
| Latin America and Caribbean Network Information Centre (LACNIC) | Latin America and parts of the Caribbean |
| Réseaux IP Européens Network Coordination Centre (RIPE NCC) | Europe, the Middle East and Central Asia |
The tool asks rdap.org, which forwards the question to whichever registry holds the address, so you always get the authoritative record, whether it is an ARIN WHOIS, RIPE WHOIS, APNIC WHOIS, LACNIC or AFRINIC record.
Who owns these well-known IP addresses?
These are addresses people often see in router settings, server logs and network tools. The owner is the organization named in the official registry record; the network is the one that carries the traffic, which is not always the same, as 1.1.1.1 shows.
| IP address | What it is | Registered to | Network (ASN) | Range | Registry |
|---|---|---|---|---|---|
| 8.8.8.8 | Google Public DNS | Google LLC | AS15169 Google | 8.8.8.0 – 8.8.8.255 | ARIN |
| 8.8.4.4 | Google Public DNS (second) | Google LLC | AS15169 Google | 8.8.4.0 – 8.8.4.255 | ARIN |
| 1.1.1.1 | Cloudflare DNS | APNIC Research and Development | AS13335 Cloudflare | 1.1.1.0 – 1.1.1.255 | APNIC |
| 1.0.0.1 | Cloudflare DNS (second) | APNIC Research and Development | AS13335 Cloudflare | 1.0.0.0 – 1.0.0.255 | APNIC |
| 9.9.9.9 | Quad9 DNS | Quad9 | AS19281 Quad9 | 9.9.9.0 – 9.9.9.255 | ARIN |
| 208.67.222.222 | OpenDNS (Cisco Umbrella) | Cisco OpenDNS, LLC | AS36692 Cisco Umbrella | 208.67.216.0 – 208.67.223.255 | ARIN |
| 4.2.2.2 | Old Level 3 DNS, still widely used | Level 3 Parent, LLC | AS3356 Level 3 | 4.0.0.0 – 4.127.255.255 | ARIN |
| 94.140.14.14 | AdGuard DNS | AdGuard Software Limited | AS212772 AdGuard | 94.140.14.0 – 94.140.15.255 | RIPE NCC |
| 198.41.0.4 | a.root-servers.net, a DNS root server | VeriSign Infrastructure & Operations | AS19836 Verisign | 198.41.0.0 – 198.41.3.255 | ARIN |
| 17.253.144.10 | Apple | Apple Inc. | AS714 Apple | 17.0.0.0 – 17.255.255.255 | ARIN |
| 31.13.64.35 | Facebook and Instagram | Facebook (Meta) | AS32934 Facebook | 31.13.64.0 – 31.13.127.255 | RIPE NCC |
| 140.82.112.3 | GitHub | GitHub, Inc. | AS36459 GitHub | 140.82.112.0 – 140.82.127.255 | ARIN |
| 54.239.28.85 | Amazon (AWS) | Amazon Technologies Inc. | AS16509 Amazon | 54.224.0.0 – 54.255.255.255 | ARIN |
| 13.107.42.14 | Microsoft 365 | Microsoft Corporation | AS8068 Microsoft | 13.64.0.0 – 13.107.255.255 | ARIN |
| 104.16.132.229 | A Cloudflare-hosted website | Cloudflare, Inc. | AS13335 Cloudflare | 104.16.0.0 – 104.31.255.255 | ARIN |
Some addresses belong to no one. These ranges are reserved by the Internet Assigned Numbers Authority (IANA), so a WHOIS lookup returns IANA or no record at all, and the same addresses are reused on millions of private networks:
| IP address | What it is | Reserved range |
|---|---|---|
| 192.168.1.1 | Home router (private network) | 192.168.0.0 – 192.168.255.255, RFC 1918 |
| 10.0.0.1 | Private network | 10.0.0.0 – 10.255.255.255, RFC 1918 |
| 100.64.0.1 | Carrier-grade NAT inside an ISP | 100.64.0.0 – 100.127.255.255, RFC 6598 |
| 127.0.0.1 | Loopback: “this device” | 127.0.0.0 – 127.255.255.255, RFC 1122 |
| 192.0.2.1 | Documentation examples only (TEST-NET-1) | 192.0.2.0 – 192.0.2.255, RFC 5737 |
Records checked on 4 November 2026 from RDAP and RIPEstat. Large networks are re-registered and re-routed from time to time, so look an address up in the tool above for its current record. To see every range a network such as AS15169 announces, use the ASN lookup.
WHOIS lookup vs IP geolocation
A WHOIS lookup tells you who an address is registered to. IP geolocation estimates where it is used. A large provider may register all its blocks at its head office in one city while customers use them across the country, so the two can differ. Use both together: WHOIS for ownership and abuse reports, IP Location for the likely city and region.
What WHOIS can and cannot tell you
A WHOIS record is about the block, not a person. For a home or mobile connection it names the internet provider; for a server it names the hosting company or, sometimes, the business that rents a large block. It never shows a customer’s name or street address.
To see the network an address is routed through, use the ASN lookup; to check whether it is listed for sending spam, use the IP blacklist checker; and for a domain name’s registration date, use the domain age checker.