IP & Domain WHOIS

Look up the owner, range and ASN of an IP, or the registrar, dates and DNS of a domain, and export a PDF.

Look up the WHOIS of an IP or domain

What is the WHOIS of an IP or a domain?

Every public IP address belongs to a block assigned by one of the five regional Internet registries (LACNIC, ARIN, RIPE NCC, APNIC and AFRINIC). The WHOIS shows which organization the block was assigned to, its range, the country, the autonomous system (ASN) announcing it, and the technical and abuse contacts.

For a domain, the WHOIS is published by the registry of its extension (.com, .co, .org...) and shows the registrar it was bought from, the registration and expiration dates, the DNS servers, whether it has DNSSEC, and its status. Many registries hide the holder's personal data for privacy. This tool uses RDAP, the standard protocol that replaces classic WHOIS and delivers the same data in a structured way.

Uses in cybersecurity:

  • Identifying the ISP behind an IP that appears in logs or alerts
  • Finding the abuse contact to report attacks, spam or phishing
  • Detecting newly registered phishing domains or domains that imitate a brand
  • Checking when your own domain expires so a third party doesn't take it
  • Documenting incident evidence with a dated, verifiable report
  • Checking whether an IP belongs to a cloud provider, VPN or corporate network

About the PDF report:

  • The PDF is generated in your browser from the WHOIS/RDAP response.
  • When you download it, the file's SHA-256 hash is calculated and included in the name so you can verify its integrity.
  • For an IP, the block holder (WHOIS) and the ISP can be different: a provider can receive the block from another company or provide service over IPs registered by a third party. The ISP comes from a public IP lookup service (ipwho.is).
  • Neither identifies the person using the address; that requires a formal request to the ISP.