IP WHOIS Lookup technical details

What you can look up

An IPv4 or IPv6 address, such as 8.8.8.8 or 2001:4860:4860::8888. IPv4-mapped and zero-compressed IPv6 forms are accepted.
A CIDR block, such as 193.0.0.0/21. Host bits are cleared, so 192.0.2.7/24 is read as 192.0.2.0/24. The registry returns the most specific network that covers the whole block.
A hostname or URL. Its A record is resolved through Cloudflare’s DNS over HTTPS, or its AAAA record when there is no A record, and the first address is looked up. Any other addresses are listed.

Special-purpose addresses

Addresses from IANA’s special-purpose registries (RFC 6890) are answered without asking any registry, because nobody holds them: private ranges (RFC 1918 and IPv6 unique local addresses), carrier-grade NAT shared space, loopback, link-local, documentation ranges, benchmarking, multicast and reserved space. The result names the range, the RFC that sets it aside and what it is for.

Finding the right registry

Bootstrap. IANA publishes which RDAP server answers for each IPv4 and IPv6 block (RFC 9224). The most specific block that contains the query wins, and only HTTPS servers are used. The files are kept in memory for the life of the worker.
Lookup. The query goes to that server as /ip/<address> or /ip/<prefix>/<length> (RFC 9082), with a 6-second limit.
Referrals. When part of a block has moved to another region, the first registry answers with a redirect. Up to three redirects are followed by hand, and only to HTTPS hosts named rdap.* on the default port, so a referral can reach another RIR or a national registry but never an arbitrary server. The path then shows a Transfer step.

The allocation path

RDAP has no single field that lists a network’s ancestors, so the tool climbs the tree one step at a time. For each network it asks the same server for the most specific network that covers a prefix one bit wider than the network itself; any network that covers that prefix also contains the current one, so the answer is its parent. It stops after four parents, at the registry’s whole-region record, or after 18 seconds in total.

ARIN, the RIPE NCC and APNIC answer these covering queries. LACNIC and AFRINIC return “not found” for them, so for those the path shows the parent block named in the record’s parentHandle, marked as published without details. The registry’s own record of the IANA block, such as ARIN’s NET-8-0-0-0-0, is merged into the IANA step rather than shown twice.

Each step’s bar is drawn to scale: the bar is the step’s range, and the coloured segment is where the next step’s range sits inside it. Very small segments are widened to stay visible; the caption gives the exact share.

What is shown

Field	Where it comes from
Registered to	The vCard name of the entity with the registrant role, or the network name when there is none
Range, CIDR and size	startAddress, endAddress and the cidr0_cidrs extension, or CIDR blocks computed from the range
Type and status	type and status, with a plain-language note for each registry’s type names
Registered and Last changed	The registration and last changed events
Contacts	Every entity, including those nested under the registrant, merged by handle, with abuse contacts first
Announced by	The origin AS and prefix from BGP routing data, through Team Cymru’s IP-to-ASN DNS service; the most specific prefix wins
Origin AS on file	ARIN’s arin_originas0 extension, when the holder has listed one
Raw RDAP response	The registry’s JSON, unchanged

Limits

Lookups share the free tools’ rate limit of 60 an hour and 200 a day per visitor IP address.
A lookup makes at most about ten outbound requests: the bootstrap file, the registry and any referrals, up to four parent queries, two DNS queries for a hostname and one for the origin AS.
Port 43 WHOIS is never queried. Registries whose RDAP service is down show an error rather than older WHOIS data.
Results are not cached or stored. The registry answers each lookup afresh.
Registration data is not geolocation and does not name who uses an address today. See How IP Addresses Are Allocated.