How to look up the provider or company behind an IP address, its network, country and autonomous system, where to send a spam or attack complaint, and what an IP address can’t tell you.
Contents
Information about every IP address in the world is held by five regional registries. From an address you can find out which organisation the network is allocated to, which country it is registered in, which autonomous system (AS) it belongs to, and where to send complaints.
The quickest way: our IP lookup
Enter the address in our lookup tool and we will show you the network range and its owner, the country, contacts for complaints and the autonomous system. It works for addresses in any region, IPv4 and IPv6.
With the whois command
whois 8.8.8.8The program is built into macOS and Linux; on Debian and Ubuntu it is the whois package. It finds the right registry by itself. The main fields in the answer:
| Field | Meaning |
|---|---|
| inetnum, NetRange | the address range |
| netname | the name of the network |
| org, descr, OrgName | the organisation the network is allocated to |
| country | the country where the network is registered |
| abuse-mailbox, OrgAbuseEmail | the address for complaints |
| origin, OriginAS | the autonomous system that announces the network |
| Registry | Region |
|---|---|
| RIPE NCC | Europe, the Middle East and Central Asia |
| ARIN | the USA, Canada and part of the Caribbean |
| APNIC | Asia and the Pacific |
| LACNIC | Latin America |
| AFRINIC | Africa |
What an IP address can’t tell you
- A person’s name and address. The database holds only the organisation the network is allocated to: a provider, a hosting company, a business. Only the provider knows which customer was using an address at a given moment, and it will share that only in response to an official request.
- The exact location. The
countryfield is the country where the network is registered, not where the computer is. Geolocation databases show a city for an IP address, and they are often wrong — see IP geolocation. - The real hosting of a protected website. If a website runs behind Cloudflare or another attack-protection service, whois will show the protection service instead — see How to find out where a website is hosted.
Where to report spam or an attack
Write to the address in the abuse-mailbox field. To help the provider trace the source, include:
- the date and time, with the time zone;
- the IP address and, if you have it, the port;
- an extract from the log, or the headers of the spam email.
Without the time and a log, a complaint usually can’t be checked — at a provider, addresses pass from one customer to another.
Didn’t find the answer? Ask our support team — we’ll help.