Use the IP / Domain WHOIS lookup to review a public IP address or domain's WHOIS and RDAP registration, ASN, CIDR, registrar, name servers, dates, and public contacts.
WHOIS shows who manages a resource; geolocation shows where it may be
Registration information describes the management relationship of an IP range or domain. It is not the same as device location, user identity, or a security conclusion. IP geolocation estimates where traffic exits; WHOIS and RDAP identify who registered or manages the resource.
Use both views when the task requires them, but do not substitute one for the other. A registration country can differ from an observed network location because of cross-border networks, cloud services, and carrier routing.
How to Read WHOIS and RDAP Lookup Results
For an IP address, read the organization, ASN, CIDR or network range, regional Internet registry, status, and public abuse contact first. These fields identify the organization that manages the network resource, not the individual currently using an address.
For a domain, review registrar, registration and expiry events, domain status, name servers, DNSSEC, and public contacts. RDAP uses structured data while traditional WHOIS is free-form text, so some registries publish fewer fields or redact personal information.
Five regional Internet registries
ARIN serves North America and parts of the Caribbean; RIPE NCC serves Europe, the Middle East, and Central Asia; APNIC serves Asia Pacific; LACNIC serves Latin America and the Caribbean; and AFRINIC serves Africa.
These regional Internet registries allocate and register Internet number resources. Their registration region does not necessarily match the place where traffic exits today.
Use registration facts for the next verification step
WHOIS and RDAP can support network ownership confirmation, abuse reporting, BGP and routing research, and domain lifecycle checks. Pair public contacts with timestamps, logs, and other verifiable evidence when following up.
If a domain has no exact record, the tool can try parent domains and identifies the query that produced the result. Missing fields remain missing instead of being guessed, and a confirmed no-record response is shown as Not Found.
IP WHOIS, Domain WHOIS, and RDAP Compared
Registration lookup methods and their scope
Lookup
Object queried
Useful for
Does not prove
IP WHOIS
A public IPv4 or IPv6 address or network range.
Finding the registry, allocated block, network name, status, and published contacts.
Who used one shared address at a particular time.
Domain WHOIS
A registered domain name.
Checking registrar, name servers, lifecycle status, and registration events.
Who hosts the website, owns its IP address, or controls visible page content.
RDAP
IP networks, autonomous systems, domains, nameservers, and entities through structured endpoints.
Machine-readable registration data, typed links, event dates, notices, and referrals.
Accuracy of every submitted field or the identity of a visitor.
Registration Fields You Will See
Core WHOIS and RDAP field guide
Field
Meaning
Interpretation
ASN
An autonomous system number assigned for routing policy.
It identifies a routed network, not necessarily the organization using one downstream IP.
CIDR
A prefix and length describing an address block.
Use it to understand which range contains the queried address and to build scoped rules.
NetRange
The first and last address of a registered network.
Older WHOIS output often uses this label; RDAP may represent the same range as startAddress and endAddress.
RIR
The regional internet registry responsible for the record or referral.
Querying the correct RIR avoids treating a referral response as the final allocation.
Registrar
The accredited company sponsoring a domain registration.
A registrar manages the domain record; it is not necessarily the registrant, DNS host, or website operator.
Status
A registry-defined lifecycle or policy state.
Interpret status in the object context; domain transfer locks and IP allocation status are different concepts.
How the Five Regional Internet Registries Fit Together
AFRINIC serves Africa, APNIC serves the Asia-Pacific region, ARIN serves Canada, many Caribbean and North Atlantic islands, and the United States, LACNIC serves Latin America and parts of the Caribbean, and RIPE NCC serves Europe, the Middle East, and parts of Central Asia. These service regions describe registry responsibility, not the current physical location of every routed address.
An initial RDAP service can bootstrap the request to the registry responsible for the object. The RIR record may then show a direct allocation to an ISP or a broader range with downstream customer information omitted. Follow authoritative referral links, preserve the source URL and lookup time, and do not combine unrelated contact fields into a person profile.
AFRINIC
Regional registry for Africa.
APNIC
Regional registry for the Asia-Pacific service region.
ARIN
Regional registry for the United States, Canada, and parts of the Caribbean and North Atlantic.
LACNIC
Regional registry for Latin America and portions of the Caribbean.
RIPE NCC
Regional registry for Europe, the Middle East, and parts of Central Asia.
Read a Redacted IP RDAP Record
Imagine a result for 203.0.113.x that refers to 203.0.113.0/24, lists a network name, shows an active allocation status, and links to the responsible registry. The x keeps this example from naming a usable endpoint, while the documentation prefix prevents it from representing a real public allocation. The prefix is the registered object; the individual address is simply contained in it.
Event dates may show registration or the latest change, not the moment a current user obtained the address. Entity roles such as administrative, technical, or abuse identify published responsibility channels. If contact details are redacted or absent, use the registry link or abuse contact actually provided instead of trying to reconstruct private information.
Illustrative, non-routable RDAP excerpt
query: 203.0.113.x
network: 203.0.113.0/24
status: active
events: registration / last changed
entities: technical / abuse (when published)
Use Registration Data Without Overclaiming
For ownership checks, compare the range, registry, network name, ASN, and routing evidence. Abuse reports should use the published channel and include the source IP, UTC timestamp, logs, protocol, and concise facts. Preserve the raw RDAP response and links for reproducible security investigations.
WHOIS and RDAP cannot prove the identity of an attacker, subscriber, domain owner behind a privacy service, or person operating a server. Shared hosting, CGNAT, VPN exits, resellers, cloud tenants, and reassigned ranges all separate registration from actual use. Treat the record as one documented source, then corroborate it with DNS, routing, application, and provider evidence.
FAQ
Frequently asked questions
How do I find who owns an IP address?
Enter a public IPv4 or IPv6 address to view the registered organization, regional Internet registry, ASN, CIDR range, and available abuse contact. These records identify the organization that manages the network resource, not the individual currently using the address.
What is the difference between WHOIS and RDAP?
Traditional WHOIS mainly returns free-form text; RDAP uses structured JSON, clear status codes, and unified fields that are easier for modern applications to read. This tool organizes both into a readable summary.
Why is the registration country different from the actual IP location?
The registration country reflects where the network resource is registered, while IP geolocation estimates where network traffic exits. Cross-border networks, cloud services, and carrier routing can make these locations differ.
Why are some contacts or dates empty?
Registries do not all publish the same fields, and privacy policies may hide some contacts. MiyaIP leaves missing fields blank instead of guessing or altering the data.
Can I query a private IP?
No. Private, loopback, link-local, documentation-reserved, and other non-publicly routable addresses do not have separate registrations for ordinary Internet users.
Why might a domain query show "Not Found"?
When the authoritative RDAP service explicitly returns no record, MiyaIP displays Not Found instead of generating registration information that appears complete but cannot be verified.
Why doesn't the detailed record include a link?
The public interface retains only the fields and values needed for network diagnosis and removes external jumps, server metadata, and supply-chain information to reduce unnecessary exposure.
Is RDAP the same as WHOIS?
They serve similar registration-discovery goals, but RDAP uses HTTP, structured JSON, standardized object types, links, events, and notices. Traditional WHOIS is a text protocol whose labels and referral behavior vary by server.
Can WHOIS show the owner of a public IP?
It can show the registry and organization responsible for an allocated network block. That organization may be an ISP, cloud provider, enterprise, or reseller and is not necessarily the person using one address.
Why is WHOIS contact information hidden?
Registry policy, privacy requirements, role-based publication, and domain privacy services can redact personal fields. Use the published registrar, registry, or abuse channel when contact is necessary.
How do I report abuse from an IP address?
Find the authoritative abuse contact in the registry record and send accurate timestamps, the source IP, logs, destination and protocol, and a concise explanation. Do not send secrets or make identity claims the evidence cannot support.
