Reverse IP Lookup with WHOIS and RDAP: How to Read Results

A WHOIS or RDAP lookup on an IP address shows which organisation the address block was registered to, the range it belongs to and usually an abuse contact. It answers “who holds this network?”, not “who is using it right now?”, which is a different and often unanswerable question.

How address registration is organised

IP addresses are distributed hierarchically. IANA hands out large blocks to five regional internet registries, which allocate smaller blocks to providers and organisations. IANA’s number resources page outlines the system. Each registry keeps a public database of the blocks it manages, and you query the one responsible for the address in question. Many tools redirect automatically to the right registry.

Two protocols expose the data. WHOIS is the traditional text service. RDAP is its successor, serving structured JSON over HTTPS in the format defined by RFC 7483. Registries such as ARIN describe their RDAP service publicly. Because RDAP is structured, it suits scripts better than screen-scraping WHOIS text.

Reading a typical record

Field names differ by registry, but the same ideas recur.

Field idea	Common label	What it tells you
Address range	inetnum or NetRange	The block of addresses covered by the record
Label	netname or NetName	A name chosen for the allocation; often the holder’s short name
Holder	org, descr or OrgName	The organisation the block is registered to
Country	country	The country associated with the registration, not necessarily the user
Abuse contact	abuse-c or abuse email	Where to send abuse reports
Status	status	Whether the block is allocated to a provider or assigned to an end user

The status field is worth reading. A block allocated to a large provider is subdivided among many customers, and the record rarely names them. A block assigned directly to an organisation names that organisation, which is where WHOIS gives you a company name.

Key takeaway: a company name in a registry record means the company holds the block. A provider name means you have reached shared space and need other evidence to learn more.

Running the query

On Linux or macOS, whois 203.0.113.7 queries the appropriate registry. Windows users can use a web search on a registry site. For RDAP, an HTTPS request to a registry’s RDAP service returns JSON you can parse. Always check the registry’s usage policy, because heavy automated querying is commonly rate-limited.

Where the answer is a provider, look for sub-allocations. Some registries show a more specific record nested inside the provider’s block that names a customer. If one exists, it is the most informative entry.

Where WHOIS ends and other lookups begin

Registry data is authoritative for allocation but thin for practical identification.

• It will not tell you which websites share the server. See reverse IP domain lookup.
• It will not publish a hostname. For that, use reverse DNS.
• It may name a company, but only if the company holds its own space. Many businesses use cloud or provider addresses and do not appear.

A company-level tool combines registry data with other sources and classifies the result. BusinessMCP’s free reverse IP lookup tool describes returning a company name and domain for business networks and an ISP or hosting label otherwise. Its guide on visitor identification says it draws on routing registries, WHOIS records and commercial network databases. That is a vendor description, but it matches how this layer generally works.

Practical uses

1. Abuse reporting. Find the abuse contact for the block and send logs, timestamps and a clear description.
2. Classifying traffic. If the holder is a hosting or cloud company, treat the traffic as automated until proven otherwise. See investigating suspicious IPs.
3. Spotting corporate visitors. A record that names an organisation directly suggests a business network, though you should check it against a company-level tool.
4. Research. Look at the range to see how large an allocation is and who else sits nearby.

Caveats on accuracy and privacy

Registry data can be out of date, and the country field reflects registration, not necessarily where the machines are. Contact details are sometimes redacted or generic, particularly where privacy rules apply. Registration data about organisations is public by design, but combining it with other information about individuals can raise data protection questions; read our privacy guide.

A repeatable routine

Record the address, the date and the registry you queried. Note the range, holder and status. Check whether a more specific sub-allocation exists. Then decide whether the result is enough. If it names a provider, stop trying to extract a customer from it; that is not what the data is for. For the bigger picture, see what reverse IP lookup means.

Worked reading of a record

Imagine a registry record for a block with the status “allocated” to a large telecom. The range covers many thousands of addresses, the holder is the telecom, and the abuse contact is a generic provider mailbox. Reading this correctly, you conclude the address is consumer or business broadband inside the provider’s network, that reports should go to the abuse mailbox, and that nothing in the record identifies a customer.

Now imagine a second record with a small range, status “assigned”, and a holder that is a named manufacturing firm with its own address space. Here the registry does the work for you: the firm holds the block, so a visit from that range most likely came from within its network, with the usual caveats about VPNs and remote workers who route through company systems.

The two records look similar on screen and mean very different things. The difference sits in the range size and the status field, which is why those two fields are worth reading before the holder name.

Rate limits and etiquette

Registries are public services and protect themselves from heavy querying. If you are processing a large list, spread requests out, cache answers and respect each registry’s published limits. For large volumes, a commercial service that has already compiled registry data may be more practical than repeated live queries. See bulk reverse IP lookup for how to batch sensibly.

Combining registry data with a company-level view

Registry data answers who holds the block. A company-level view answers whether that block represents a business visitor. Running both on the same addresses is a good habit. Where they agree, confidence rises. Where the registry shows a provider and the company tool shows a business, the second tool is drawing on additional data. BusinessMCP’s IP to company API page is one example of such a service, and describes verdicts of company, non_business and unidentified.