How to Look Up Who Owns a List of IP Addresses (Bulk IP WHOIS)
A bulk IP WHOIS lookup reads the registration record of the network each IP address belongs to, from the regional internet registry's RDAP server. The bulk IP WHOIS lookup takes up to 100 IPs or domains (500 after a free Google sign-in) and returns the network name, address range, organisation, country, abuse email and dates for each, as a CSV.
The record returned is the smallest registered network that contains the IP, often a customer's assignment inside a provider's larger block.
For the network that announces an IP (its ASN) rather than the registration record, see how to find which company owns an IP address or range.
When you need it
Typical cases are tracing the servers behind a list of senders or leads, or finding where to send an abuse report. For a domain's owner and registrar rather than an IP's, see WHOIS lookup for a list of domains and what WHOIS privacy hides.
The by-hand way
- Find which registry holds the block, using IANA's RDAP bootstrap files.
- Query that registry's RDAP or WHOIS service for the IP.
- Read the network, organisation and abuse fields, and repeat for each address.
It works, but five registries and one IP at a time is slow.
Step 1: paste the IPs
IPv4 or IPv6, one per line, or domains.
Step 2: look them up
Each IP is matched to its registry through IANA's bootstrap file and looked up there, 10 items a request. The tool follows the registry's own redirect when a block moved to another registry.
Step 3: read and download
Each row shows the network name and handle, range, organisation, registry, country and the abuse email when the record names one. Filter by registry or result and download the CSV. For the routing side, use the bulk IP to ASN lookup.
What this check cannot do
- It shows the registered holder of the block; a reseller's customer may not be named.
- Registries differ in what they publish, so some fields can be blank.
- Private and reserved addresses are not looked up.
- Limits: 100 items a run signed out, 500 signed in, and at most 60 requests a minute to one registry server.
Next: check which addresses on the list exist
IP records say who runs a network, not whether the people on your list can receive mail. Upload the list at the verify page: the first 100 email checks are free with a Google sign-in, no card. See bulk email verification and pricing.
Try it now
Open the bulk IP WHOIS lookup.
Common questions
Where does IP WHOIS data come from?
From the five regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC), which publish each allocation over RDAP, the JSON successor to WHOIS.
Can I paste domains instead of IPs?
Yes. Domains are resolved to their IP first. Log lines work too, and the first IP on each line is used.
Is the country the server's location?
No. It is the country where the holder registered the network.
How do I report spam from an IP?
Send the report to the abuse email in the record, with the full headers or logs that show the IP and time.
How many can I look up?
Up to 100 IPs or domains a run, or 500 after a free Google sign-in.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.