Bulk IP WHOIS lookup: network owner, range and abuse contact for up to 500 IPs
In short: Paste IPs or domains and get the registry record of each network: name, address range, organisation, registration country, abuse email and dates, straight from ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC. Limit: Shows the registered holder of the block; a reseller's customer may not be named.
A bulk IP WHOIS lookup reads the registration record of the network each IP address belongs to. Paste up to 100 IPs or domains, or 500 after a free Google sign-in, and each row shows the network name, address range, organisation, registration country, abuse email and dates from the regional internet registry's RDAP server. Domains are resolved to their IP first. CSV out.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
8.8.8.8 is in network GOGL (8.8.8.0/24), registered with ARIN to Google LLC, abuse to [email protected].
- IP
- 8.8.8.8
- Network
- 8.8.8.0/24
- Organisation
- Google LLC
What this means for you
Abuse reports go to the network's holder, usually the hosting company or provider.
- Network name, handle and range
- Organisation and registration country
- Abuse email when published
- IPs or domains; CSV out
- IP WHOIS
- RDAP
- Abuse contact
By SimpleVerifier Team · Last updated
Also in: Português (Brasil) · Español · Deutsch · Français · Türkçe · 简体中文 · Русский · Nederlands · Italiano · Tiếng Việt · Bahasa Indonesia · Polski · العربية · Українська · Čeština · Magyar · 日本語 · 한국어
Tracing the servers behind a list of senders or leads?
- IP records tell you who runs a network, not whether the people on your list can receive mail. To remove addresses that would bounce before you send, upload the list at /verify.
- The first 100 email checks are free with a Google sign-in, no card. For the routing side of each IP (its ASN and announced prefix), use the bulk IP to ASN lookup.
How do I look up the owner of many IP addresses at once?
- Paste IPv4 or IPv6 addresses, or domains, one per line, up to 100 a run or 500 after a free Google sign-in. Log lines work too: the first IP on each line is used.
- Press Look up IP WHOIS. Each IP is matched to its registry through IANA's bootstrap file and looked up there, 10 items a request.
- Read each row: the network name and handle, the address range, the organisation, the registry and country, and the abuse email when the record names one.
- Filter by registry or result and download the CSV with every field.
Example
- You enter
- Two IPs and a domain:
8.8.8.8,1.1.1.1andacme.example. - You get
- Each row shows the network name and handle, the address range, the organisation, the registry (ARIN, APNIC, ...), the registration country and the abuse email from that registry's record. acme.example is resolved to its IP first. Download the CSV.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 10 items a request, at most 60 requests a minute to one registry server.
Where does IP WHOIS data come from?
Five regional internet registries hand out IP addresses: ARIN (North America), RIPE NCC (Europe, the Middle East and Central Asia), APNIC (Asia Pacific), LACNIC (Latin America and the Caribbean) and AFRINIC (Africa). Each publishes the record of every allocation over RDAP, the JSON successor to WHOIS. IANA's bootstrap files for IPv4 and IPv6 say which registry holds which block, as RFC 9224 describes.
This tool looks each IP up at the registry the bootstrap names and follows the registry's own redirect when a block was transferred to another registry. The record returned is the smallest registered network that contains the IP, often a customer's assignment inside a provider's larger block.
What does each column mean?
Network is the name and handle the registry gave the block, such as GOOGLE or NET-8-8-8-0-2. Range is the first and last address, with the CIDR prefixes when the record lists them. Organisation is the registrant entity. Country is where the holder registered the network, not where the server physically sits. Abuse is the address the holder publishes for spam and abuse reports.
Registered and Updated are the record's own dates. Fields the registry leaves out stay blank; nothing is filled in by guessing.
How do I report spam or abuse from an IP?
Send the report to the abuse email in the IP's record, with the full message headers or logs that show the IP and the time. That address belongs to whoever runs the network, usually the hosting company or internet provider, which can act on its customer. For a domain's registrar abuse contact, use the bulk WHOIS lookup.
How are the registries protected from heavy use?
Each run counts towards a per-minute limit: 100 items a minute signed out and 500 signed in. On top of that, the tool sends at most 60 requests a minute to any one registry server across all users, four at a time; items over that come back with a note to try again in a minute. Private and reserved addresses are never looked up.
Who uses this tool, and for what?
- Deliverability teams
- Find who runs the IPs in bounce messages and Received headers, and where to report abuse.
- Security teams
- Attribute a list of IPs from logs to their networks and registrants in one run.
- Sales researchers
- See which hosting company or provider runs each prospect's servers.
- Email senders
- Confirm a new dedicated IP block is registered to your provider before you warm it up.
What can’t this tool tell you?
- Shows the registered holder of the block; a reseller's customer may not be named.
- Country is the registration country, not the server's location.
- Registries differ in what they publish, so some fields can be blank.
- Up to 100 items a run without an account, 500 signed in, and at most 60 requests a minute to one registry server.
- Private and reserved addresses aren't looked up.
Common questions
- How do I find who owns a list of IP addresses?
- Paste them into a bulk IP WHOIS lookup like this one. It reads each IP's record from its regional registry and shows the network, organisation, country and abuse contact, with a CSV.
- Is this bulk IP WHOIS lookup free?
- Yes. Up to 100 IPs or domains a run without an account, and up to 500 a run when you sign in with Google, with no card.
- Is the country where the server is?
- No. It is the country the network's holder registered, which is often its head office. A cloud provider's network can be registered in one country and used in many.
- What is the difference between IP WHOIS and an ASN lookup?
- IP WHOIS reads who registered the address block. An ASN lookup reads which network announces the block on the internet. They usually agree, but a customer block inside a provider's space shows the customer in WHOIS and the provider in ASN data.
- Why is the abuse email blank?
- The registry record doesn't name one for that network, or names it only on a parent block. Try the provider's website, or the parent network in the provider's own WHOIS.
- Can I look up domains?
- Yes. A domain is resolved to its first IPv4 address (or IPv6 when it has no IPv4), and that IP's record is shown.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.