Guides · Investigate an IP

WHOIS vs RDAP: how to look up who owns an IP or domain

Written by Aldo · blue-team threat hunter
Last updated November 9, 2026 · 4 min read

Whenever you want to know who's responsible for an IP address or a domain, you end up asking a registry. For forty years the way to ask was WHOIS. Today it's RDAP. They're worth knowing both, because you'll meet both.

The difference in one example

Here is part of what the RDAP service of ARIN, the registry for North America, returned for 8.8.8.8 on 9 November 2026 (trimmed to the useful fields):

{
  "objectClassName": "ip network",
  "handle": "NET-8-8-8-0-2",
  "startAddress": "8.8.8.0",
  "endAddress": "8.8.8.255",
  "name": "GOGL",
  "type": "DIRECT ALLOCATION",
  "parentHandle": "NET-8-0-0-0-0",
  "events": [
    { "eventAction": "registration", "eventDate": "2023-12-28T17:24:33-05:00" },
    { "eventAction": "last changed", "eventDate": "2023-12-28T17:24:56-05:00" }
  ],
  "entities": [
    { "handle": "GOGL", "roles": ["registrant"], "fn": "Google LLC",
      "entities": [
        { "roles": ["abuse"], "email": "network-abuse@google.com" },
        { "roles": ["technical", "administrative"], "email": "arin-contact@google.com" }
      ] }
  ],
  "port43": "whois.arin.net"
}

(In the real response, names and emails sit inside a format called jCard; we've flattened them so they're readable.) Each field means the same thing at every registry. The block runs from 8.8.8.0 to 8.8.8.255; it's a direct allocation called GOGL, carved out of a larger parent block; the registrant is Google LLC; and the abuse contact is a separate role. The last line, port43, names the old WHOIS server for the same data.

Run whois 8.8.8.8 and you get similar information as lines of text, in ARIN's own layout. Ask RIPE NCC or APNIC about an address of theirs and the field names, order and wording change. That's fine for a person reading it, and miserable for a program. RDAP fixes exactly that.

Querying RDAP yourself

You don't need to know which registry holds an address. The community-run service rdap.org redirects each query to the right one (for 8.8.8.8 it sent us to rdap.arin.net):

curl -sL https://rdap.org/ip/8.8.8.8
curl -sL https://rdap.org/autnum/15169
curl -sL https://rdap.org/domain/example.com

The paths are part of the standard: /ip/ for addresses, /autnum/ for network numbers (ASNs), /domain/ for domain names. Add | jq '.name, .startAddress, .endAddress' to pick out fields if you have jq installed. On Windows, PowerShell's Invoke-RestMethod https://rdap.org/ip/8.8.8.8 turns the JSON into an object you can explore.

A browser works too: open https://rdap.org/ip/8.8.8.8 and most browsers will show the JSON readably.

Querying WHOIS

On macOS and most Linux systems, whois is a command:

whois 8.8.8.8
whois example.com

Windows doesn't include one; use the registries' web pages, or RDAP. Expect WHOIS answers for domains to shrink further over time: for the generic top-level domains (.com, .net, .org and the like), ICANN has made RDAP the official source and is phasing WHOIS out for them. Country domains such as .de or .it follow their own registries' rules.

What each one tells you

If you want to…

• Report abuse from an address: look up the address and write to the contact with the abuse role. iplover's IP lookup shows it directly.
• Find out who runs the network, as opposed to who registered the block: look up the ASN too. Our guide on ASNs shows why the two can differ.
• Contact a domain's owner: use the contact form or email relay the registrar offers in its RDAP or WHOIS answer, since the owner's own address is usually hidden.
• Check when a domain expires or whether it's locked: the dates and status codes are always public; iplover's domain report reads them for you.

What neither can tell you

Registration data describes who's responsible for a block of addresses or a domain, as the registry knows it. It doesn't track devices, it isn't updated every time a provider hands an address to a new customer, and it never contains a home address for a residential connection. When a site claims to find the person behind an IP address, it's guessing from the same public data you can read yourself.