What can WHOIS and RDAP tell me about an IP address?¶
title: "What can WHOIS and RDAP tell me about an IP address?" card_id: "IP-069" status: "complete" source_document: "https://docs.google.com/document/d/1IvWC6vhoCOKc9t8ehodUA3QuGSEe2kUMNU9466fXt14/edit?usp=drivesdk"
What can WHOIS and RDAP tell me about an IP address?¶
WHOIS and RDAP are services used to obtain registration information about internet resources.
For an IP address, they may show the address range containing it, the organisation registered for that range and contact information associated with the network.
RDAP stands for Registration Data Access Protocol.
It provides structured registration data and is increasingly used in place of the older, text-based WHOIS service.
The underlying information is generally maintained through the regional internet registries responsible for allocating address space in different parts of the world.
A result may include the network name, address range, registration status, country code and administrative or abuse contacts.
That can help identify the organisation responsible for managing the address block or direct an enquiry towards the appropriate network.
But the registered organisation isn't necessarily the customer who used the individual address.
A large internet provider may hold a very large range and allocate individual addresses to customers dynamically.
A hosting company may assign addresses to different virtual servers. A parent network may delegate part of its range to a reseller or another organisation.
The public registration record normally doesn't contain those confidential, time-specific customer allocations.
The country shown in the record may describe the registered organisation or administrative allocation. It isn't reliable proof of the physical location of the device using the address.
Registration information can also change.
An address range may be transferred, renamed or delegated. A current result may not show who controlled or used the address at the time of an older event.
WHOIS and RDAP results should also be kept distinct from domain-name registration results.
An IP lookup concerns the registration of network address space. It doesn't establish who registered a website that happened to use the address.
WHOIS and RDAP can identify an address block, its registered network and useful contacts.
They help classify the infrastructure and locate a possible data holder.
They don't identify the subscriber, device or person who used the individual IP address at the relevant time.