What can WHOIS and RDAP tell me about an IP address?¶
WHOIS and RDAP are registration services. They can help identify the organisation responsible for an address range and the route to a relevant contact.
The short version¶
A registration lookup identifies an address holder or responsible organisation - not the user of the address at the event time.
What the result may show¶
Depending on the registry and record, it may include:
- the address range or prefix;
- organisation name;
- registration or allocation status;
- abuse or technical contact;
- regional registry;
- registration dates; and
- related network or autonomous-system information.
The result is a starting point for the next enquiry.
What it cannot show by itself¶
A lookup does not normally establish:
- who used the address;
- which customer held it at the event time;
- which device generated the traffic;
- whether the current holder was the holder then; or
- what activity occurred through the range.
Think of it as a signpost
A registration lookup is like finding the organisation responsible for a building number. It tells you whom to approach; it does not tell you which room, tenant or person was involved.
Record the lookup properly¶
Keep:
- the full address searched;
- the date and time of the lookup;
- the service used;
- the complete result;
- any referral or abuse contact; and
- the original event details that led to the lookup.
See whether the current operator controlled the address at the event time.
The point to remember
WHOIS and RDAP help identify the likely record holder. They are not subscriber or user-identification tools.
