IP WHOIS Database - Ownership, RIR Allocation & Network Range Data

The IP WHOIS Database is a downloadable dataset of registry records for every allocated IPv4 and IPv6 range: the organization holding it, the registry that issued it, the network range, and the abuse contact. Refreshed every 3 to 4 days.

pricing backgroundEclipse Top RightEclipse Top Left

Products

IP WHOIS Database

IP WHOIS snapshots covering network ranges, organization records, registrant details, and published abuse contacts, delivered as CSV, JSON, or SQL. New snapshot every 3 to 4 days.

Features

Comprehensive Coverage
Detailed Records
Regular Updates
Integration Capabilities
Image

Features

What IP WHOIS Database Offers

Network ranges, organization records, abuse contacts.

Feature icon

IPv4 and IPv6 Coverage

Every allocated IPv4 and IPv6 range from the five regional registries: ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC, in one flat file.

Feature icon

Detailed Records

Organization name, registrant details, abuse contact, and network range for each allocated block, as the registry publishes it.

Feature icon

Regular Updates

A new snapshot every 3 to 4 days, so reassigned ranges and changed abuse contacts never go stale in your dataset.

Feature icon

Integration Capabilities

Load the CSV, JSON, or SQL export straight into your SIEM, your data warehouse, or an existing IP enrichment pipeline.

Products

Custom Tailored Solution

Filtered IP WHOIS extracts built to your specification.

Tailored IP WHOIS Data Solutions

We build filtered IP WHOIS extracts to your specification. Filter by country, email contact, abuse contact, IP range, or any combination of fields in the record, and we prepare the snapshot from the current dataset. Custom snapshots are delivered within 3 to 4 days.

monitoring

Use Cases

IP WHOIS Database in Action

How network, security, and compliance teams use registry ownership data.

Feature icon

Network Troubleshooting

Find which operator holds a range and which contact to reach when traffic from it breaks or floods your network.

Feature icon

Cybersecurity Threat Detection

Attribute an attacking IP to its operator, then block or monitor the whole allocated range instead of one address.

Feature icon

Registry Attribution

See which regional registry issued a range and which country the registrant record lists, without inferring anything at the end user level.

Feature icon

Market Research

Measure how much address space your competitors and hosting providers hold in each registry region, and track how that shifts over time.

Feature icon

Regulatory Compliance

Verify IP address allocations for accurate records, governance compliance, and audit documentation.

Feature icon

Abuse Management

Send complaints to the abuse contact published for the range, instead of chasing down a hosting provider's general support desk.

Request demo background

Use the IP WHOIS Database to trace range ownership, attribute attacking IPs, and route abuse reports to the right operator.

IP Geolocation Database

IP Geolocation Database

Add country, region, city, timezone, ISP, and ASN data for each IPv4 and IPv6 address that you hold.

IP Geolocation Database
IP WHOIS API

IP WHOIS API

Query one IP live for its ownership, RIR registry, routing data, network range, and abuse contacts.

IP WHOIS API
ASN WHOIS Database

ASN WHOIS Database

Download ASN ownership, BGP routes, prefix allocations, peer ASNs, and provider data in bulk daily.

ASN WHOIS Database

FAQs

Common questions on IP WHOIS datasets: schema coverage, refresh cycles, and how to interpret org data.

What is an IP WHOIS Database?

An IP WHOIS database is a publicly accessible repository that contains registration details of IP address allocations. It provides information such as the organization or individual to whom the IP address is assigned, their contact details, and the associated Autonomous System Numbers (ASNs). This data is essential for network administrators, cybersecurity professionals, and researchers to trace the ownership and origin of specific IP addresses, aiding in tasks like network troubleshooting, abuse investigation, and ensuring compliance with internet governance policies.

What information does the IP WHOIS Database include?

It includes registration and allocation details tied to IP address blocks, such as the registrant/organization, contact details (where available), and other network identifiers that help you understand who manages a given IP range.

Does the database support both IPv4 and IPv6?

Yes. The database includes both IPv4 and IPv6 address allocation records, including historical data where available.

How often is the IP WHOIS Database updated?

The database is regularly updated to reflect changes in IP allocations, ownership transfers, and registry updates published by regional internet registries.

Can this database help with cybersecurity investigations?

Yes. IP WHOIS data helps security teams identify the organization responsible for an IP address or range, making it easier to investigate malicious activity, correlate threats, and take appropriate action.

Does IP WHOIS data provide the exact physical location of an IP address?

No. IP WHOIS data reflects registration and administrative details, not precise physical or user-level locations. For location-based use cases, IP geolocation data is more appropriate.

In what formats is the IP WHOIS Database available?

The IP WHOIS Database is available in structured formats such as CSV, JSON or SQL-compatible files, making it easy to integrate into databases, analytics tools, and internal systems.

How is the IP WHOIS Database different from IP Geolocation data?

IP WHOIS focuses on ownership and registration information, while IP geolocation estimates the geographic location of an IP address. Both datasets serve different purposes and are often used together.
Ready to get started?Join now and claim 500 credits for free!

Elevate your cybersecurity strategy with our all-in-one domain and IP intelligence platform empowering analysts, researchers, and brand owners with real-time WHOIS, DNS, IP, and subdomain insights.