Understanding IP WHOIS & RDAP (Registration Data Access Protocol)
An IP WHOIS Lookup queries the master databases of the global Internet Registries to uncover the legal and administrative owners of an Autonomous System or IP subnet block. When internet providers, universities, or enterprises are allocated IP addresses, they must register their contact details, technical operations teams, and emergency abuse dispatchers.
In modern network infrastructure, classic text WHOIS (port 43) has been superseded by RDAP (RFC 7480 - 7484). RDAP delivers machine-readable, cryptographically verifiable JSON records directly from authoritative Regional Internet Registry endpoints, complete with standard internationalization and privacy tiering.
The Five Regional Internet Registries (RIRs)
Global public IPv4 and IPv6 space is partitioned geographically among five non-profit authorities chartered by ICANN / IANA:
| Registry | Full Name | Territories Covered | Query Protocol |
|---|---|---|---|
| ARIN | American Registry for Internet Numbers | United States, Canada, parts of the Caribbean | RDAP & WHOIS (Port 43) |
| RIPE NCC | Réseaux IP Européens Network Coordination Centre | Europe, Middle East, Central Asia | RDAP & RIPE Database |
| APNIC | Asia-Pacific Network Information Centre | East Asia, South Asia, Australasia, Oceania | RDAP & APNIC Whois |
| LACNIC | Latin America & Caribbean Network Information Centre | Latin America and the Caribbean basin | RDAP & LACNIC Whois |
| AFRINIC | African Network Information Centre | The African Continent and surrounding islands | RDAP & AFRINIC Whois |
How to Report Network Abuse or Cybersecurity Attacks
If you encounter distributed denial of service (DDoS) traffic, brute-force credential stuffing, botnet scraping, or phishing origins originating from a specific IP address, standard law enforcement and enterprise procedures mandate contacting the network’s designated Abuse POC (Point of Contact) listed in its WHOIS / RDAP record.
When filing an incident report with an ISP's abuse desk, ensure you include:
- Exact UTC Timestamp of the detected packet storm or unauthorized connection attempt.
- Source IP, Source Port, Destination IP, Destination Port, and protocol (TCP, UDP, ICMP).
- Firewall or IDS logs (snort/suricata extracts or web server access log entries).
- Never initiate retaliatory port scans or counter-attacks, which violate Computer Fraud & Abuse Acts internationally.
CIDR Subnet Notation & IP Allocation Architecture
IP space is distributed in blocks defined by Classless Inter-Domain Routing (CIDR). A /24 prefix represents 256 individual IPv4 addresses (with 254 usable host addresses), while large corporate carriers may hold /16 (65,536 addresses) or legacy /8 allocations (16.7 million addresses).
RDAP records distinguish between Direct Allocation (IP space assigned directly by an RIR to an ISP) and Reassigned / Sub-allocated space (blocks leased by an ISP to hosting centers or enterprise clients).