IP WHOIS and RDAP Lookup: What They Show and When to Use Them

An IP geolocation lookup answers 'where does this address appear to be used?'. WHOIS and RDAP answer a different question: 'who holds this address block, and whom do I contact about it?'. The first is an estimate assembled by a database vendor; the second is a record kept by the registry that allocated the block. Investigations need both, and confusing them is the most common mistake in reading either.

Registration data lives with the five Regional Internet Registries that manage address space under the framework of RFC 7020: AFRINIC (Africa), APNIC (Asia-Pacific), ARIN (North America and parts of the Caribbean), LACNIC (Latin America and the Caribbean) and the RIPE NCC (Europe, the Middle East and Central Asia). Each publishes its records over both WHOIS and RDAP.

WHOIS is a plain-text query service on TCP port 43, specified in RFC 3912. You send a query string, the server returns human-readable text, and the connection closes. Its simplicity is why every operating system still ships a whois client.

Its weaknesses are the reasons RDAP exists. RFC 3912 defines no format for the response, so every registry answers in its own layout and a parser written for ARIN breaks on RIPE. There is no standard way to find which server is authoritative for an address, no authentication, no encryption on the wire and no support for internationalized text. Scripts that scrape WHOIS output are brittle by design.

The Registration Data Access Protocol delivers the same registration data over HTTPS as JSON. Four RFCs define it: RFC 7480 covers how RDAP uses HTTP, RFC 7481 the security services (TLS, authentication and access control), RFC 9082 the query format, for example '/ip/192.0.2.1' or '/autnum/64496', and RFC 9083 the JSON responses.

Structured responses mean a program reads the network range, registrant, contacts and events from named fields instead of guessing at text. HTTPS means the answer is encrypted and can be authenticated, so a registry can return more detail to an authenticated abuse handler than to an anonymous query. Internationalized names and addresses are supported natively.

RFC 9224 solves the 'which server?' problem. IANA publishes bootstrap files that map address space to the RDAP base URL of the registry responsible for it: ipv4.json, ipv6.json and asn.json under https://data.iana.org/rdap/. A client matches the address against the prefixes in the file and sends its query to that base URL. The IPv4 file maps, for instance, 1.0.0.0/8 to APNIC, 8.0.0.0/8 to ARIN and 41.0.0.0/8 to AFRINIC.

The registries' base URLs are https://rdap.arin.net/registry/ (ARIN), https://rdap.db.ripe.net/ (RIPE NCC), https://rdap.apnic.net/ (APNIC), https://rdap.lacnic.net/rdap/ (LACNIC) and https://rdap.afrinic.net/rdap/ (AFRINIC); append ip/ and the address to query one. Each also still answers WHOIS on port 43, and an RDAP response names its legacy server in a port43 field.

Network range. RDAP returns a startAddress and an endAddress (WHOIS shows NetRange at ARIN and inetnum at the RIPE NCC, APNIC and AFRINIC), a handle and a name for the block, and its type: a direct allocation from the registry, or an assignment to a customer.

Organization. The registrant entity, with its name and often a postal address. This is the holder of the block, an ISP, hosting company, university or enterprise; it is not necessarily the operator of the server behind one address inside the block.

Contacts. Entities with roles such as administrative, technical and abuse. The abuse contact is the one investigators need; RDAP marks it with the role 'abuse' and it normally carries an email address.

ASN, where relevant. Registration data for an autonomous system lives at /autnum/ followed by the number and names the holder of the AS number. Which AS actually announces a range is routing data from BGP route collectors, not registration data; the ASN guide covers the difference.

Registry country. A country code attached to the block or its holder. It records where the resource was registered, and the RIPE Database documentation states that it has never been specified what this country represents (the head office of a multinational, the server center or the end user's home) and that it cannot be used in any reliable way to map IP addresses to countries.

Events and remarks. Registration and last-changed dates, plus free-text remarks that sometimes carry abuse-reporting instructions.

The IPv4 bootstrap file places 8.0.0.0/8 with ARIN, so the query is https://rdap.arin.net/registry/ip/8.8.8.8. At the time of writing the response describes the block 8.8.8.0 to 8.8.8.255 with the handle NET-8-8-8-0-2 and the name GOGL, a direct allocation whose parent is NET-8-0-0-0-0, registered and last changed on 28 December 2023. The registrant entity is Google LLC; nested under it are an administrative and technical contact and an abuse contact, ABUSE5250-ARIN, with the address network-abuse@google.com. The port43 field points at whois.arin.net, the legacy server for the same record.

Put that next to a geolocation lookup of the same address and the split is obvious. Registration says who is responsible and whom to email about abuse; it says nothing about where the machine answering 8.8.8.8 is, and for an anycast service like Google Public DNS there is no single place. The reverse holds too: the city a database assigns to a cloud address says nothing about which of the provider's customers runs the server.

The table sets the two registration systems against geolocation on the questions that come up in practice.

Redaction. Registries increasingly withhold personal data. Contact records show a role or an organization rather than a person, and RDAP lets a registry return less to anonymous clients than to authenticated ones.

Referrals and nesting. A large allocation can contain more specific assignments to customers, and a registry that transferred a block may answer with a referral to another server. The most specific record describes the actual user of a range; follow the chain instead of stopping at the first answer.

Rate limits. Registries limit anonymous query volume and refuse or slow a script that hammers them. For bulk enrichment, use the data the registries publish for download or a licensed dataset rather than live queries.

Country is not location. A block registered to an organization in one country can be used in another, and a multinational's entire address space can carry its head-office country.

Staleness. A record describes the holder as last reported to the registry; reassignments to customers are not always recorded, and nothing in it says who was using an address at a given moment. Keep the observation time with every piece of evidence.

Start with a geolocation and risk lookup for the quick picture: country, network type, proxy or hosting flags, reputation. Then query RDAP for the block: confirm who holds the range, capture the abuse contact, and note whether the block is a direct allocation to an ISP or an assignment to a specific customer. If routing matters, check which AS announces the prefix, and record the query time alongside the evidence.

When the address has to be reported, the abuse-contact guide covers what a usable report contains, and the ISP lookup guide explains how the provider name in a geolocation result relates to the registrant in the RDAP record.