# IP WHOIS Lookup API URL: https://www.deepinfo.com/data-api/apis/ip-whois-lookup/ ## Ask the Registry Who Holds an IP Address. The IP WHOIS Lookup API takes an IPv4 or IPv6 address. It queries the regional internet registries over RDAP and WHOIS and returns the network that holds the address, its range, the autonomous system that announces it and the entities behind both. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [IP WHOIS reference](https://docs.deepinfo.com/reference/lookup/ip-whois/) ### Look Up One Address to Get Its Allocation. The response keeps the autonomous system that announces the address apart from the registered network that holds it. The two can be different organizations, and the fields never assume they match. GET `https://api.deepinfo.com/v1/lookup/ip-whois` [Reference](https://docs.deepinfo.com/reference/lookup/ip-whois/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `ip` | string | Required | An IPv4 or IPv6 address, for example `8.8.8.8`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/lookup/ip-whois?ip=8.8.8.8" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/lookup/ip-whois", params={"ip": "8.8.8.8"}, headers={"apikey": "YOUR_API_KEY"}, ) w = r.json()["ipwhois"] print(w["asn"], w["asn_description"], w["network"]["cidr"]) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/lookup/ip-whois?ip=8.8.8.8', { headers: { apikey: 'YOUR_API_KEY' } } ) const { ipwhois } = await r.json() console.log(ipwhois.asn, ipwhois.network.cidr) ``` Response 200 OK · application/json ```json { "ip": "8.8.8.8", "ipwhois": { "asn": "15169", "asn_cidr": "8.8.8.0/24", "asn_description": "GOOGLE - Google LLC, US", "asn_country_code": "US", "asn_registry": "arin", "asn_date": "2023-12-28", "network": { "cidr": "8.8.8.0/24", "name": "GOGL", "start_address": "8.8.8.0", "end_address": "8.8.8.255", "type": "DIRECT ALLOCATION", "status": ["active"], "…": "handle, parent_handle, events, notices, links" }, "entities": ["GOGL"], "objects": { "…": "per-entity contact, roles, events" }, "nir": null }, "check_date": "2026-09-22T12:26:00Z" } ``` ### One Block per Question. ASN #### Who Announces It The autonomous system number, its CIDR, description, country code, registry and allocation date. Network #### Who Holds It The registered network: CIDR, name, first and last address, allocation type and status, with its handles, events and notices. Entities #### Who to Contact Handles of the organizations and contacts tied to the network. Under `objects`, each one’s contact details, roles and events, which is where an abuse contact appears when the registry publishes one. ### From One Address to Its Neighbors. IP WHOIS tells you who holds an address. [Reverse IP](https://www.deepinfo.com/data-api/apis/reverse-ip/) tells you which domains resolve to it, or to its /8, /16 or /24 network. Run them in that order and a single address from an alert becomes a list of the other domains hosted next to it, each returned as a full domain record. [Reverse IP API](https://www.deepinfo.com/data-api/apis/reverse-ip/) The pivot ``` # 1. Who holds it? GET /v1/lookup/ip-whois?ip=203.0.113.10 → ipwhois.network.cidr, ipwhois.asn # 2. Which domains resolve into its /24? GET /v1/discovery/reverse-ip?ip=203.0.113.10&mask=24 → results[]: domain records ``` ### When an Address Needs an Owner. #### [Incident Investigation](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) Resolve the network, ASN and registry of an address in an alert before you decide who to contact about it. #### [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) Group suspicious infrastructure by the autonomous system and network that hold it. #### [Attack Surface Checks](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/) Confirm that the addresses your hostnames resolve to sit in networks you or your providers hold. ### Registries, Limits and the Platform View. - **National registries**: `nir` carries National Internet Registry data where one applies, and is `null` otherwise. - **In the Deepinfo Platform**: [External Attack Surface Management](https://www.deepinfo.com/platform/easm/continuous-scanning/) scans IP WHOIS on all monitored assets and keeps each snapshot. - **Rate limits**: Plan-dependent. The default is one request per second per key and endpoint. See [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/). - **Errors**: `400` when `ip` is not a valid address. See [errors](https://docs.deepinfo.com/getting-started/errors/). ### Other Live Lookups. - [Domain WHOIS](https://www.deepinfo.com/data-api/apis/whois-lookup/) (Lookup): The registration record of a domain, raw and parsed. - [Port Scan](https://www.deepinfo.com/data-api/apis/port-scan/) (Lookup): Open TCP and UDP ports on a host you are authorized to test. - [Reverse IP](https://www.deepinfo.com/data-api/apis/reverse-ip/) (Discovery): Domains that resolve to an address or its network. ### Questions About IP WHOIS Lookup API **Which regional internet registry does an address belong to?** `ipwhois.asn_registry` names the registry of the autonomous system that announces the address, for example `arin`. **When was a network registered?** `ipwhois.network.events` lists the registry’s events for the network, each with its action, such as `registration`, its actor where the registry names one, and a UTC timestamp. `asn_date` gives the allocation date of the autonomous system. **Is the registry’s raw answer included?** Yes, when the registry provides one: `ipwhois.network.raw` holds it next to the parsed network fields. **Is the IP WHOIS API in our plan?** Your plan sets which endpoints your key can call; a call outside it returns `403` with `You cannot consume this service`. API services are priced by volume and frequency, as [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing) explains. **Can analysts run IP WHOIS without writing code?** Yes. [Instant Lookups](https://www.deepinfo.com/platform/dsi/instant-lookups/) runs IP WHOIS in the Deepinfo Platform, next to Domain WHOIS, DNS and SSL. ### Put Your Address Space Through It. Most teams start with the ranges they already know they hold. We set up access and walk through the response on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)