IP WHOIS Lookup API
Ask the Registry Who Holds an IP Address.
The IP WHOIS Lookup API takes an IPv4 or IPv6 address. It queries the regional internet registries over RDAP and WHOIS and returns the network that holds the address, its range, the autonomous system that announces it and the entities behind both.
Request
GET /
Response · 200 OK
-
Which network
8.8.8.8
8.8.8.08.8.8.255
registry arin · RDAP and WHOIS
-
Who announces it
ASN 15169 · GOOGLE - Google LLC, US · 8.8.8.0/24
-
Who holds it
GOGL · DIRECT ALLOCATION · active
-
Who to contact
GOGL, listed in entities
check_date 2026-09-22T12:26:00Z
Look Up One Address to Get Its Allocation.
The response keeps the autonomous system that announces the address apart from the registered network that holds it. The two can be different organizations, and the fields never assume they match.
| Parameter | Type | Description | |
|---|---|---|---|
ip | string | Required | An IPv4 or IPv6 address, for example 8.8.8.8. |
Request
curl "https://api.deepinfo.com/v1/lookup/ip-whois?ip=8.8.8.8" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/lookup/ip-whois",
params={"ip": "8.8.8.8"},
headers={"apikey": "YOUR_API_KEY"},
)
w = r.json()["ipwhois"]
print(w["asn"], w["asn_description"], w["network"]["cidr"])const r = await fetch(
'https://api.deepinfo.com/v1/lookup/ip-whois?ip=8.8.8.8',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const { ipwhois } = await r.json()
console.log(ipwhois.asn, ipwhois.network.cidr)Response
{
"ip": "8.8.8.8",
"ipwhois": {
"asn": "15169",
"asn_cidr": "8.8.8.0/24",
"asn_description": "GOOGLE - Google LLC, US",
"asn_country_code": "US",
"asn_registry": "arin",
"asn_date": "2023-12-28",
"network": {
"cidr": "8.8.8.0/24",
"name": "GOGL",
"start_address": "8.8.8.0",
"end_address": "8.8.8.255",
"type": "DIRECT ALLOCATION",
"status": ["active"],
"…": "handle, parent_handle, events, notices, links"
},
"entities": ["GOGL"],
"objects": { "…": "per-entity contact, roles, events" },
"nir": null
},
"check_date": "2026-09-22T12:26:00Z"
}One Block per Question.
ASN
Who Announces It
The autonomous system number, its CIDR, description, country code, registry and allocation date.
Network
Who Holds It
The registered network: CIDR, name, first and last address, allocation type and status, with its handles, events and notices.
Entities
Who to Contact
Handles of the organizations and contacts tied to the network. Under objects, each one’s contact details, roles and events, which is where an abuse contact appears when the registry publishes one.
From One Address to Its Neighbors.
IP WHOIS tells you who holds an address. Reverse IP tells you which domains resolve to it, or to its /8, /16 or /24 network.
Run them in that order and a single address from an alert becomes a list of the other domains hosted next to it, each returned as a full domain record.
# 1. Who holds it?
GET /v1/lookup/ip-whois?ip=203.0.113.10
→ ipwhois.network.cidr, ipwhois.asn
# 2. Which domains resolve into its /24?
GET /v1/discovery/reverse-ip?ip=203.0.113.10&mask=24
→ results[]: domain recordsWhen an Address Needs an Owner.
Incident Investigation
Resolve the network, ASN and registry of an address in an alert before you decide who to contact about it.
Threat Hunting
Group suspicious infrastructure by the autonomous system and network that hold it.
Attack Surface Checks
Confirm that the addresses your hostnames resolve to sit in networks you or your providers hold.
Registries, Limits and the Platform View.
| National registries | nir carries National Internet Registry data where one applies, and is null otherwise. |
|---|---|
| In the Deepinfo Platform | External Attack Surface Management scans IP WHOIS on all monitored assets and keeps each snapshot. |
| Rate limits | Plan-dependent. The default is one request per second per key and endpoint. See rate limits. |
| Errors | 400 when ip is not a valid address. See errors. |
Questions About IP WHOIS Lookup API
Which regional internet registry does an address belong to?
ipwhois.asn_ names the registry of the autonomous system that announces the address, for example arin.
When was a network registered?
ipwhois.network.events lists the registry’s events for the network, each with its action, such as registration, its actor where the registry names one, and a UTC timestamp. asn_ gives the allocation date of the autonomous system.
Is the registry’s raw answer included?
Yes, when the registry provides one: ipwhois.network.raw holds it next to the parsed network fields.
Is the IP WHOIS API in our plan?
Your plan sets which endpoints your key can call; a call outside it returns 403 with You cannot consume this service. API services are priced by volume and frequency, as Data & API pricing explains.
Can analysts run IP WHOIS without writing code?
Yes. Instant Lookups runs IP WHOIS in the Deepinfo Platform, next to Domain WHOIS, DNS and SSL.
Put Your Address Space Through It.
Most teams start with the ranges they already know they hold. We set up access and walk through the response on a short call.