Type an IP address into a WHOIS tool and you get back a wall of fields: NetRange, OrgName, CIDR, abuse contacts, dates. It looks like it should tell you exactly who is behind the address. It usually does not, and knowing why saves a lot of wasted effort.
This guide explains what each part of an IP WHOIS record means, walks through two real lookups, and then shows who actually holds the internet's addresses, using the registries' own data.
Who hands out IP addresses
No single company owns the internet's addresses. IANA gives large blocks to five regional internet registries (RIRs), and each registry hands smaller blocks to the internet providers, hosting companies and large organisations in its region. Every WHOIS record traces back to one of these five.
We added up every block marked allocated or assigned in each registry's public statistics file, dated 22 and 23 October 2026:
| Registry | Region | IPv4 allocated or assigned | Share of world | IPv4 still in free pool | Network numbers (ASNs) | IPv6 blocks |
|---|---|---|---|---|---|---|
| ARIN | USA, Canada, parts of the Caribbean | 1,644,563,200 | 44.6% | 0 | 34,255 | 11,552 |
| APNIC | Asia Pacific | 888,915,840 | 24.1% | 2,928,512 | 31,432 | 17,276 |
| RIPE NCC | Europe, Middle East, Central Asia | 856,051,040 | 23.2% | 3,328 | 40,072 | 26,868 |
| LACNIC | Latin America, parts of the Caribbean | 181,934,848 | 4.9% | 0 | 14,415 | 13,594 |
| AFRINIC | Africa | 116,177,152 | 3.2% | 581,888 | 2,816 | 1,691 |
| Total | 3,687,642,080 | 122,990 | 70,981 |
That total is 85.9% of the 4,294,967,296 IPv4 addresses that can exist. Most of the rest is set aside for private networks, multicast, documentation and other special uses, so in practice the free supply is gone. ARIN and LACNIC have nothing left to give out, RIPE NCC has 3,328 addresses (thirteen /24 blocks), and only APNIC and AFRINIC still have small pools.
Who holds the most addresses
| Country | IPv4 addresses held | Share of all assigned IPv4 |
|---|---|---|
| United States | 1,606,246,560 | 43.6% |
| China | 342,985,472 | 9.3% |
| Japan | 188,719,168 | 5.1% |
| United Kingdom | 138,744,896 | 3.8% |
| Germany | 126,365,312 | 3.4% |
| South Korea | 112,497,984 | 3.1% |
| France | 81,586,768 | 2.2% |
| Brazil | 79,321,344 | 2.2% |
| Canada | 67,835,904 | 1.8% |
| Italy | 54,086,016 | 1.5% |
| Netherlands | 47,943,456 | 1.3% |
| Australia | 46,088,960 | 1.2% |
| Russia | 45,249,856 | 1.2% |
| India | 42,032,128 | 1.1% |
| Taiwan | 35,741,952 | 1.0% |
The imbalance is the legacy of who built the early internet. The United States holds about 6.4 IPv4 addresses for every person online there, using APNIC Labs' user estimates. India, with more than twice as many internet users, holds about 0.07 per user. That gap is why so many people outside North America share a single public address with their neighbours through carrier grade NAT, and why our IPv6 adoption by country report shows India far ahead on IPv6.
Network numbers tell a different story. The United States has 32,290 registered ASNs, but Brazil is second with 9,179, ahead of China (6,627) and India (6,308). Brazil has thousands of small regional internet providers, and each one registers its own network.
Reading a real IP WHOIS record
Here is what a lookup returns for Google's public DNS address, 8.8.8.8, through ARIN's RDAP service:
| Field | Value | What it means |
|---|---|---|
| Handle | NET-8-8-8-0-2 | ARIN's ID for this record |
| Range | 8.8.8.0 to 8.8.8.255 | The block the record covers |
| CIDR | 8.8.8.0/24 | The same range in CIDR form, 256 addresses |
| Name | GOGL | A short label chosen by the holder |
| Type | Direct allocation | Handed straight from ARIN to the organisation |
| Registrant | Google LLC | The organisation that holds the block |
| Registry | ARIN (whois.arin.net) | Which of the five RIRs is the source |
Clear enough. Now 1.1.1.1, the address most people know as Cloudflare's DNS:
| Field | Value |
|---|---|
| Range | 1.1.1.0 to 1.1.1.255 (1.1.1.0/24) |
| Name | APNIC-LABS |
| Type | Assigned portable |
| Registrant | APNIC Research and Development |
| Abuse contact | IRT-APNICRANDNET-AU |
| Registered | 10 August 2011 |
| Registry | APNIC (whois.apnic.net) |
The registered holder is not Cloudflare at all. The block belongs to APNIC's research arm, and Cloudflare operates its resolver on it under an agreement with APNIC Labs. This is a good reminder that the WHOIS holder and the operator are not always the same organisation.
What a WHOIS lookup on your own IP shows
Run our WHOIS lookup or IP lookup on your own address and you will see your internet provider's name, its address block, and its abuse contact. You will not see your name or street address. That information sits in your provider's customer records, not in any public registry.
The same is true when you look up someone else's IP from a server log or an email header. The record tells you which provider to contact. It does not identify the person. Only the provider can match an address and a timestamp to a customer account, and reputable providers only do that for law enforcement with a legal order.
Two more things that confuse people:
- The country in WHOIS is where the block is registered, often the provider's head office. A block registered in one country can be used anywhere. The location shown by IP lookup tools comes from separate geolocation databases and is usually more accurate for where the user actually is.
- Cloud and VPN addresses show the cloud or VPN company, not the customer renting the server. If a lookup shows Amazon, Google, Microsoft, DigitalOcean or a VPN brand, you are looking at a server, not a home.
WHOIS vs RDAP
WHOIS is a protocol from the early 1980s. It returns plain text in a different layout at every registry, which is why WHOIS output for an IP in Europe looks nothing like one in the US.
RDAP (Registration Data Access Protocol) is its replacement. It returns the same information as structured JSON over HTTPS, in the same format everywhere. All five regional registries run RDAP, and our tools use it. From a terminal you can try either:
whois 8.8.8.8
curl https://rdap.org/ip/8.8.8.8
The rdap.org address automatically forwards your query to whichever registry holds the block, so you do not have to know in advance.
How to report abuse from an IP
If an address is attacking your server or sending you spam:
- Look up the IP and find the abuse contact. In ARIN records it is labelled OrgAbuseEmail. In RIPE NCC records look for abuse-mailbox.
- Send the exact date and time of the activity, with the time zone, and the log lines that show it.
- Keep it short and factual. Providers get thousands of these reports, and the clear ones get handled first.
If the address belongs to a cloud provider, use their abuse form instead of email. AWS, Google Cloud, Azure and DigitalOcean all have one, and they act faster through it.
The bottom line
An IP WHOIS lookup tells you which organisation holds an address block, which registry it came from, and who to contact about abuse. For a home connection that is the internet provider, never the person. Behind those records sit five registries that have handed out 3.69 billion IPv4 addresses, 43.6% of them to the United States, with almost nothing left in their free pools. To see what the record says about any address, including your own, use our WHOIS lookup.