codynet

RDAP

IP Registration Lookup

Look up IP network allocation and registration data with RDAP.

Query IP RDAP

Validate an IP address and fetch its registration data from RDAP.

Results come from deterministic DNS APIs or HTTPS RDAP endpoints.

Results

Sample Live example: RDAP allocation for 20.118.138.147 (Microsoft). Run your own lookup above to replace it.

20.118.138.147RDAP398 ms
Name
MSFT
Handle
NET-20-33-0-0-1
Status
active
Registrar
Unavailable
Events
registration: 2017-10-18T13:17:25-04:00, last changed: 2021-12-14T20:28:38-05:00
Source
https://rdap.arin.net/registry/

Raw RDAP response

{
  "objectClassName": "ip network",
  "handle": "NET-20-33-0-0-1",
  "startAddress": "20.33.0.0",
  "endAddress": "20.128.255.255",
  "name": "MSFT",
  "type": "DIRECT ALLOCATION",
  "country": "US",
  "status": [
    "active"
  ]
}

Continue investigating

Hand a value from this result to another tool — the lookup is prefilled for you.

Practical guide

How to use the IP Registration tool

IP RDAP is the modern way to ask 'who owns this IP block?' This page resolves the right Regional Internet Registry for the address, queries it over HTTPS, and parses the JSON response for you.

What this tool checks

Given an IPv4 or IPv6 address, the tool uses the IANA bootstrap registry to find the right RIR (ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC) and queries that RIR's RDAP endpoint. The response describes the network block the address belongs to, the organization holding the allocation, the relevant dates, status codes, and abuse contact.

When to use it

Use this when you need to know which organization is responsible for a block of address space — investigating abusive traffic, identifying an ISP, confirming a cloud provider's range, or tracing where a connection actually terminates. It is also the standard way to find an abuse contact for reporting attacks or scraping.

How to read the result

handle is the RIR's identifier for the network block. startAddress and endAddress (or cidr0_cidrs) tell you the boundary of the allocation. name is a short label the holder gave the block. events shows registration and last-changed dates. The entities array contains the organization that holds the block plus an abuse contact role you can use for reporting.

Common errors and what they mean

An empty or 404 response usually means the address is in reserved or unallocated space (RFC 1918 private ranges, link-local, loopback, etc.) — those have no RDAP record because no one owns them. An unexpectedly broad block (a /8 or /16) is common for direct RIR assignments to large organizations or sub-allocated ISPs. If the abuse contact is missing, fall back to the organization's published abuse policy.

The five Regional Internet Registries

IP RDAP routes your query to the RIR that holds the address. This is who covers which part of the world.

RIRRegion
ARINUnited States, Canada, parts of the Caribbean
RIPE NCCEurope, the Middle East, Central Asia
APNICAsia-Pacific
LACNICLatin America and the Caribbean
AFRINICAfrica

Field notes

Remember that RDAP shows the holder of record, not today's user. A cloud provider may hold a /15 and sub-delegate a tiny slice to the customer you are actually investigating, so the org name can look too big. Pair this with a PTR lookup and the network name field to get closer to the real operator, and use the abuse contact — not the registrant — when you need to report something.

Example RDAP query for an IPv4 address

Example input
8.8.8.8
Example result
{
  "handle": "NET-8-8-8-0-1",
  "startAddress": "8.8.8.0",
  "endAddress": "8.8.8.255",
  "name": "LVLT-GOGL-8-8-8",
  "events": [
    { "eventAction": "registration", "eventDate": "2014-03-14T00:00:00Z" }
  ],
  "entities": [
    { "handle": "GOGL", "roles": ["registrant"] }
  ]
}

ARIN returns this for 8.8.8.8 because it is in ARIN's region. The block (8.8.8.0/24) and the registrant (Google) are the two pieces of data you usually came here to find.

Related tools

Domain Whois / RDAP

Same RDAP protocol, but for domain names instead of IP blocks.

Open tool

Reverse DNS (PTR)

Get the hostname the IP claims, then cross-check against the RIR's holder.

Open tool

DNS Lookup

Look up A or AAAA records for a hostname to start an IP investigation.

Open tool

Related guides

RDAP vs WHOIS

How IP allocation data flows through RDAP from the regional internet registries, and how to read the JSON.

Read guide

FAQ

What is an RIR and why does it matter for IP RDAP?
The five Regional Internet Registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) hold the authoritative records for IP allocations in their regions. IP RDAP routes your query — via the IANA bootstrap registry — to the right RIR for the address you asked about. That is why a 8.8.8.8 lookup hits ARIN and a 81.2.69.142 lookup hits RIPE: the bootstrap registry sends them to different servers.
How is this different from a domain RDAP lookup?
Domain RDAP answers 'who registered this name?' and goes to a TLD registry. IP RDAP answers 'who has this address space allocated?' and goes to a regional internet registry. The JSON shape is similar (events, status, entities, network) but the entities you get back describe the organization that holds the network block, not a domain registrant.
What is the difference between the network block and the ASN?
The network block (CIDR range) is the actual IP space the organization holds — for example 8.8.8.0/24. The ASN (Autonomous System Number) is the routing identity used to announce that block on the global internet. One organization usually owns multiple network blocks and announces them under one or more ASNs. Use the ASN to find peering and routing info; use the CIDR to find the boundary of who owns this specific address.
Does IP RDAP work for IPv6?
Yes. The same bootstrap-and-query flow applies to IPv6 addresses — you submit something like 2606:4700:4700::1111 and the tool routes you to the right RIR. Most large allocations are documented and the responses look essentially identical to the IPv4 case.
Why does my IP show a different organization than I expected?
RIR data describes who holds the allocation, not who is using the address today. ISPs and cloud providers re-delegate large blocks to customers, and reverse DNS or the network name may reflect a customer rather than the holder of record. For end-user assignments you usually only see the ISP that owns the block.
How do I find the abuse contact for an IP address?
Look in the entities array of the RDAP response for an entity whose roles include 'abuse'. Its vCard usually carries an email and sometimes a phone number. That abuse address is the supported channel for reporting attacks, scraping, or spam originating from the block — use it rather than the registrant contact.
Why does a private IP like 192.168.1.1 return no data?
Private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback, and link-local addresses are not allocated to anyone on the public internet, so no RIR has a record for them. An empty or not-found response for those addresses is expected — they only have meaning inside a local network.

Last reviewed: 2026-06-25.