SearchCtrl+K

WHOIS APIs›IP WHOIS Lookup

IP WHOIS Lookup API — Organization, CIDR & Abuse Contact Data

Every IP address on the internet is registered with one of five Regional Internet Registries: ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC. The IP WHOIS Lookup API queries those registries directly and returns the full registration record for any IPv4 or IPv6 address in a single REST call — who owns the IP block, what CIDR range it belongs to, the registered organization, and the abuse contacts you need when investigating suspicious traffic.

Manual WHOIS queries are slow, inconsistently formatted across registries, and impossible to automate at scale. This API gives you structured JSON and raw WHOIS text in the same response, so you can parse the fields your application needs and still retain the original registry output for audit or compliance workflows.

Try Playground Get Free API Key

10K Free Credits, No Credit Card Required

What You Get in Every Response

Full inet_num record

Each response includes the registered network block tied to the IP: start and end address, CIDR notation, network name, net handle, allocation type (direct allocation, reallocated, etc.), and the parent network. The inet_nums array gives you everything needed to identify the owning block and push a netblock-level firewall rule without a second lookup.

Organization and contact data

The organization object returns the legal name, physical address, country, and registry handle of the entity responsible for the IP block. Separate technical_contacts and abuse_contacts arrays give you the email addresses and phone numbers to use when filing network abuse reports — the contacts your abuse reporting workflow actually needs.

Structured JSON and raw WHOIS text

Every response includes both a clean, parsed JSON structure and the raw WHOIS output in whois_raw_response — exactly as returned by the source registry server. Use the structured data for programmatic workflows; use the raw output for audit logs, compliance documentation, or ML pipelines that need to parse their own field formats.

Full IPv4 and IPv6 coverage

Pass any valid IPv4 or IPv6 address as the ip parameter. The API identifies the responsible registry, queries it in real time, and returns the same structured response format for both address families. No separate endpoints, no configuration changes.

Built for These Use Cases

Abuse reporting and incident response

When your firewall or SIEM flags suspicious traffic from an unknown IP, the first question is: who do I contact? The API returns abuse_contacts[].email directly from the registry — the registered address for network abuse reports, not a generic contact form. Pull the IP, extract the contact, and file the report without leaving your toolchain. Security operations teams use this to close the abuse loop on incidents in seconds.

Netblock-level threat blocking

Blocking a single IP is reactive. The inet_nums object gives you the full CIDR range the IP belongs to, so you can push a block rule that covers the entire registered allocation. Pair this with the ASN Lookup API to trace the owning autonomous system and block at the routing level when the threat scope warrants it.

Fraud detection and datacenter identification

Legitimate users rarely transact through IP addresses registered to cloud infrastructure. The organization object returns the legal name of the entity that owns the IP block — "Amazon Data Services," "DigitalOcean, LLC," "Cloudflare, Inc." — so you can flag at transaction time whether a request originates from a datacenter rather than a residential or business ISP. Combine this with the inet_nums.status field to identify direct allocations to known hosting providers and route those transactions to your fraud review queue without relying on third-party blocklists.

IP inventory audits and compliance

Enterprise network teams and ISPs use IP WHOIS records to verify allocations, document peering arrangements, and maintain accurate IP inventory for security audits and regulatory compliance. The structured JSON output integrates directly into CMDB and asset management platforms. For domain-level ownership investigations in the same workflow, see the Domain WHOIS Lookup API.

OSINT and security research

Researchers mapping attack infrastructure use the organization.handle and parents[] fields to pivot from a single malicious IP to all registered IP blocks under common organizational ownership. The whois_raw_response preserves the full registry record for documentation and chain-of-custody requirements.

API Endpoint

GEThttps://api.apifreaks.com/v1.0/ip/whois/live

Test

Explore the complete API reference with detailed request parameters, response fields, error codes, and code examples visit API Reference.

LANGUAGE


$ pip install requests
import requests 

url = "https://api.apifreaks.com/v1.0/ip/whois/live?ip=8.8.8.8"

payload = {}
headers = {
	'X-apiKey': 'API-KEY'
}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)

How-To-Guides

Look up an IPv4 address

Pass the ip parameter with any valid IPv4 address. The response identifies the responsible registry (whois_server), returns the full inet_nums block containing the CIDR range and network handle, and includes the organization and abuse_contacts objects for the registered owner.

curl -X 'GET'   'https://api.apifreaks.com/v1.0/ip/whois/live?ip=8.8.8.8&apiKey=API-KEY'

{
    "status": true,
    "ip_address": "8.8.8.8",
    "query_time": "2024-08-08 15:14:11",
    "whois_server": "whois.arin.net",
    "inet_nums": [
        {
            "start_ip": "8.8.8.0",
            "end_ip": "8.8.8.255",
            "cidr": [
                "8.8.8.0/24"
            ],
            "net_name": "GOGL",
            "net_handle": "NET-8-8-8-0-2",
            "status": "Direct Allocation",
            "organization": "Google LLC (GOGL)",
            "date_created": "2023-12-28",
            "date_updated": "2023-12-28",
            "source": "https://rdap.arin.net/registry/ip/8.8.8.0",
            "parents": [
                "NET8 (NET-8-0-0-0-0)"
            ]
        }
    ],
    "organization": {
        "handle": "GOGL",
        "name": "Google LLC",
        "address": [
            "1600 Amphitheatre Parkway",
            "Mountain View",
            "CA",
            "94043",
            "US"
        ],
        "street": "Amphitheatre Parkway",
        "city": "Mountain View",
        "state": "CA",
        "zip_code": "94043",
        "country": [
            "US"
        ],
        "date_created": "2000-03-30",
        "date_updated": "2019-10-31",
        "source": "https://rdap.arin.net/registry/entity/GOGL"
    },
    "technical_contacts": [
        {
            "handle": "ZG39-ARIN",
            "name": "Google LLC",
            "email": [
                "arin-contact@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ZG39-ARIN"
        }
    ],
    "abuse_contacts": [
        {
            "handle": "ABUSE5250-ARIN",
            "name": "Abuse",
            "email": [
                "network-abuse@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ABUSE5250-ARIN"
        }
    ],
    "whois_raw_response": "#\n# ARIN WHOIS data and services are subject to the Terms of Use\n# available at: https://www.arin.net/resources/registry/whois/tou/\n#\n# If you see inaccuracies in the results, please report at\n# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/\n#\n# Copyright 1997-2024, American Registry for Internet Numbers, Ltd.\n#\n\n\nNetRange:       8.8.8.0 - 8.8.8.255\nCIDR:           8.8.8.0/24\nNetName:        GOGL\nNetHandle:      NET-8-8-8-0-2\nParent:         NET8 (NET-8-0-0-0-0)\nNetType:        Direct Allocation\nOriginAS:       \nOrganization:   Google LLC (GOGL)\nRegDate:        2023-12-28\nUpdated:        2023-12-28\nRef:            https://rdap.arin.net/registry/ip/8.8.8.0\n\n\n\nOrgName:        Google LLC\nOrgId:          GOGL\nAddress:        1600 Amphitheatre Parkway\nCity:           Mountain View\nStateProv:      CA\nPostalCode:     94043\nCountry:        US\nRegDate:        2000-03-30\nUpdated:        2019-10-31\nComment:        Please note that the recommended way to file abuse complaints are located in the following links. \nComment:        \nComment:        To report abuse and illegal activity: https://www.google.com/contact/\nComment:        \nComment:        For legal requests: http://support.google.com/legal \nComment:        \nComment:        Regards, \nComment:        The Google Team\nRef:            https://rdap.arin.net/registry/entity/GOGL\n\n\nOrgTechHandle: ZG39-ARIN\nOrgTechName:   Google LLC\nOrgTechPhone:  +1-650-253-0000 \nOrgTechEmail:  arin-contact@google.com\nOrgTechRef:    https://rdap.arin.net/registry/entity/ZG39-ARIN\n\nOrgAbuseHandle: ABUSE5250-ARIN\nOrgAbuseName:   Abuse\nOrgAbusePhone:  +1-650-253-0000 \nOrgAbuseEmail:  network-abuse@google.com\nOrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE5250-ARIN\n\n\n#\n# ARIN WHOIS data and services are subject to the Terms of Use\n# available at: https://www.arin.net/resou... (line truncated to 2000 chars)
}

Look up an IPv6 address

IPv6 lookups use the same endpoint and parameter. The response format is identical to IPv4 — inet_nums, organization, technical_contacts, and abuse_contacts are all present. Pass the address URL-encoded when using curl.

curl -X 'GET'   'https://api.apifreaks.com/v1.0/ip/whois/live?ip=2001%3A4860%3A4860%3A%3A1&apiKey=API-KEY'

{
    "status": true,
    "ip_address": "2001:4860:4860::1",
    "query_time": "2024-08-08 15:27:56",
    "whois_server": "whois.arin.net",
    "inet_nums": [
        {
            "start_ip": "2001:4860::",
            "end_ip": "2001:4860:ffff:ffff:ffff:ffff:ffff:ffff",
            "cidr": [
                "2001:4860::/32"
            ],
            "net_name": "GOOGLE-IPV6",
            "net_handle": "NET6-2001-4860-1",
            "status": "Direct Allocation",
            "organization": "Google LLC (GOGL)",
            "date_created": "2005-03-14",
            "date_updated": "2012-02-24",
            "source": "https://rdap.arin.net/registry/ip/2001:4860::",
            "parents": [
                "ARIN-004 (NET6-2001-4800-0)"
            ]
        }
    ],
    "organization": {
        "handle": "GOGL",
        "name": "Google LLC",
        "address": [
            "1600 Amphitheatre Parkway",
            "Mountain View",
            "CA",
            "94043",
            "US"
        ],
        "street": "Amphitheatre Parkway",
        "city": "Mountain View",
        "state": "CA",
        "zip_code": "94043",
        "country": [
            "US"
        ],
        "date_created": "2000-03-30",
        "date_updated": "2019-10-31",
        "source": "https://rdap.arin.net/registry/entity/GOGL"
    },
    "technical_contacts": [
        {
            "handle": "ZG39-ARIN",
            "name": "Google LLC",
            "email": [
                "arin-contact@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ZG39-ARIN"
        }
    ],
    "abuse_contacts": [
        {
            "handle": "ABUSE5250-ARIN",
            "name": "Abuse",
            "email": [
                "network-abuse@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ABUSE5250-ARIN"
        },
        {
            "handle": "ZG39-ARIN",
            "name": "Google LLC",
            "email": [
                "arin-contact@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ZG39-ARIN"
        }
    ],
    "whois_raw_response": "#
# ARIN WHOIS data and services are subject to the Terms of Use\n# available at: https://www.arin.net/resources/registry/whois/tou/\n#\n# If you see inaccuracies in the results, please report at\n# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/\n#\n# Copyright 1997-2024, American Registry for Internet Numbers, Ltd.\n#\n\n\nNetRange:       2001:4860:: - 2001:4860:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF\nCIDR:           2001:4860::/32\nNetName:        GOOGLE-IPV6\nNetHandle:      NET6-2001-4860-1\nParent:         ARIN-004 (NET6-2001-4800-0)\nNetType:        Direct Allocation\nOriginAS:       AS15169\nOrganization:   Google LLC (GOGL)\nRegDate:        2005-03-14\nUpdated:        2012-02-24\nRef:            https://rdap.arin.net/registry/ip/2001:4860::\n\n\n\nOrgName:        Google LLC\nOrgId:          GOGL\nAddress:        1600 Amphitheatre Parkway\nCity:           Mountain View\nStateProv:      CA\nPostalCode:     94043\nCountry:        US\nRegDate:        2000-03-30\nUpdated:        2019-10-31\nComment:        Please note that the recommended way to file abuse complaints are located in the following links. \nComment:        \nComment:        To report abuse and illegal activity: https://www.google.com/contact/\nComment:        \nComment:        For legal requests: http://support.google.com/legal \nComment:        \nComment:        Regards, \nComment:        The Google Team\nRef:            https://rdap.arin.net/registry/entity/GOGL\n\n\nOrgTechHandle: ZG39-ARIN\nOrgTechName:   Google LLC\nOrgTechPhone:  +1-650-253-0000 \nOrgTechEmail:  arin-contact@google.com\nOrgTechRef:    https://rdap.arin.net/registry/entity/ZG39-ARIN\n\nOrgAbuseHandle: ABUSE5250-ARIN\nOrgAbuseName:   Abuse\nOrgAbusePhone:  +1-650-253-0000 \nOrgAbuseEmail:  network-abuse@google.com\nOrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE5250-ARIN\n\nRTechHandle: ZG39-ARIN\nRTechName:   Google LLC... (line truncated to 2000 chars)
}

Extract abuse contacts

When investigating a flagged IP, you typically need the abuse contact directly. The abuse_contacts array contains the registered email address and phone number for the responsible network operator — the contacts the registry holds on record for abuse reporting.

import requests

response = requests.get(
    "https://api.apifreaks.com/v1.0/ip/whois/live",
    params={"ip": "8.8.8.8", "apiKey": "YOUR_API_KEY"}
)
data = response.json()

for contact in data.get("abuse_contacts", []):
    print(f"Name:  {contact['name']}")
    for email in contact.get("email", []):
        print(f"Email: {email}")
    for phone in contact.get("phone", []):
        print(f"Phone: {phone}")

# RESPONSE

Name:  Abuse
Email: network-abuse@google.com
Phone: +1-650-253-0000

Get the registered CIDR block

To retrieve the full registered IP range — useful for netblock-level blocking or network audits — read the inet_nums array. Each entry contains cidr, start_ip, end_ip, net_name, and status.

import requests

response = requests.get(
    "https://api.apifreaks.com/v1.0/ip/whois/live",
    params={"ip": "8.8.8.8", "apiKey": "YOUR_API_KEY"}
)
data = response.json()

for block in data.get("inet_nums", []):
    print(f"CIDR:         {block['cidr']}")
    print(f"Range:        {block['start_ip']} — {block['end_ip']}")
    print(f"Net name:     {block['net_name']}")
    print(f"Status:       {block['status']}")
    print(f"Organization: {block['organization']}")

#RESPONSE

CIDR:         ['8.8.8.0/24']
Range:        8.8.8.0 — 8.8.8.255
Net name:     GOGL
Status:       Direct Allocation
Organization: Google LLC (GOGL)

FAQs

Each response includes: the WHOIS server queried, the inet_nums array (registered IP block, CIDR notation, start and end address, net handle, and allocation status), the organization object (legal name, address, country, and registry handle), technical_contacts and abuse_contacts arrays with emails and phone numbers, and the full whois_raw_response text from the registry server.

The API covers all five Regional Internet Registries: ARIN (Americas), RIPE NCC (Europe, Middle East, and Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America and Caribbean), and AFRINIC (Africa). The correct registry is selected automatically based on the IP address. You pass the IP — the API handles the routing.

Yes. Pass any valid IPv6 address as the `ip` parameter. The response structure is identical to IPv4 lookups — same fields, same JSON format.

The IP Geolocation Lookup API maps an IP address to a physical location (city, country, coordinates) from a database. The IP WHOIS Lookup API retrieves the official network registration record from the responsible internet registry — who owns the IP block, what organization it is allocated to, and who to contact about it. Use geolocation for user-facing features; use IP WHOIS for network intelligence, abuse reporting, and compliance.

The ASN Lookup API takes an Autonomous System Number and returns BGP peer relationships, routing policies, and all IP prefixes announced by that ASN. The IP WHOIS Lookup API takes an IP address and returns the registry ownership record for that specific IP block. A common workflow is to call IP WHOIS first to identify the registered organization, then call ASN Lookup with the owning ASN to map their full routing footprint.

Yes. Each request queries the live WHOIS server of the responsible registry — the same source queried manually via the `whois` command. There is no cached database. The `query_time` field in the response records exactly when the registry was queried.

Pricing

To use the IP WHOIS Lookup API, API credits are required. Charges apply only for successful queries, indicated by a 2xx status code. If a request results in a 4xx or 5xx status code, no credits will be deducted, and any credits previously charged will be refunded.

For each successful request, 15 credits will be charged for WHOIS IP lookup. Utilize the Credits Usage API to efficiently monitor your recent consumption of both one-off and subscription credits. This API provides a streamlined way to track and manage your credit usage, ensuring you stay informed about your remaining balance and can optimize your resource allocation effectively.

Each successful request costs 15 credits. 10,000 free credits on signup — approximately 666 lookups at no cost.

Price Estimation Calculator

WHOIS APIs›IP WHOIS Lookup

IP WHOIS Lookup API — Organization, CIDR & Abuse Contact Data

Try Playground Get Free API Key

10K Free Credits, No Credit Card Required

What You Get in Every Response

Full inet_num record

Organization and contact data

Structured JSON and raw WHOIS text

Full IPv4 and IPv6 coverage

Built for These Use Cases

Abuse reporting and incident response

Netblock-level threat blocking

Fraud detection and datacenter identification

IP inventory audits and compliance

OSINT and security research

API Endpoint

GEThttps://api.apifreaks.com/v1.0/ip/whois/live

Test

Explore the complete API reference with detailed request parameters, response fields, error codes, and code examples visit API Reference.

LANGUAGE


$ pip install requests
import requests 

url = "https://api.apifreaks.com/v1.0/ip/whois/live?ip=8.8.8.8"

payload = {}
headers = {
	'X-apiKey': 'API-KEY'
}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)

How-To-Guides

Look up an IPv4 address

curl -X 'GET'   'https://api.apifreaks.com/v1.0/ip/whois/live?ip=8.8.8.8&apiKey=API-KEY'

{
    "status": true,
    "ip_address": "8.8.8.8",
    "query_time": "2024-08-08 15:14:11",
    "whois_server": "whois.arin.net",
    "inet_nums": [
        {
            "start_ip": "8.8.8.0",
            "end_ip": "8.8.8.255",
            "cidr": [
                "8.8.8.0/24"
            ],
            "net_name": "GOGL",
            "net_handle": "NET-8-8-8-0-2",
            "status": "Direct Allocation",
            "organization": "Google LLC (GOGL)",
            "date_created": "2023-12-28",
            "date_updated": "2023-12-28",
            "source": "https://rdap.arin.net/registry/ip/8.8.8.0",
            "parents": [
                "NET8 (NET-8-0-0-0-0)"
            ]
        }
    ],
    "organization": {
        "handle": "GOGL",
        "name": "Google LLC",
        "address": [
            "1600 Amphitheatre Parkway",
            "Mountain View",
            "CA",
            "94043",
            "US"
        ],
        "street": "Amphitheatre Parkway",
        "city": "Mountain View",
        "state": "CA",
        "zip_code": "94043",
        "country": [
            "US"
        ],
        "date_created": "2000-03-30",
        "date_updated": "2019-10-31",
        "source": "https://rdap.arin.net/registry/entity/GOGL"
    },
    "technical_contacts": [
        {
            "handle": "ZG39-ARIN",
            "name": "Google LLC",
            "email": [
                "arin-contact@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ZG39-ARIN"
        }
    ],
    "abuse_contacts": [
        {
            "handle": "ABUSE5250-ARIN",
            "name": "Abuse",
            "email": [
                "network-abuse@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ABUSE5250-ARIN"
        }
    ],
    "whois_raw_response": "#\n# ARIN WHOIS data and services are subject to the Terms of Use\n# available at: https://www.arin.net/resources/registry/whois/tou/\n#\n# If you see inaccuracies in the results, please report at\n# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/\n#\n# Copyright 1997-2024, American Registry for Internet Numbers, Ltd.\n#\n\n\nNetRange:       8.8.8.0 - 8.8.8.255\nCIDR:           8.8.8.0/24\nNetName:        GOGL\nNetHandle:      NET-8-8-8-0-2\nParent:         NET8 (NET-8-0-0-0-0)\nNetType:        Direct Allocation\nOriginAS:       \nOrganization:   Google LLC (GOGL)\nRegDate:        2023-12-28\nUpdated:        2023-12-28\nRef:            https://rdap.arin.net/registry/ip/8.8.8.0\n\n\n\nOrgName:        Google LLC\nOrgId:          GOGL\nAddress:        1600 Amphitheatre Parkway\nCity:           Mountain View\nStateProv:      CA\nPostalCode:     94043\nCountry:        US\nRegDate:        2000-03-30\nUpdated:        2019-10-31\nComment:        Please note that the recommended way to file abuse complaints are located in the following links. \nComment:        \nComment:        To report abuse and illegal activity: https://www.google.com/contact/\nComment:        \nComment:        For legal requests: http://support.google.com/legal \nComment:        \nComment:        Regards, \nComment:        The Google Team\nRef:            https://rdap.arin.net/registry/entity/GOGL\n\n\nOrgTechHandle: ZG39-ARIN\nOrgTechName:   Google LLC\nOrgTechPhone:  +1-650-253-0000 \nOrgTechEmail:  arin-contact@google.com\nOrgTechRef:    https://rdap.arin.net/registry/entity/ZG39-ARIN\n\nOrgAbuseHandle: ABUSE5250-ARIN\nOrgAbuseName:   Abuse\nOrgAbusePhone:  +1-650-253-0000 \nOrgAbuseEmail:  network-abuse@google.com\nOrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE5250-ARIN\n\n\n#\n# ARIN WHOIS data and services are subject to the Terms of Use\n# available at: https://www.arin.net/resou... (line truncated to 2000 chars)
}

Look up an IPv6 address

curl -X 'GET'   'https://api.apifreaks.com/v1.0/ip/whois/live?ip=2001%3A4860%3A4860%3A%3A1&apiKey=API-KEY'

{
    "status": true,
    "ip_address": "2001:4860:4860::1",
    "query_time": "2024-08-08 15:27:56",
    "whois_server": "whois.arin.net",
    "inet_nums": [
        {
            "start_ip": "2001:4860::",
            "end_ip": "2001:4860:ffff:ffff:ffff:ffff:ffff:ffff",
            "cidr": [
                "2001:4860::/32"
            ],
            "net_name": "GOOGLE-IPV6",
            "net_handle": "NET6-2001-4860-1",
            "status": "Direct Allocation",
            "organization": "Google LLC (GOGL)",
            "date_created": "2005-03-14",
            "date_updated": "2012-02-24",
            "source": "https://rdap.arin.net/registry/ip/2001:4860::",
            "parents": [
                "ARIN-004 (NET6-2001-4800-0)"
            ]
        }
    ],
    "organization": {
        "handle": "GOGL",
        "name": "Google LLC",
        "address": [
            "1600 Amphitheatre Parkway",
            "Mountain View",
            "CA",
            "94043",
            "US"
        ],
        "street": "Amphitheatre Parkway",
        "city": "Mountain View",
        "state": "CA",
        "zip_code": "94043",
        "country": [
            "US"
        ],
        "date_created": "2000-03-30",
        "date_updated": "2019-10-31",
        "source": "https://rdap.arin.net/registry/entity/GOGL"
    },
    "technical_contacts": [
        {
            "handle": "ZG39-ARIN",
            "name": "Google LLC",
            "email": [
                "arin-contact@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ZG39-ARIN"
        }
    ],
    "abuse_contacts": [
        {
            "handle": "ABUSE5250-ARIN",
            "name": "Abuse",
            "email": [
                "network-abuse@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ABUSE5250-ARIN"
        },
        {
            "handle": "ZG39-ARIN",
            "name": "Google LLC",
            "email": [
                "arin-contact@google.com"
            ],
            "phone": [
                "+1-650-253-0000"
            ],
            "source": "https://rdap.arin.net/registry/entity/ZG39-ARIN"
        }
    ],
    "whois_raw_response": "#
# ARIN WHOIS data and services are subject to the Terms of Use\n# available at: https://www.arin.net/resources/registry/whois/tou/\n#\n# If you see inaccuracies in the results, please report at\n# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/\n#\n# Copyright 1997-2024, American Registry for Internet Numbers, Ltd.\n#\n\n\nNetRange:       2001:4860:: - 2001:4860:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF\nCIDR:           2001:4860::/32\nNetName:        GOOGLE-IPV6\nNetHandle:      NET6-2001-4860-1\nParent:         ARIN-004 (NET6-2001-4800-0)\nNetType:        Direct Allocation\nOriginAS:       AS15169\nOrganization:   Google LLC (GOGL)\nRegDate:        2005-03-14\nUpdated:        2012-02-24\nRef:            https://rdap.arin.net/registry/ip/2001:4860::\n\n\n\nOrgName:        Google LLC\nOrgId:          GOGL\nAddress:        1600 Amphitheatre Parkway\nCity:           Mountain View\nStateProv:      CA\nPostalCode:     94043\nCountry:        US\nRegDate:        2000-03-30\nUpdated:        2019-10-31\nComment:        Please note that the recommended way to file abuse complaints are located in the following links. \nComment:        \nComment:        To report abuse and illegal activity: https://www.google.com/contact/\nComment:        \nComment:        For legal requests: http://support.google.com/legal \nComment:        \nComment:        Regards, \nComment:        The Google Team\nRef:            https://rdap.arin.net/registry/entity/GOGL\n\n\nOrgTechHandle: ZG39-ARIN\nOrgTechName:   Google LLC\nOrgTechPhone:  +1-650-253-0000 \nOrgTechEmail:  arin-contact@google.com\nOrgTechRef:    https://rdap.arin.net/registry/entity/ZG39-ARIN\n\nOrgAbuseHandle: ABUSE5250-ARIN\nOrgAbuseName:   Abuse\nOrgAbusePhone:  +1-650-253-0000 \nOrgAbuseEmail:  network-abuse@google.com\nOrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE5250-ARIN\n\nRTechHandle: ZG39-ARIN\nRTechName:   Google LLC... (line truncated to 2000 chars)
}

Extract abuse contacts

import requests

response = requests.get(
    "https://api.apifreaks.com/v1.0/ip/whois/live",
    params={"ip": "8.8.8.8", "apiKey": "YOUR_API_KEY"}
)
data = response.json()

for contact in data.get("abuse_contacts", []):
    print(f"Name:  {contact['name']}")
    for email in contact.get("email", []):
        print(f"Email: {email}")
    for phone in contact.get("phone", []):
        print(f"Phone: {phone}")

# RESPONSE

Name:  Abuse
Email: network-abuse@google.com
Phone: +1-650-253-0000

Get the registered CIDR block

import requests

response = requests.get(
    "https://api.apifreaks.com/v1.0/ip/whois/live",
    params={"ip": "8.8.8.8", "apiKey": "YOUR_API_KEY"}
)
data = response.json()

for block in data.get("inet_nums", []):
    print(f"CIDR:         {block['cidr']}")
    print(f"Range:        {block['start_ip']} — {block['end_ip']}")
    print(f"Net name:     {block['net_name']}")
    print(f"Status:       {block['status']}")
    print(f"Organization: {block['organization']}")

#RESPONSE

CIDR:         ['8.8.8.0/24']
Range:        8.8.8.0 — 8.8.8.255
Net name:     GOGL
Status:       Direct Allocation
Organization: Google LLC (GOGL)

FAQs

Yes. Pass any valid IPv6 address as the `ip` parameter. The response structure is identical to IPv4 lookups — same fields, same JSON format.

Pricing

Each successful request costs 15 credits. 10,000 free credits on signup — approximately 666 lookups at no cost.

IP WHOIS Lookup API — Organization, CIDR & Abuse Contact Data

What You Get in Every Response

Full inet_num record

Organization and contact data

Structured JSON and raw WHOIS text

Full IPv4 and IPv6 coverage

Built for These Use Cases

Abuse reporting and incident response

Netblock-level threat blocking

Fraud detection and datacenter identification

IP inventory audits and compliance

OSINT and security research

API Endpoint

How-To-Guides

Look up an IPv4 address

Look up an IPv6 address

Extract abuse contacts

Get the registered CIDR block

FAQs

What does the IP WHOIS Lookup API return?

Which registries does the API query?

Does it support IPv6?

How is this different from the IP Geolocation Lookup API?

How is this different from the ASN Lookup API?

Is the data real-time?

Pricing

Price Estimation Calculator

IP WHOIS Lookup API — Organization, CIDR & Abuse Contact Data

What You Get in Every Response

Full inet_num record

Organization and contact data

Structured JSON and raw WHOIS text

Full IPv4 and IPv6 coverage

Built for These Use Cases

Abuse reporting and incident response

Netblock-level threat blocking

Fraud detection and datacenter identification

IP inventory audits and compliance

OSINT and security research

API Endpoint

How-To-Guides

Look up an IPv4 address

Look up an IPv6 address

Extract abuse contacts

Get the registered CIDR block

FAQs

What does the IP WHOIS Lookup API return?

Which registries does the API query?

Does it support IPv6?

How is this different from the IP Geolocation Lookup API?

How is this different from the ASN Lookup API?

Is the data real-time?

Pricing

Price Estimation Calculator