How to Read a WHOIS Report - Step by Step

Ever looked up an IP address on our WHOIS tool and landed on a block of text full of unfamiliar fields - NetRange, OrgName, abuse-mailbox? WHOIS is an old protocol, but it's still the standard way to find out who owns and manages a block of IP addresses.

What WHOIS actually is

Every block of IP addresses in the world is allocated by a regional registry (RIPE NCC for Europe, ARIN for North America, APNIC for Asia-Pacific, LACNIC for Latin America, AFRINIC for Africa). These registries maintain public databases - queryable through the WHOIS protocol - with information about who owns each block.

The main fields, explained

NetRange / inetnum - the range of IP addresses allocated (e.g. 82.77.0.0 - 82.77.255.255) or CIDR notation (82.77.0.0/16).
OrgName / org-name - the organization the block is allocated to. Usually an ISP, hosting company, or institution.
NetName / netname - a short, internal label given to the network block (more useful for technical identification than for a reader).
Country - the country associated with the allocation - note this doesn't guarantee the server is physically located there, only that the block was registered there.
abuse-mailbox / OrgAbuseEmail - the most important field if you're reporting abuse (spam, attacks, suspicious activity): the address to contact the network's administrator.
RegDate / created - the date the block was first registered.

A practical example

Say you're getting suspicious traffic from an IP address and want to report abuse. You look up the IP on WHOIS, find OrgName: Example Hosting SRL and abuse-mailbox: abuse@example-hosting.ro. That's the correct contact - not the company's general support line, but the team dedicated specifically to abuse reports.

What WHOIS doesn't tell you

WHOIS shows you who owns the block of addresses, not who's currently using a specific one. An IP from a hosting block could be used by any of that provider's customers - WHOIS doesn't go down to that level of detail, for obvious privacy reasons.

For additional context about an address - ISP, connection type, VPN/Tor indicators - combine the WHOIS report with a full IP lookup, which adds geolocation and ASN data on top of the raw WHOIS information.

Raw vs. parsed

Most WHOIS tools (including ours) offer a "parsed" view - fields extracted and labeled - and a "raw" one, the original text returned by the server. The raw version is useful when you need a less common field that the parsed interface doesn't display explicitly.