ARIN / IP Blocks
Which network block an IP belongs to (RDAP).
Enter a value above to run ARIN / IP Blocks
e.g. 8.8.8.8
Quick answer
ARIN / IP Blocks shows which network block an IP address belongs to via RDAP, including the assigned range, the organization that holds it, and its registration details. Use it to find who is responsible for a given IP.
This tool tells you which network block a given IPv4 or IPv6 address belongs to and who is responsible for it. It queries RDAP (Registration Data Access Protocol), the modern JSON-based replacement for WHOIS, and follows referrals to the correct Regional Internet Registry — ARIN, RIPE, APNIC, LACNIC or AFRINIC. You get the allocated CIDR range, the organization holding it, the network name, and abuse contacts. It is the quickest way to move from a raw IP in your logs to the party that actually operates that address space.
How it works
RDAP is a bootstrap protocol. IANA publishes which registry owns each address range, so a lookup starts at the correct RIR without you knowing it in advance. The tool sends an HTTPS request for the IP, and the registry returns structured JSON describing the smallest allocation containing that address. Unlike legacy WHOIS text, RDAP data is machine-readable, consistently formatted across all five RIRs, and includes standardized fields for CIDR blocks, contacts, and status.
How to read the results
The startAddress and endAddress mark the block's boundaries, usually also shown as a CIDR prefix like 203.0.113.0/24. The organization or entity name identifies the current holder — often an ISP, hosting provider, or enterprise. Look at remarks and status fields for allocation type (allocated, assigned, reserved). The abuse-c or abuse email is the address to report attacks or spam to. A parent block may cover several smaller sub-allocations, so note whether you are seeing the whole allocation or a delegated slice.
Why it matters
When you see a suspicious IP hitting your server, the raw number tells you nothing. Knowing the block reveals whether the traffic comes from a datacenter, a residential ISP, or a cloud provider — which shapes how you respond. You can block an entire abusive range instead of single IPs, verify that a claimed vendor really owns their advertised space, and send abuse reports to the correct contact instead of guessing.
Frequently asked questions
- What's the difference between ARIN and RDAP here?
- ARIN is one of five Regional Internet Registries, covering North America. RDAP is the query protocol used by all of them. The tool is named for ARIN out of familiarity, but it automatically routes each lookup to whichever registry actually manages the address — so a European or Asian IP resolves through RIPE or APNIC without extra steps.
- Why does the owner shown not match the website using the IP?
- The RDAP holder is whoever the address block is allocated to, which is frequently a hosting company or cloud provider rather than the site itself. Many customers run services on IP space owned by their infrastructure vendor. To identify the actual site, combine this with reverse DNS and a look at the domain, since the block owner is only the network operator.
- Can I trust the abuse contact for reporting?
- Generally yes — the abuse contact comes directly from the registry's authoritative record and is the address the network operator is expected to monitor. Response quality varies by provider, but it is far more reliable than guessing. For serious incidents, include timestamps in UTC, the offending IP, and relevant log lines so the operator can act quickly.