Skip to content

Reverse IP WHOIS

The Reverse IP Whois API provides a list of IP ranges that are owned by an Organization. You can enter an organization’s name and receive a list of all of the organization’s currently owned IP ranges.

https://api.domaintools.com/v1/reverse-ip-whois/?query=google
https://api.domaintools.com/v1/reverse-ip-whois/?ip=127.0.0.1

Reverse IP Whois Parameters

Parameters Description
ip Required for single IP result. Returns the most recent cached IP Whois record for the allocated range the IP is in.
query Required for lists of ranges. A space separated list of free text query terms. Returns the list of IP ranges that satisfy the query. The query terms have the following rules: +term: Term must be included in the results; -term: Term must not be included in the results; term*: Term as a prefix must be included in the results; No modifiers: The search performed is a phrase search. For example, if you provide a query of google inc then only results that include both terms in the order provided will be included. Search terms are case-insensitive. Search terms should be url encoded, including modifiers. E.g. + should be encoded as %2b to avoid interpretation as a space.
country Limits results to IP addresses allocated to an entity with a particular country. Valid options are ISO 3166-1 two character country codes. Default: (All country codes)
server Limits results to ranges from a particular Whois server. Valid options are whois.arin.net, whois.apnic.net, whois.ripe.net, whois.lacnic.net, or whois.afrinic.net. Default: (All whois servers)
include_total_count Returns the total number of results for a query. This should typically be used only for the first page of a large result set. Valid options are "true" and "false". Default: false
page Providing the page number allows access to additional pages of data. Results are returned 1000 ranges at a time. The maximum allowed value is 5. Default: 1
ip_version Limits the query search results to a particular IP version. If omitted, the default is to query against IPv4. Valid options are 4 or 6. Default: 4

Sample query= Response

{
  "response": {
    "has_more_pages": true,
    "page": 1,
    "total_count": 1105,
    "record_count": 1000,
    "records": [
      {
        "ip_from": "1.179.248.0",
        "ip_to": "1.179.255.255",
        "record_ip": "1.179.249.17",
        "record_date": "2015-05-15",
        "server": "whois.apnic.net",
        "organization": "Static IP address for Google-caching servers",
        "country": "TH",
        "range": "1.179.248.0/21"
      },
      {
        "ip_from": "4.3.2.0",
        "ip_to": "4.3.2.255",
        "record_ip": "4.3.2.1",
        "record_date": "2015-05-17",
        "server": "whois.arin.net",
        "organization": "Google Inc.",
        "country": "US",
        "range": "4.3.2.0/24"
      },
      ...
    ]
  }
}

Sample ip= Response

{
  "response": {
    "ip_from": "127.0.0.0",
    "ip_to": "127.255.255.255",
    "ip_from_alloc": "127.0.0.0",
    "ip_to_alloc": "127.255.255.255",
    "record_ip": "127.161.0.128",
    "record_date": "2015-05-18",
    "server": "whois.arin.net",
    "organization": "Internet Assigned Numbers Authority",
    "country": "US",
    "range": "127.0.0.0/8",
    "whois_record": "NetRange:       127.0.0.0 - 127.255.255.255
                    CIDR:           127.0.0.0/8
                    NetName:        SPECIAL-IPV4-LOOPBACK-IANA-RESERVED
                    NetHandle:      NET-127-0-0-0-1
                    Parent:          ()
                    NetType:        IANA Special Use
                    OriginAS:       
                    Organization:   Internet Assigned Numbers Authority (IANA)
                    RegDate:        
                    Updated:        2013-08-30
                    Comment:        Addresses starting with "127." are used when one program needs to talk to another program running on the same machine using the Internet 
                    Comment:        Protocol.  127.0.0.1 is the most commonly used address and is called the "loopback" address.
                    Comment:        
                    Comment:        These addresses were assigned by the IETF, the organization that develops Internet protocols, in the Standard document, RFC 1122, which can  
                    Comment:        be found here:
                    Comment:        http://datatracker.ietf.org/doc/rfc1122
                    Ref:            http://whois.arin.net/rest/net/NET-127-0-0-0-1

                    OrgName:        Internet Assigned Numbers Authority
                    OrgId:          IANA
                    Address:        12025 Waterfront Drive
                    Address:        Suite 300
                    City:           Los Angeles
                    StateProv:      CA
                    PostalCode:     90292
                    Country:        US
                    RegDate:        
                    Updated:        2012-08-31
                    Ref:            http://whois.arin.net/rest/org/IANA

                    OrgTechHandle: IANA-IP-ARIN
                    OrgTechName:   ICANN
                    OrgTechPhone:  +1-310-301-5820 
                    OrgTechEmail:  abuse@iana.org
                    OrgTechRef:    http://whois.arin.net/rest/poc/IANA-IP-ARIN

                    OrgAbuseHandle: IANA-IP-ARIN
                    OrgAbuseName:   ICANN
                    OrgAbusePhone:  +1-310-301-5820 
                    OrgAbuseEmail:  abuse@iana.org
                    OrgAbuseRef:    http://whois.arin.net/rest/poc/IANA-IP-ARIN
"
  }
}