September 3, 2026
WHOIS vs RDAP: Who Owns This IP, Prefix, or ASN?
Registration is a document. Routing is a behavior. People still say “WHOIS this IP” when they mean both. The modern protocol for the document is RDAP. The behavior still lives in BGP. You need the two side by side or you will accuse the wrong network of hosting the wrong crime.
Why classic WHOIS feels broken
Port 43 WHOIS grew up as a pile of text dialects. Each Regional Internet Registry invented field names. Rate limits, privacy redaction, and referrals made scripts fragile. RDAP (Registration Data Access Protocol) answers the same operational questions over HTTPS with JSON: what object is this, who is the registrant in policy terms, what are the abuse contacts, when was it last changed, and where should you look next.
On bgplookup.io WHOIS you are using that modern path for domain, IP, prefix, and ASN records across RIRs — ARIN, RIPE NCC, APNIC, AFRINIC, LACNIC — rather than scraping a banner.
What an IP or prefix record is good for
- Organization name — the entity the RIR believes holds the allocation or assignment.
- Parent and children — a /12 may be sliced into /20s given to customers. Abuse mail goes to the most specific useful contact, not always the RIR.
- Abuse and tech contacts — still the correct first email during an incident, even when marketing sites pretend otherwise.
- Registration dates — useful when a prefix is brand new and already in a spam report.
What it is not: proof of current packet origin. Space can be leased, announced by a transit provider, or stolen in the table while the RIR object stays untouched for months.
What an ASN record is good for
An ASN object tells you who is supposed to speak BGP as that number: name, source RIR, sometimes a remark about peering policy. Pair it with a live BGP Lookup. If AS64500 is registered to a regional ISP but currently originates a cloud gaming /24 from another continent, you are looking at either anycast, a customer, or a problem.
The comparison that actually closes tickets
| RDAP says | BGP says | Read it as |
|---|---|---|
| Bank Ltd, US | Same org’s ASN | Normal |
| Bank Ltd, US | Unknown hosting ASN | Hijack, leak, or undocumented lease — investigate |
| Hosting LLC | Same hosting ASN | Normal; abuse the host, not a random ISP |
| Redacted / personal | Tiny ASN, one prefix | Hobby or small business; still write abuse@ |
Domains are a third namespace
A domain RDAP record points at a registrar and registrant policy, not at an ASN. After you have the name servers and published A/AAAA records, those addresses go back into IP Lookup. Phishing domains often sit on bulletproof or abused cloud prefixes. The domain privacy flag does not hide the origin ASN of the web server.
Privacy redaction is not a wall
GDPR-era redaction hides people. It does not hide the prefix, the ASN, or the org in most number-resource records. You can still find an abuse mailbox. You can still see whether space belongs to a national ISP or a shell. Do not stop an investigation because a person’s name is missing.
Operational etiquette
RIR databases are not a marketing list. Use contacts for abuse, routing incidents, and legitimate research. Include prefix, timestamp, looking-glass evidence, and a packet sample description. “Your IP is bad” gets ignored. “Your /24 originated from ASX at 14:02 UTC, RPKI invalid, here are two paths” gets a human.
Do both lookups: registration on WHOIS / RDAP, then live origin on IP Lookup.
FAQ
FAQ
Is WHOIS dead?
The port-43 habit is dying. The need for registration data is not. RDAP is the supported way to get it.
Why does geo say one country and RDAP another?
Geolocation databases guess from whois, latency, and politics. They are not authority. Prefer RIR region plus origin ASN.
Can I see historical owners?
Sometimes through RIR logs or commercial history products. Live RDAP is the current document, not an archive of every lease.