WHOIS lookup for IP address

This section tells you how to perform a WHOIS search for an IP address.

To perform a WHOIS lookup for an IP address:

  1. Open the WHOIS Lookup page (WHOIS Tracking (WHOIS icon.) → WHOIS Lookup), and then select the IP address tab.

    Required and optional fields will be displayed.

  2. Fill in at least one of the required fields:
    • IP address—IP address or a range of IP addresses you want to investigate.
    • Organization—Name, email address of the organization or person, or net description. The search is word-based and case-insensitive. You can search for a phrase by putting your search terms (the entire string) in quotes that the IP address belongs to.
    • ASN—Autonomous system number.
  3. If necessary, in the Advanced options section, specify the following fields:
    • Country—Country where the IP address is located.

      Use a two-letter country code (ISO 3166-1 alpha-2 standard).

    • Resolution date (range)—Period of time when the IP address was last resolved.
    • Contract created date (range)—Creation date of the organization that the IP address belongs to.
    • Contract updated date (range)—Period of time when WHOIS information about the organization the IP address belongs to was updated.
  4. Click the Search button.

    Kaspersky Threat Intelligence Portal will display available results.

  5. If necessary, in the History table, click the Resend request button to repeat the WHOIS lookup search.

If more than 1000 results are available, Kaspersky Threat Intelligence Portal will ask you to narrow your search by filling in more fields and/or using date pickers.

Page top