Which registries does it cover?

ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC, the national registries JPNIC, KRNIC, TWNIC and IDNIC, and operators' RWHOIS servers. source says which.

Why does one address match several records?

Registries nest them: an allocation to a provider, then the blocks it assigns inside that. Every level is a row, and parent names the smallest record enclosing each, so the chain can be walked upward.

Why is a contact field empty?

Because the registry doesn't publish it. Bulk registry data leaves out what privacy rules withhold, most often a personal contact's email, and a record carries only what its holder filed.

Why is created empty on some records?

The record predates the registry keeping a creation date.

Every network record the registries publish.

The address blocks registered with the five regional registries and the national ones, a row per record at every level of nesting, with the holder, status, dates, contacts and the AS announcing it.

Request evaluation

In the lookup API: whois, on a paid plan.

Real rows, with what each column means.

See documentation →

The schema and metadata are in the docs. It is published as CSVGZ and MMDB.

start_ip	end_ip	id	name	country	status	source	abuse_email
1.1.1.0	1.1.1.255	APNIC-LABS	APNIC Research and Development	AU	ASSIGNED PORTABLE	apnic	helpdesk@apnic.net
8.8.8.0	8.8.8.255	GOGL	Google LLC		allocation	arin	network-abuse@google.com
88.198.0.0	88.198.15.255	HETZNER-RZ-NBG-NET	Hetzner Online AG	DE	ASSIGNED PA	ripe
196.216.2.0	196.216.3.255	AFRINIC	African Network Information Center - (AfriNIC) Ltd	ZA	ASSIGNED PI	afrinic	abuse@afrinic.net
2a01:4f8::	2a01:4ff:ffff:ffff:ffff:ffff:ffff:ffff	DE-HETZNER-20071010	Hetzner Online GmbH	DE	ALLOCATED-BY-RIR	ripe	abuse@hetzner.com

ip_whois_v1

Entries

12,319,709

Refresh

Daily

CSVGZ

481 MB

MMDB

717 MB

Download it from your code in one call.

Database API reference →

Every official client fetches the current IP Whois build to disk, as a link for your own runner or into memory, and checks it against its published checksums.

download()

Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.

downloadUrl()

The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.

downloadBytes()

The build in memory, for a small database or a pipeline that never touches a filesystem.

metadata()

Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.

checksums()

The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.

import os
from internetdata import InternetData
 
client = InternetData(os.environ["INTERNETDATA_API_KEY"])
 
# what is in today's build, without moving the file
meta = client.database.metadata("ip_whois_v1")
 
client.database.download("ip_whois_v1", "mmdb", "./ip_whois_v1.mmdb")
sums = client.database.checksums("ip_whois_v1", "mmdb")
print(meta.updated, meta.entries, sums["sha256"])

load.pypip install internetdata

Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

Put it to work in your own systems.

Teams join IP Whois against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.

Ownership

Name the organization a block is registered to, and the larger block it was carved from.

Contacts

Reach the abuse, admin or technical contact on record without a whois query per address.

License the full database

Sales will quote on volume, term and whether you need redistribution rights.

Checksums published per file: md5, sha1, sha256 and sha512.

The ID fixes the schema, so a new build never changes the columns your parser reads.

Samples are cut from the current build, not a synthetic extract.

Get a quote See documentation

Call the API in your language, with an official client.

All SDKs on GitHub →

Thirteen official clients, one for each language you ship in and one for the browser, plus middleware for fifteen web frameworks. Each answers private addresses without a request, caches what it looks up and splits big batches for you.

Node.js Web Python Go Java .NET PHP Ruby Rust Swift Erlang Perl Zig Express Fastify Next.js Django Flask FastAPI Laravel Symfony Rails Spring Boot ASP.NET Core net/http Gin axum Cowboy

Common questions

Read the docs →API reference →Email support →

On this page

What does a row tell us?

One network record from a registry: its netname, holder, country, status and dates, its contacts, the record that encloses it, and the AS announcing it.

00 · Unlimited

Unlimited lookups, no sign-up.

Paste it into a terminal. Any address answers with its country, network, company and hostname, with no key and no daily or monthly cap. ASes and domains answer too.

curl https://api.internetdata.io/8.8.8.8

{
  "ip": "8.8.8.8",
  "is_tor": false,
  "is_anycast": true,
  "is_dns_resolver": true,
  "location": {
    "country": "US", ...
  },
  "asn": { "asn": 15169, ... },
  "hostname": "dns.google"
}

01 · Every field

All of the data on a paid plan.

VPN, proxy, hosting and CDN flags, each naming the operator.

Location to the city, with coordinates and an accuracy radius.

WHOIS records, the whole abuse contact and the services an address runs.

Up to 1,000 addresses, ASes and domains in one request.

A free API key answers every field for its first 100 lookups each day, with no card.

See pricing Get a free API key