whois reverse ip - Page 1
Forum section: electronics / general

author: PlainName
author_rank: Super Contributor
timestamp: September 12, 2025, 09:11:11 am
content: Periodically I need to look up what block an IP address is, and I used to use a a DNS server (SimpleDNS). Give it in IP and it would return the whois info along with the address block. But whois has been killed off apparently and now all I get is the entire country allocation or something. Nothing useful.But... there are websites that can still return the desired info, although many of them are borked too, so it must still be possible. Any idea if there is a standalone tool available to do this?For ref, today I needed to look up 83.105.109.105 and normal whois returns:Code:NetRange: 83.0.0.0 - 83.255.255.255CIDR: 83.0.0.0/8NetName: 83-RIPENetHandle: NET-83-0-0-0-1Parent: ()NetType: Allocated to RIPE NCCOriginAS:Organization: RIPE Network Coordination Centre (RIPE)RegDate: 2003-11-17Updated: 2025-02-10Comment: These addresses have been further assigned to users in the RIPE NCC region. Please note that the organization and point of contact details listed below are those of the RIPE NCC not the current address holder. ** You can find user contact information for the current address holder in the RIPE database at http://www.ripe.net/whois.Ref: https://rdap.arin.net/registry/ip/83.0.0.0What I actually need, and could get from whois.domaintools.com, is:Code:inetnum: 83.105.96.0 - 83.105.127.255netname: VODAFONE-DYN-IPdescr: Dynamic IP Addressesdescr: Vodafone Consumer Broadbandcountry: GBadmin-c: GSOC-RIPEtech-c: GSOC-RIPEstatus: ASSIGNED PAmnt-by: VODAFONE-UK-MNTNERcreated: 2024-08-14T16:27:04Zlast-modified: 2024-08-14T16:27:04Zsource: RIPEAnd from that I can see that I need to be entering "83.105.109.105/19".

author: bitwelder
author_rank: Super Contributor
timestamp: September 15, 2025, 09:07:03 am
content: From my trusty Ubuntu 20.04 workstation, if I issue the command "whois 83.105.109.105" I already get the expected answer:Code:$ whois 83.105.109.105% This is the RIPE Database query service.% The objects are in RPSL format.%% The RIPE Database is subject to Terms and Conditions.% See https://docs.db.ripe.net/terms-conditions.html% Note: this output has been filtered.% To receive output for a database update, use the "-B" flag.% Information related to '83.105.96.0 - 83.105.127.255'% Abuse contact for '83.105.96.0 - 83.105.127.255' is 'ipabuse@vodafone.co.uk'inetnum: 83.105.96.0 - 83.105.127.255netname: VODAFONE-DYN-IPdescr: Dynamic IP Addressesdescr: Vodafone Consumer Broadbandcountry: GBadmin-c: GSOC-RIPEtech-c: GSOC-RIPEstatus: ASSIGNED PAmnt-by: VODAFONE-UK-MNTNERcreated: 2024-08-14T16:27:04Zlast-modified: 2024-08-14T16:27:04Zsource: RIPErole: Vodafone IP GSOCaddress: Vodafone Group PLCaddress: The Connectionaddress: Newburyaddress: RG14 2FNaddress: United Kingdomphone: +44 1344 602224remarks: ------------------------------------------------------------remarks: For network issues contact Network Control phoneremarks: +44 1344 602224, email ncipsupport@vodafone.comremarks: ------------------------------------------------------------remarks: To report spam or network abuse email ipabuse@vodafone.co.ukremarks: ------------------------------------------------------------remarks: For more details please see http://www.as1273.netremarks: or refer to AS1273 object in the RIPE databaseremarks: ------------------------------------------------------------admin-c: VE1405-RIPEtech-c: VE1405-RIPEabuse-mailbox: ipabuse@vodafone.co.uknic-hdl: GSOC-RIPEmnt-by: CW-EUROPE-GSOCcreated: 2002-08-26T15:06:10Zlast-modified: 2025-05-22T05:43:29Zsource: RIPE # Filtered% Information related to '83.105.96.0/19AS5378'route: 83.105.96.0/19descr: Vodafone BBorigin: AS5378mnt-by: CW-EUROPE-GSOCcreated: 2024-07-18T09:56:16Zlast-modified: 2024-07-18T09:56:16Zsource: RIPE% This query was served by the RIPE Database Query Service version 1.118.1 (SHETLAND)

author: kite31
author_rank: Regular Contributor
timestamp: September 15, 2025, 09:58:20 am
content: Same success on MacOS 15 and FreeBSD 14, while Ubuntu 24.04 offers installation of whois and Debian 12 says unknown. I have no Windows nor solutions for it.

author: paulca
author_rank: Super Contributor
timestamp: September 15, 2025, 12:39:40 pm
content: The tool you want is dig.infoblox-prk-grid01.ipam.cw.net. hostmaster.demon.net.Of course that tells you who admins the IP or specifically the public DNS records.root@kea:~# dig -x 83.105.109.105; <<>> DiG 9.18.12-0ubuntu0.22.04.3-Ubuntu <<>> -x 83.105.109.105;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 30977;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 1232; COOKIE: a91d33550b6ad9950100000068c808299e32597b5548ee1e (good);; QUESTION SECTION:;105.109.105.83.in-addr.arpa. IN PTR;; AUTHORITY SECTION:109.105.83.in-addr.arpa. 872 IN SOA infoblox-prk-grid01.ipam.cw.net. hostmaster.demon.net. 2017121104 10800 3600 2419200 900;; Query time: 0 msec;; SERVER: 10.1.0.2#53(10.1.0.2) (UDP);; WHEN: Mon Sep 15 12:35:53 UTC 2025;; MSG SIZE rcvd: 171

author: PlainName
author_rank: Super Contributor
timestamp: September 15, 2025, 12:48:19 pm
content: QuoteThanks (and to everyone else). That prompted me to ask what whois server your system queries, but before doing that I changed the one used here to whois.ripe.net (it was previously automatic and chose arin) and now I get the info. Don't know why it stopped working after many years of faultless operation, but there we go.

author: madires
author_rank: Super Contributor
timestamp: September 15, 2025, 01:36:45 pm
content: Based on the RIR you have to set the whois server, e.g.:whois <IP address> -h whois.ripe.netThe default server is usually whois.arin.net. In your case whois.arin.net responds with the hint that the address space is managed by RIPE. Therefore you should ask whois.ripe.net for the details.

author: madires
author_rank: Super Contributor
timestamp: September 15, 2025, 01:43:17 pm
content: Quote from: bitwelder on September 15, 2025, 09:07:03 am... because your whois client asked whois.ripe.net.

author: PlainName
author_rank: Super Contributor
timestamp: September 15, 2025, 03:40:10 pm
content: Quote from: madires on September 15, 2025, 01:36:45 pmThat should be done automatically by the whois client. Don't know why it's stopped that - perhaps the format of the reply has changed.

author: madires
author_rank: Super Contributor
timestamp: September 15, 2025, 03:52:39 pm
content: Some do, some don't. And sometimes the smarter clients fail to determine the right whois server.