WHOIS
The public registration record system that says who holds an IP address or domain, and the raw source behind every ownership lookup in this glossary.
Half of this glossary keeps saying that address ownership is public information anyone can query. WHOIS is the thing being queried. It is the registration record system of the internet: for every allocated block of IP addresses, a record of which organisation holds it, the range it belongs to, and a contact for abuse reports, published by the registries that did the allocating.
For IP addresses the chain of custody is short and fully public. IANA delegated the address space to five regional registries, ARIN for North America, RIPE NCC for Europe, APNIC, LACNIC and AFRINIC for their regions, and each publishes the records for the space it manages. Ask about any address and the answer names the holder of its range, which is how one cheap query turns a bare number into 'a Hetzner range' or 'Vodafone consumer space', the classification everything else in proxy detection builds on.
The protocol itself is charmingly ancient, a plain-text question and answer on port 43 with no standard record format, which is why its replacement exists. RDAP, standardised in RFC 7480, serves the same registration data as structured JSON over HTTPS, with proper internationalisation and rate limiting. The registries all run it, tooling increasingly prefers it, and the word WHOIS survives as the name for the activity regardless of which protocol performs it.
One asymmetry is worth knowing because it confuses people who have only met the domain side. Domain WHOIS became heavily redacted after 2018, when privacy law pushed registrars to withhold the personal details of individual registrants, so a domain lookup now usually returns a privacy service instead of a person. IP WHOIS was never about individuals: the records describe organisations holding address space, there is nothing personal to redact, and the data remains as open as ever. Ownership of ranges is public by design, because routing disputes and abuse handling depend on it.
What it cannot tell you matters as much. The record names the organisation that HOLDS the range, not who is using an address right now, and it lags reality when ranges are transferred, leased or repurposed. An address can be registered to a consumer provider and currently rented out through a proxy network, and the record will not say so. WHOIS gives you provenance, not behaviour, which is why reputation systems layer history on top of it rather than trusting the paperwork alone.
How HProxy handles it
The ownership and range facts on our IP pages come from this registration data, surfaced per address because it is the first thing any destination reads about you. We pair it with measured behaviour precisely because the paperwork says who holds a range and nothing about what is currently exiting through it.
Frequently asked questions
How do I do a WHOIS lookup on an IP address?
Any IP lookup site returns the registration record, command-line users have the whois tool, and every regional registry offers a web query. The answer names the organisation holding the range, the range boundaries, and an abuse contact. Our own IP lookup surfaces the same ownership data alongside measured facts about the address.
What is the difference between WHOIS and RDAP?
Same data, different plumbing. WHOIS is the original plain-text protocol on port 43, with free-form records that every registry formats differently. RDAP is its standardised successor, defined in RFC 7480, serving the identical registration data as structured JSON over HTTPS. Registries run both, and the older name persists as the word for the lookup itself.
Why do domain WHOIS results show a privacy service instead of an owner?
Privacy regulation, principally since 2018, pushed registrars to redact personal details of individual domain registrants, so lookups return a proxy contact instead. IP address records are unaffected: they describe organisations holding address space rather than private individuals, so there was never personal data to withhold, and range ownership remains fully public.
Can WHOIS tell me if an address is a proxy?
Not directly. It tells you who holds the range, which supports the inference: hosting-company space is where datacenter proxies live, consumer space is where residential exits live. Whether a specific address is currently relaying traffic is behaviour, not registration, and the record also lags transfers and leasing. Treat it as provenance evidence, one input rather than a verdict.
Back to the full glossary.