How much a WHOIS record actually proves
Ask a registry who holds a block and this is what comes back: the allocation it sits in, the organization on file, contacts for administrative and technical questions, and the date somebody last touched the record.
That makes it the strongest evidence anyone has about a block. It is also thinner than most people expect, in three fairly specific ways.
The name on the record may not be the network you want
Providers hand out /24s to customers constantly and leave their own name on the record. The organization you are looking at could be several steps removed from whoever actually announces those addresses: an upstream, a parent company, a hosting brand that got rebranded in 2019.
It proves nothing whatsoever about routing
No part of a WHOIS record stops another network announcing the space. If what you need to know is whether an announcement is legitimate, the answer lives in RPKI and in IRR route objects, which are separate systems with separate records. Our lookup tool checks both →
Expect the contacts to be dead ends
Registries do require contacts to be kept current. Enforcement varies a great deal, and finding an address for someone who left the company in 2014 is entirely normal. If you are trying to report abuse, plan on needing a second way in.
Common questions
Who owns this IP address?
Nobody, strictly speaking. Address space is not property. What you are looking at is the organization the space is registered to, which amounts to a right to use it under the registry's rules. More on what that means →
Why does the record show a different company than I expected?
Two likely explanations. Either the block is a sub-allocation and you are seeing the parent holder, or it changed hands and nobody has updated the record yet.
Can I hide my organization from WHOIS?
Not for address space, no. Registries publish holder information as a matter of policy, and a block nobody can trace is one other networks are entitled to view with suspicion.