If you are experiencing harassment or other harmful activity from an IP address then you should report it and when appropriate partner with law enforcement. It is important to remember that sometimes IP addresses are being used to conduct harmful activity without the owners knowledge.

1. Retrieve the IP address from the logs / headers
2. Use the IP WHOIS Lookup tool to retrieve the WHOIS data for the IP
3. Report the behavior of the IP to the "OrgAbuseEmail" or "OrgAbusePhone"

Each WHOIS lookup will return information about each IP address. The amount of details returned depend on what was made available when the IP was registered. Common fields returned are:

• Organization: The organization or company who owns the IP address
• Organization address: The mailing address of the organization who owns the IP address
• Organization phone number: The phone number of the organization that owns the IP address
• Abuse mailing address: The mailing address that abuse reports should be mailed to
• Abuse email address: The email address that abuse reports should be emailed
• Technical email address: The email address where technical information regarding the IP address should be sent
• Technical phone number: The phone number that should be used to contact the organization regarding technical matters

The data supplied from an IP WHOIS can largely be broken down into business (organization), abuse, and technical contacts. It's important to understand which contact you should use so that your inquiries are properly handled. We especially recommend taking note of the abuse contact email and phone number as this is useful for situations when IPs are used for harmful purposes.

WHOIS literally stands for "who is" and is not a acronym. WHOIS is a protocol used to query ownership information for domains and IP addresses. WHOIS lookups are especially useful because they provide information on the person or organization that registered the IP address. In many cases the organization tied to the IP address is the Internet Service Provider (ISP) that assigned the IP address to the user.

When you execute a WHOIS lookup you are requesting information form a RIR about an IP address. IPSearch.io specifically performs WHOIS inquiries using whois.arin.net:43.

IP addresses are manage by five regional Regional Internet Registries or RIRs for short. These RIRs are given blocks of IPs by Internet Assigned Numbers Authority (IANA) and they assigned them to ISPs and other companies based on need.

The five RIRs are as follows:

• ARIN (American Registry for Internet Numbers)
• RIPE NCC (Réseaux IP Européens Network Coordination Centre)
• APNIC (Asia-Pacific Network Information Centre)
• LACNIC (Latin America and Caribbean Network Information Centre)
• AFRINIC (African Network Information Centre)

You can read more about about IP governance in our article on IP Address Governance and Allocation