Current IP allocation state, in one call.
Pass an IP address. Get back the current registration record: allocation, organization, ASN, country, abuse contact, and Whois server reference.
The full IP Whois record, raw and parsed.
The IP Whois Lookup API returns the registration record for an IP address right now: allocation block, organization, autonomous system, country, abuse contact, and Whois server reference. Both the raw RIR response and a parsed structured form are returned in the same call.
The parsed object exposes the fields most workflows need without forcing you to write a per-RIR Whois parser. The raw block is preserved for cases where the parsed view loses signal that matters to you.
Use this when an IP surfaces in incident telemetry, in firewall logs, or in any artifact where you need to know who allocated the address and which provider currently announces it.
One endpoint, one parameter.
Endpoint:
GET https://api.deepinfo.com/v1/lookup/ip-whois?ip={ip}Parameters:
Authentication is by API token in the request header. See docs.deepinfo.com for the full request reference.
See what the API returns.
Real response structure for the Current IP allocation state, in one call endpoint. Field coverage may vary based on query parameters and data availability.
{
"ip": "8.8.8.8",
"ipwhois": {
"raw": "NetRange: 8.8.8.0 - 8.8.8.255
OrgName: Google LLC
OrgId: GOGL
...",
"parsed": {
"net_range": "8.8.8.0 - 8.8.8.255",
"cidr": "8.8.8.0/24",
"organization": "Google LLC",
"country": "US",
"asn": "AS15169",
"asn_description": "GOOGLE",
"abuse_email": "[email protected]",
"registry": "ARIN"
}
},
"check_date": "2026-05-02T08:30:11Z"
}Sample response shown. Real responses depend on query parameters, data availability, and API version. Talk to us for full schema documentation.
Workflows this API plugs into directly.
Incident Investigation and Response
Resolve allocation, ASN, and abuse contact for any IP surfaced in telemetry.
Read the use caseThreat Hunting
Cluster adversary infrastructure by ASN or organization.
Read the use caseAttack Surface Management
Verify ownership of IP space pointing to your hostnames.
Read the use case“Allocation, ASN, and abuse contact in one shot drives our IP-attribution pipeline for inbound threat events. The single-call shape replaced three RIR-specific lookups that returned inconsistent payloads.”
Other lookup APIs.
Current Whois state for any domain, in one call.
The Whois Lookup API returns the registration record for a domain right now: registrar, dates, registrant, name servers, and status codes.
See API APICurrent DNS state for an FQDN, in one call.
Pass an FQDN and one or more record types.
See API APICurrent TLS state for a host, in one call.
Pass a domain or IP.
See API APIFind every domain on an MX record.
Pass an MX record value.
See API APIFind every domain on a name server.
Pass a name server hostname.
See API APIFind every domain on an IP.
Pass an IP address or CIDR.
See API APICapture a target page as the user sees it.
Pass a URL.
See API APIDetect the technology stack of a target, in one call.
Pass a URL.
See API APILive web-page data for a target, in one call.
Pass a URL.
See API APIScan a target's open ports, in one call.
Pass a target.
See APIRun a sample call, or batch lookup your IP set.
We'll set up token access and answer schema questions on a call.