At my school there was a boy everyone called “Doctor.” Nobody remembered why. He was not a doctor and he never became one. The name stayed with him anyway.
IP tools have the same problem. Many are labelled “WHOIS” but return geolocation instead. The service ipwho.is has “whois” in its name, yet what it sends back is a location guess. The label and the data do not match.
Here is the difference, and how to tell which one you are looking at.
WHOIS: who the address is registered to
Every public IP address sits inside a block that a Regional Internet Registry (RIR) has assigned to an organisation. There are five RIRs: ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC. A WHOIS lookup asks the registry for the record of that block. It returns:
- the network name and its CIDR range
- the organisation the block is assigned to
- the country on the registration
- an abuse contact email
- the dates the record was created and last changed
- the ASN, which is the network's routing number
This data comes straight from the registry, so it is the closest thing to an official record. It does not include a person's name or home address.
The old way to read it is the WHOIS protocol on port 43, which returns plain text. The current way is RDAP, which returns the same data as JSON. Our IP WHOIS lookup uses RDAP.
Geolocation: roughly where the address is
Geolocation is a different question with a different source. Companies such as MaxMind and IP2Location build databases that map an IP address to a city, a region, and an internet provider. They build these from routing data, registry hints, and traffic they observe.
A geolocation lookup returns a city, a provider name, and sometimes map coordinates. None of it is official. The country is usually right. The city is often wrong, especially for mobile networks, VPNs, and cloud servers.
How to tell which one you are using
- If the result has a CIDR range, a network name, and an abuse contact, it is WHOIS or RDAP.
- If the result has a city, a flag, and a latitude and longitude, it is geolocation.
- If it has both, the tool ran two lookups and joined the results. That is fine, as long as the tool says so.
Why the difference matters
To report attack traffic, you need the abuse contact from the registry, not the provider name from a geolocation database. Send the report to that email, use timestamps in UTC, and attach the log lines.
To show a visitor content for their region, geolocation is the right tool. Treat the city as an estimate, and check the time zone the same way.
Two questions, two sources. A tool that calls itself “WHOIS” should be answering the first one.
Related: IP address lookup · IP to time zone · IP WHOIS tool