API Documentation

Reverse IP Whois

Overview

The DomainTools API is organized into distinct products with queries that follow a RESTful URL structure wherever possible. Each product offers free, un-authenticated access for the sample URLs listed with each product. If you haven’t already, you may want to review the getting started document to learn about authentication and response formats.

The Reverse IP Whois API provides a list of IP ranges that are owned by an Organization. You can enter an organization’s name and receive a list of all of the organization’s currently owned IP ranges.

https://api.domaintools.com/v1/reverse-ip-whois/?query=google
https://api.domaintools.com/v1/reverse-ip-whois/?ip=127.0.0.1

Reverse IP Whois Parameters

Parameters Description
ip Required for single IP result.
Returns the most recent cached IP Whois record for the allocated range the IP is in.
query Required for lists of ranges.
A space separated list of free text query terms. Returns the list of IP ranges that satisfy the query. The query terms have the following rules:

+term: Term must be included in the results.
-term: Term must not be included in the results.
term*: Term as a prefix must be included in the results.
No modifiers: The search performed is a phrase search.

For example, if you provide a query of “google inc” then only results that include both terms in the order provided will be included. Search terms are case-insensitive. Search terms should be urlencoded, including modifiers. E.g. + should be encoded as %2b to avoid interpretation as a space.

country Limits results to IP addresses allocated to an entity with a particular country. Valid options are ISO 3166-1 two character country codes.
Default: (All country codes)
server Limits results to ranges from a particular Whois server. Valid options are “whois.arin.net”, “whois.apnic.net”, “whois.ripe.net”, “whois.lacnic.net”, or “whois.afrinic.net”.
Default: (All whois servers)
include_total_count Returns the total number of results for a query. This should typically be used only for the first page of a large result set. Valid options are “true” and “false”.
Default: false
page Providing the page number allows access to additional pages of data. Results are returned 1000 ranges at a time. The maximum allowed value is 5.
Default: 1
ip_version Limits the query search results to a particular IP version. If omitted, the default is to query against IPv4. Valid options are 4 or 6.
Default: 4

Sample “query=” Response:

{
  "response": {
    "has_more_pages": true,
    "page": 1,
    "total_count": 1105,
    "record_count": 1000,
    "records": [
      {
        "ip_from": "1.179.248.0",
        "ip_to": "1.179.255.255",
        "record_ip": "1.179.249.17",
        "record_date": "2015-05-15",
        "server": "whois.apnic.net",
        "organization": "Static IP address for Google-caching servers",
        "country": "TH",
        "range": "1.179.248.0/21"
      },
      {
        "ip_from": "4.3.2.0",
        "ip_to": "4.3.2.255",
        "record_ip": "4.3.2.1",
        "record_date": "2015-05-17",
        "server": "whois.arin.net",
        "organization": "Google Inc.",
        "country": "US",
        "range": "4.3.2.0/24"
      },
      ...
    ]
  }
}

Sample “ip=” Response:

{
  "response": {
    "ip_from": "127.0.0.0",
    "ip_to": "127.255.255.255",
    "ip_from_alloc": "127.0.0.0",
    "ip_to_alloc": "127.255.255.255",
    "record_ip": "127.161.0.128",
    "record_date": "2015-05-18",
    "server": "whois.arin.net",
    "organization": "Internet Assigned Numbers Authority",
    "country": "US",
    "range": "127.0.0.0/8",
    "whois_record": "NetRange:       127.0.0.0 - 127.255.255.255
CIDR:           127.0.0.0/8
NetName:        SPECIAL-IPV4-LOOPBACK-IANA-RESERVED
NetHandle:      NET-127-0-0-0-1
Parent:          ()
NetType:        IANA Special Use
OriginAS:       
Organization:   Internet Assigned Numbers Authority (IANA)
RegDate:        
Updated:        2013-08-30
Comment:        Addresses starting with "127." are used when one program needs to talk to another program running on the same machine using the Internet 
Comment:        Protocol.  127.0.0.1 is the most commonly used address and is called the "loopback" address.
Comment:        
Comment:        These addresses were assigned by the IETF, the organization that develops Internet protocols, in the Standard document, RFC 1122, which can  
Comment:        be found here:
Comment:        http://datatracker.ietf.org/doc/rfc1122
Ref:            http://whois.arin.net/rest/net/NET-127-0-0-0-1

OrgName:        Internet Assigned Numbers Authority
OrgId:          IANA
Address:        12025 Waterfront Drive
Address:        Suite 300
City:           Los Angeles
StateProv:      CA
PostalCode:     90292
Country:        US
RegDate:        
Updated:        2012-08-31
Ref:            http://whois.arin.net/rest/org/IANA

OrgTechHandle: IANA-IP-ARIN
OrgTechName:   ICANN
OrgTechPhone:  +1-310-301-5820 
OrgTechEmail:  [email protected]
OrgTechRef:    http://whois.arin.net/rest/poc/IANA-IP-ARIN

OrgAbuseHandle: IANA-IP-ARIN
OrgAbuseName:   ICANN
OrgAbusePhone:  +1-310-301-5820 
OrgAbuseEmail:  [email protected]
OrgAbuseRef:    http://whois.arin.net/rest/poc/IANA-IP-ARIN
"
  }
}

You must provide your
API credentials
to use this API.

General Information
Products