WHOIS IP v6 Lookup: Find the IPv6 Network Owner

A WHOIS IP v6 lookup shows which organization a public IPv6 address range is registered to, often an ISP, cloud provider, or business. It does not identify the person using an address or pinpoint their home. Keep reading to learn how to check the authoritative record and make sense of location data.

How to run a WHOIS IP v6 lookup

IPv6 is the Internet Protocol version with 128-bit addresses, usually written as hexadecimal groups separated by colons. Providers receive these long addresses in ranges called prefixes. For a quick view of the ISP, ASN, approximate location, and reverse DNS, start with Loqmi’s IP lookup. A WHOIS or RDAP search matches the address to its network prefix and returns the public registration record.

The Internet Assigned Numbers Authority (IANA) coordinates top-level number resources and delegates address ranges to five Regional Internet Registries (RIRs): ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC. Each RIR records allocations and assignments in its region. An RDAP lookup uses IANA's bootstrap data to find the registry that is authoritative for a given address. RFC 9224 describes how that matching works. Read RFC 9224.

WHOIS is the older query protocol. RDAP is its newer, standardized replacement, and it returns registration data in a structured format. Both can lead you to registry information, but the result describes an allocated network, not a live list of every device on it. (The registry works like a filing cabinet: it knows who owns the drawer, not who is sitting at the desk.)

What an IPv6 lookup can tell you

For a public address, the record may show the prefix or range, the registered organization, a network name, registration dates, contacts, and an abuse-reporting contact. It may also list an Autonomous System Number (ASN), which identifies a network that exchanges routing information with other networks. A quick ISP number lookup can help you find the provider operating a range. The name may still belong to a parent company, a hosting provider, or the organization that assigned the range onward.

Look for the most specific matching network object and note its prefix. A large organization can receive a broad block and delegate smaller blocks to customers or internal networks. WHOIS tools sometimes show both the parent record and a more specific record, much like a building directory that lists both the property owner and the tenant.

To look up an ISP, compare the registry's organization and network name with the ASN's operator. Together they identify the network carrying traffic, though not always your retail provider. The visible operator may instead be a VPN, content delivery network (CDN), mobile carrier, or cloud platform.

An ASN is a routing label for a network. It tells you which network announces a route, but it says nothing about the person behind a single packet.

Steps to find the network owner

1. Get the exact address. If you are checking your own connection, open Loqmi's IP checker and copy the public IPv6 address it reports. If the address comes from a log, copy only the address and remove any brackets, commas, or port number.
2. Run a registration lookup. Paste the address into an IP WHOIS or RDAP search. A registry accepts an address directly, and a lookup service should route it to the right RIR. For example, ARIN's Whois/RDAP search accepts IPv6 addresses, while the APNIC search guide explains queries for IPv6 network objects.
3. Read the range and holder together. Record the network prefix, organization, ASN if one is shown, and abuse contact. If a third-party summary looks wrong, follow any referral or link to the RIR's record and check it there.
4. Use other data for other questions. If you want to know where the connection appears to be, compare an IP geolocation result separately. To check whether a VPN changes the address that websites see, compare your result before and after connecting with this VPN check.

Read the prefix, not just the name

Address ranges are usually written in Classless Inter-Domain Routing (CIDR) notation: an address, a slash, and a prefix length. For example, 2001:db8:1234::/48 is a range that shares its first 48 bits. That example sits in the documentation range, so it is good for learning the format but is not a live ISP allocation. IPv6's 128-bit address format makes those prefixes far larger than familiar IPv4 ranges.

A provider may delegate an IPv6 prefix to your router using DHCPv6 (Dynamic Host Configuration Protocol for IPv6); devices can also form addresses through SLAAC (Stateless Address Autoconfiguration). Temporary interface addresses can change while the provider's broader registered prefix stays put. So a record can name the same ISP even after your device's full address changes. RFC 8415 covers DHCPv6 and prefix delegation.

This matters when you try to find an IP address owner. The organization on a parent prefix may be the upstream ISP, while a more specific record names a customer network. If a lookup shows an RIR itself, follow the registry's link or referral. IANA coordinates assignments but is usually not the ISP running the connection. Use the result to reach the responsible network contact. It will not give you a person's name.

WHOIS location is not device location

WHOIS and RDAP record registration details. IP geolocation is an estimate built from other information, including network-published data and commercial databases. A country or city on a registration record may point to an organization's office or to where a block was registered. It does not say where a phone or computer is sitting. (Yes, the registry may know the country. No, it does not know which chair you are in.) ARIN states that it does not maintain IP geolocation data and cannot guarantee that a resource record's address is the network's physical location. See ARIN's explanation.

Some network operators publish coarse geolocation feeds so services can update their estimates. RFC 8805 describes one format. That is one reason an IP WHOIS location and an IP location database can disagree, and neither one is a street-level truth. For more context, see why an IP location can be wrong and what someone can infer from your IP.

Addresses that won't have a public owner

Not every IPv6 address is publicly reachable. An address beginning fe80:: is link-local, which means it only works on the nearby network segment. Addresses in fc00::/7 are Unique Local Addresses (ULAs), meant for private internal use. IANA's special-purpose registry lists these ranges and their reachability limits. Check the current IPv6 registry.

RFC 1918 defines private-use space for IPv4, such as common home-network addresses. It does not define IPv6's local ranges. Network Address Translation (NAT) often lets many devices share one public IPv4 address, so a public lookup sees the shared gateway. IPv6 works differently, but a device can still have a non-public local address, and its ISP may change or delegate prefixes. (More digits do not make an address a name tag.) See public versus private IP addresses.

If there is no result, check for a typo and confirm that the address is not link-local, unique-local, or documentation space. If it is public, follow the registry link to the most specific record. For abuse concerns, send the address and relevant timestamped logs to the listed abuse contact or the affected service. A lookup does not identify a person.