IP WHOIS Database

Overview

Our IP WHOIS Database delivers clean, consistently parsed ownership data for any IPv4/IPv6 range, so you can verify who controls an address block, identify the right contacts, and act with confidence. Use it to harden security, speed up network troubleshooting, validate IP ownership during onboarding or investigations, and enrich tooling with reliable WHOIS insights across the global internet.

Raw WHOIS text is preserved for auditability. Delivered as Gzip-compressed JSON (one record per line), with Parquet or any custom format on request at no extra cost, backed by stable schemas and changelogs. Below, you'll find full documentation of the archive contents, schema definitions, file specifications, and integration notes to help you get up and running quickly.

Available Database Formats

JSON

File Size: 1.47 GB

Entries: 11.5M

Fields: 55

Last Updated: Today

Documentation

JSON Database Documentation

1. Overview

The JSON version of our IP WHOIS Database is delivered as a ZIP archive that includes db-ip-whois.json.gz (Gzip-compressed, newline-delimited JSON with one record per line), a README file, and a checksum file. Organization and contact details are embedded in each record, so no joins between files are needed.

2. Archive Content

After downloading and extracting the IP WHOIS JSON database archive, you'll find the following files (with their types noted):

db-ip-whois.json.gz

Newline-delimited JSON WHOIS records for IPv4 and IPv6 ranges: name, country, domain, RIR, embedded organization and contacts, and the raw WHOIS record.

File Size: 1.47 GB

Entries: 11.5M

README.md

Documentation for dataset contents, schema, usage, and support.

File Size: 5.44 KB

checksum.txt

SHA-256 checksums for verifying file integrity.

File Size: 162 Bytes

Response Schema

This section describes the structure of each record in the IP WHOIS JSON file. Each field is detailed with its type, meaning, and example values to help you parse records and integrate them into your applications.

1. db-ip-whois.json.gz

This file contains one WHOIS record per line for each IPv4 and IPv6 address range, with the organization and contacts embedded in the record. Below is an example of a single record.

2. Field Reference

The following reference lists all fields available in each JSON record. Each entry includes the field path, its description, data type, and example value to help you understand how to parse and integrate the data.

Showing 9 of 55

Select a field to view details

Field	Type	Description	Example
`range`	string	The IP range covered by the WHOIS record, as start_ip-end_ip.	1.21.6.176-1.21.6.183
`name`	string	The name associated with the IP range in the WHOIS record.	Example Network
`domain`	string	The domain name associated with the IP range in the WHOIS record.	example.com
`country`	string	The country code associated with the IP range in the WHOIS record.	US
`rir`	string	The Regional Internet Registry (RIR) that manages the IP range.	ARIN
`bgp`	string	The Border Gateway Protocol (BGP) prefix associated with the IP range.	192.168.0.0/16
`raw_whois`	string	The raw WHOIS record data associated with the IP range.	Raw WHOIS data string...
`date_updated`	string	The date when the WHOIS record for the IP range was last updated.	2023-01-15T12:00:00
`date_created`	string	The date when the WHOIS record for the IP range was created.	2020-01-01T12:00:00
`org`	object	The organization associated with the IP range.
`org.handle`	string	The handle of the WHOIS organization.	EXAMPLE-ORG
`org.name`	string	The name of the WHOIS organization.	Example Organization
`org.type`	string	The type of the WHOIS organization.	organization
`org.address`	string	The address of the WHOIS organization.	123 Example St, Example City, EX 12345, Country
`org.country`	string	The country of the WHOIS organization.	US
`org.email`	string	The email address of the WHOIS organization.	contact@example.org
`org.phone`	string	The phone number of the WHOIS organization.	+1-800-555-0123
`org.fax`	string	The fax number of the WHOIS organization.	+1-800-555-0456
`org.date_updated`	string	The date when the WHOIS organization information was last updated.	2023-01-15T12:00:00
`org.source`	string	The source of the WHOIS organization information.	ARIN
`abuse`	object	The abuse contact associated with the IP range.
`abuse.handle`	string	The WHOIS handle.	EXAMPLE-HANDLE
`abuse.name`	string	The name associated with the WHOIS handle.	John Doe
`abuse.country`	string	The country associated with the WHOIS handle.	US
`abuse.email`	string	The email address associated with the WHOIS handle.	contact@example.org
`abuse.phone`	string	The phone number associated with the WHOIS handle.	+1-800-555-0123
`abuse.fax`	string	The fax number associated with the WHOIS handle.	+1-800-555-0456
`abuse.address`	string	The physical address associated with the WHOIS handle.	123 Example St, Example City, EX 12345, Country
`abuse.date_updated`	string	The date when the WHOIS handle information was last updated.	2023-01-15T12:00:00
`abuse.source`	string	The source of the WHOIS handle information.	ARIN
`admin`	object	The administrative contact associated with the IP range.
`admin.handle`	string	The WHOIS handle.	EXAMPLE-HANDLE
`admin.name`	string	The name associated with the WHOIS handle.	John Doe
`admin.country`	string	The country associated with the WHOIS handle.	US
`admin.email`	string	The email address associated with the WHOIS handle.	contact@example.org
`admin.phone`	string	The phone number associated with the WHOIS handle.	+1-800-555-0123
`admin.fax`	string	The fax number associated with the WHOIS handle.	+1-800-555-0456
`admin.address`	string	The physical address associated with the WHOIS handle.	123 Example St, Example City, EX 12345, Country
`admin.date_updated`	string	The date when the WHOIS handle information was last updated.	2023-01-15T12:00:00
`admin.source`	string	The source of the WHOIS handle information.	ARIN
`tech`	object	The technical contact associated with the IP range.
`tech.handle`	string	The WHOIS handle.	EXAMPLE-HANDLE
`tech.name`	string	The name associated with the WHOIS handle.	John Doe
`tech.country`	string	The country associated with the WHOIS handle.	US
`tech.email`	string	The email address associated with the WHOIS handle.	contact@example.org
`tech.phone`	string	The phone number associated with the WHOIS handle.	+1-800-555-0123
`tech.fax`	string	The fax number associated with the WHOIS handle.	+1-800-555-0456
`tech.address`	string	The physical address associated with the WHOIS handle.	123 Example St, Example City, EX 12345, Country
`tech.date_updated`	string	The date when the WHOIS handle information was last updated.	2023-01-15T12:00:00
`tech.source`	string	The source of the WHOIS handle information.	ARIN
`irt`	object	The Incident Response Team (IRT) contact associated with the IP range.
`irt.handle`	string	The WHOIS handle.	EXAMPLE-HANDLE
`irt.name`	string	The name associated with the WHOIS handle.	John Doe
`irt.country`	string	The country associated with the WHOIS handle.	US
`irt.email`	string	The email address associated with the WHOIS handle.	contact@example.org
`irt.phone`	string	The phone number associated with the WHOIS handle.	+1-800-555-0123
`irt.fax`	string	The fax number associated with the WHOIS handle.	+1-800-555-0456
`irt.address`	string	The physical address associated with the WHOIS handle.	123 Example St, Example City, EX 12345, Country
`irt.date_updated`	string	The date when the WHOIS handle information was last updated.	2023-01-15T12:00:00
`irt.source`	string	The source of the WHOIS handle information.	ARIN

Database Integrity & Authenticity Verification

There are two methods of verifying the integrity and authenticity of our Database:

1. Using the Signature File (Recommended)

IPGeolocation.io signs every database release to ensure its authenticity and integrity. This allows customers to verify that a downloaded IP WHOIS database file originates directly from IPGeolocation.io and has not been altered, corrupted, or tampered with during transfer or storage.

Each database update includes a corresponding signature file, generated using our private signing key. Customers can validate the database using the provided public verification key. To verify a database file, you need:

Database file (the downloaded archive)
Signature file (the matching signature for that archive)
Public key (public-key.pem)

These files are available via official IPGeolocation.io download endpoints and are also shared in database update notifications.

Note

The public key may be provided as PEM-encoded text. Save it to a file named public-key.pem

Ensure OpenSSL is installed on your system. If not, install it using the following commands

On Linux, if openssl is not installed

sudo apt install openssl

Verify OpenSSL installation:

openssl version

To verify the database file, run the following command, replacing the placeholders with your actual file paths:

openssl dgst -sha256 -verify <path-to-public-key.pem> -signature <path-to-signature-file.sig> <path-to-database-file.zip>

Example output:

Verified OK

if verification FAILED do not use the file, re-download the database and signature from official IPGeolocation endpoints. If the issue persists, please contact our support team.

2. Using the Checksum File (Legacy)

Each database archive includes a checksum.txt file containing the SHA-256 checksums for the files packaged in the archive. You can use this file to validate that the extracted contents are complete and unchanged.

Tip

Always verify downloaded files with the provided checksum before importing.

On Linux, if sha256sum is not installed, first run:

sudo apt-get install coreutils

Then check the archive files against the checksum file with:

sha256sum -c checksum.txt

Example output:

db-ip-whois.json.gz: OK
README.md: OK

*your output may differ depending on the specific database archive you downloaded.

If a file's checksum does not match, FAILED will be shown instead of OK . If verification fails, first confirm that the download completed correctly; if the issue persists, please contact our support team.

Data Format & Constraints

The IP WHOIS JSON file is newline-delimited JSON (NDJSON): each line is one complete JSON record, so files can be streamed and processed line by line.
Files are compressed with Gzip (.json.gz) and all text values are encoded in UTF-8.
Every field defined in the schema is present in every record.
org is an object, contact fields ( admin , tech , abuse , irt ) are arrays of contact objects, and bgp is an array.
The organization, contact, BGP, and created/updated date fields are null when the registry has no data for them, so check for null before reading them. Name, country, domain, RIR, and raw WHOIS values are always strings.
The original registry response is preserved verbatim in the raw WHOIS field for auditing or custom parsing.
Field names and record structure remain stable across updates for backward compatibility.

Database Updates & Delivery

When you subscribe to our IP WHOIS database, we'll send you static download links. These links never change, so you can use them both for your initial download and for all future updates. You will receive:

Database Archive URL : downloads the latest release of your subscribed database (JSON or requested formats).
Signature File URL : downloads the matching signature file for the latest release (used for authenticity verification).
Public Key URL : downloads the public verification key (used with the signature file).
Status Endpoint URL : returns the database's most recent update timestamp.

Our databases are updated continuously and shipped on a daily or weekly cycle depending on your plan, ensuring you always have access to the most current data. Each time your subscribed dataset is updated, you'll also receive an email notification so you don't miss a release.

For automated workflows, you can check our status endpoint to see the last update timestamp. When the date changes, simply re-fetch the archive using your static download URL to pull the latest version into your system.