Registrars know who registered it.
We know who's routing it.
Prefix WhoIs answers whois-shaped questions from the Internet's live global BGP table — the most-specific prefix currently advertised for an address, the autonomous system announcing it, the AS path our peers observe, and when that route first appeared, plus other useful attributes. Sourced from actual routing, not paperwork. We also include the registry details thanks to our longstanding relationships with every regional Internet registry, making Prefix WhoIs one of the best sources of near-real-time network information available globally.
$ whob -v 8.8.8.8 connecting to whois.pwhois.org [43/tcp] ... IP: 8.8.8.8 Origin-AS: 15169 Prefix: 8.8.8.0/24 AS-Path: 8220 15169 AS-Org-Name: Google LLC Net-Name: GOGL Country-Code: US // answered from the live global routing table
Real data, not opinions.
Who announces it
The origin AS advertising the covering prefix right now, plus the AS path our peers see in front of it.
Origin-ASAS-PathAS-Org-NameExactly which block
The most-specific advertised prefix covering the address — a /24 carve-out never hides inside its /16 parent — with the network and organization registered for it.
PrefixNet-NameOrg-NameHow old the truth is
When the cache was built and when this AS first originated the prefix. A route that appeared last week and is already sending you traffic is a finding.
Cache-DateRoute-Originated-DateA filing versus a fact.
A registry record is a filing: it says who was allocated an address block, by whom, and when someone last remembered to update it. A BGP announcement is a fact: it says which autonomous system is telling the rest of the Internet "send this traffic to me"—at this moment.
Prefix WhoIs processes BGP traffic from around the world at massive scale. Registry data is still important — we combine registry data to enrich our responses organized by the global routing table — in essence, the routing table is enriched by registry data to become the complete source of truth.
$ whob -gnp 4.2.2.1 4.2.2.1 | origin-as 3356 (4.0.0.0/9) | as-path 8220 1299 3356 | LVLT-ORG-4-8 | Level 3 Parent, LLC $ echo "2001:4860:4860::8888 and [2606:4700:4700::1111]:53" | whob -e 2001:4860:4860::8888 [AS15169 Google LLC] and [2606:4700:4700::1111]:53 [AS13335 Cloudflare, Inc.] $ whois -h whois.pwhois.org "type=json 1.1.1.1" {"IP":"1.1.1.1","Origin-AS":13335,"Prefix":"1.1.1.0/24","AS-Path":"8220 13335","AS-Org-Name":"Cloudflare, Inc.", ... }
[host]$ lft -S -E eggs.gnu.org:587 TTL LFT trace to eggs.gnu.org (209.51.188.92):587/tcp 1 192.0.2.1 0/1/1 ±0ms ** [neglected] no reply packets received from TTLs 2 through 4 5 nyiix-px.jfk01.twdx.net (198.32.160.208) 2/2/2 ±0ms 6 bbr02-ae-4-901.bos01.twdx.net (198.160.63.126) 7/7/7 ±0ms 7 dcr03-hu-0-8-0-0.bsn04.twdx.net (198.160.62.201) 7/7/7 ±0ms ** [firewall] the next gateway may statefully inspect packets 8 mass-ix.fsf.org (206.53.143.61) 7/7/7 ±0ms 9 [target open] eggs.gnu.org (209.51.188.92):587 7.4ms
Traceroute that gets through the firewall — and names the AS on the way.
Layer Four Traceroute sends TCP, UDP, ICMP or RFC 1393 probes, finds paths through stateful firewalls that swallow classic traces, exposes ECMP diamonds, discovers path MTU, and annotates every hop with its autonomous system using Prefix WhoIs. WhoB, shipped alongside it, is the easiest way to enrich your logs and other data to add useful annotations about networks.
Run your own view of the Internet.
pWhoIs server
pwhois-updatedb pulls the global table from your routers or a route-views feed; pwhoisd answers on port 43 in native, Cymru and RPSL formats, single or bulk. Your routers, your perspective.
MAILPrefix WhoIs Milter
Postfix and Sendmail filter that stamps each message with the origin AS, organization, country and route age of the sender — and of the host actually delivering it.
LIBRARIESC and PHP
A C whois library that walks ARIN, RIPE, APNIC, RADB, Cymru and RIS recursively until it finds the answer; PHP clients for single and bulk pWhoIs queries; community ports in Python, Perl and Ruby.
Twenty years, zero invoices.
Since 2005, 100% of the servers, transit and DNS behind whois.pwhois.org have been donated by public and private organisations — many of them large ISPs who run a node on their own network. The software is open source. Higher query limits for education, research and government are customarily granted free upon reasonable request.
If you run a network, the most valuable thing you can give is a node.
What the server is being asked.
Counters straight off the public service: which interfaces carry the load, and where in the world it comes from. Full statistics →