| A whois lookup is performed in the background on the IP addresses included in the incident and the results are displayed in the Whois tab. An attempt is made to determine the country in which the IP addresses are registered. The lookup first queries the ARIN whois database, and if required then RIPE, APNIC, or LACNIC is queried. |