IPs are shared by many machines these days, in particular CGNAT bundles many machines in potentially very disperse locations together. You can't identify the source of DDOS by whois in that case.