On this page
Look up an address in ARIN's whois and you often get the ISP, not the company using the address. For 38.142.241.41, ARIN answers with Cogent's whole /8:
$ whois -h whois.arin.net 38.142.241.41 | grep -E '^(NetRange|OrgName|Referral)'
NetRange: 38.0.0.0 - 38.255.255.255
OrgName: Cogent Communications, LLC
ReferralServer: rwhois://rwhois.cogentco.com:4321
The last line says where the customer record is.
What RWHOIS is
RWHOIS, referral whois (RFC 2167, 1997), lets a network operator run its own whois server for the blocks it hands to its customers. ARIN requires every IPv4 reassignment of a /29 or larger to be reported within seven days, and an operator can report them to ARIN directly or publish them on an RWHOIS server of its own. When it does the second, ARIN's record for the parent block carries a ReferralServer line pointing there.
Querying a server by hand
RWHOIS servers listen on port 4321, and the standard whois client can ask one directly:
$ whois -h rwhois.cogentco.com -p 4321 38.142.241.41
%rwhois V-1.5:0010b0:00 rwhois.cogentco.com (CGNT rwhoisd 1.2.2)
network:ID:NET4-268EF1281D
network:Network-Name:NET4-268EF1281D
network:IP-Network:38.142.241.40/29
network:Org-Name:Megaport (USA), Inc.
network:Street-Address:1301 FANNIN STREET
network:City:HOUSTON
network:State:TX
network:Country:US
network:Postal-Code:77002
network:Tech-Contact:ZC108-ARIN
network:Updated:2024-05-13 17:28:50
%ok
Where ARIN had a /8 and Cogent, Cogent's server has the /29 and the company using it.
Records come in more than one shape. Cogent's server sends one block of network: lines. Hurricane Electric's marks references with ;I: and sends the holder's name and address as a separate contact: record, so a parser has to follow the reference.
Whois libraries don't always follow the referral. whoiser, a Node.js whois client, has an open issue where a lookup fails trying to resolve rwhois.rcn.net:4321 as a hostname. Code that reads only registry whois reads the ISP.
What RWHOIS holds
IP RWHOIS is collected weekly from the RWHOIS servers the registries refer to. Its run of 2026-10-08:
| Measure | Value |
|---|---|
| Servers that answered | 89 |
| Networks returned | 171,872 |
| IPv4 addresses they cover | 31.3M |
| Networks smaller than a /24 | 118,321 (68.8%) |
| Networks of a /29 or smaller | 105,782 (61.5%) |
| Distinct holder names | 44,262 |
| Networks with an abuse contact | 10,938 (6.4%) |
Only 5,162 of the 171,867 distinct networks (3.0%) are also in ARIN's whois with the same start and end. Of those smaller than a /24, it's 1,332 of 118,317 (1.1%). For the other 97%, ARIN's whois has no record of the block.
Most of what RWHOIS adds is inside /24s. Its 118,321 networks smaller than a /24 sit in just 7,733 /24s, and 5,221 of those are split between two or more holders, 2,382 between ten or more. Cogent's server alone returned 69,773 networks, for 18,170 distinct customers.
Who needs the customer
An abuse report about a /29 belongs with the hosting company that runs it, not the transit provider above it. A fraud team learns nothing from "Cogent" or "Hurricane Electric" next to an address, and the customer's name tells it who's actually there. And no registry's bulk files carry that layer, which matters to anyone building IP data.
Its limits
Every network the servers return is IPv4. Only 6.4% of networks name an abuse contact, so for most of them the abuse address is still the operator's. Servers come and go: 89 answered on 2026-10-08, against 95 on 2026-09-03. And no registry publishes RWHOIS data in bulk: to have it, you ask each server.
Using it at scale
IP RWHOIS has every one of those networks with its holder, contacts, address and the parent network the server names, as gzipped CSV and MMDB; its docs list the columns. Pair it with IP Whois for the registry record and IP Abuse Contact for where reports go. To license them, see pricing or talk to us.
