# What is RWHOIS? The customer records ARIN whois lacks

ARIN whois often names only the ISP. Its RWHOIS server names the customer: 171,872 networks from 89 servers, 97% of them missing from ARIN whois.

Look up an address in ARIN's whois and you often get the ISP, not the company using the address. For `38.142.241.41`, ARIN answers with Cogent's whole /8:

```
$ whois -h whois.arin.net 38.142.241.41 | grep -E '^(NetRange|OrgName|Referral)'
NetRange:       38.0.0.0 - 38.255.255.255
OrgName:        Cogent Communications, LLC
ReferralServer:  rwhois://rwhois.cogentco.com:4321
```

The last line says where the customer record is.

## What RWHOIS is

RWHOIS, referral whois ([RFC 2167](https://www.rfc-editor.org/rfc/rfc2167), 1997), lets a network operator run its own whois server for the blocks it hands to its customers. ARIN [requires](https://www.arin.net/resources/registry/reassignments/rwhois/) every IPv4 reassignment of a /29 or larger to be reported within seven days, and an operator can report them to ARIN directly or publish them on an RWHOIS server of its own. When it does the second, ARIN's record for the parent block carries a `ReferralServer` line pointing there.

## Querying a server by hand

RWHOIS servers listen on port 4321, and the standard `whois` client can ask one directly:

```
$ whois -h rwhois.cogentco.com -p 4321 38.142.241.41
%rwhois V-1.5:0010b0:00 rwhois.cogentco.com (CGNT rwhoisd 1.2.2)
network:ID:NET4-268EF1281D
network:Network-Name:NET4-268EF1281D
network:IP-Network:38.142.241.40/29
network:Org-Name:Megaport (USA), Inc.
network:Street-Address:1301 FANNIN STREET
network:City:HOUSTON
network:State:TX
network:Country:US
network:Postal-Code:77002
network:Tech-Contact:ZC108-ARIN
network:Updated:2024-05-13 17:28:50
%ok
```

Where ARIN had a /8 and Cogent, Cogent's server has the /29 and the company using it.

Records come in more than one shape. Cogent's server sends one block of `network:` lines. Hurricane Electric's marks references with `;I:` and sends the holder's name and address as a separate `contact:` record, so a parser has to follow the reference.

Whois libraries don't always follow the referral. `whoiser`, a Node.js whois client, has an [open issue](https://github.com/LayeredStudio/whoiser/issues/119) where a lookup fails trying to resolve `rwhois.rcn.net:4321` as a hostname. Code that reads only registry whois reads the ISP.

## What RWHOIS holds

[IP RWHOIS](https://internetdata.io/databases/ip-rwhois) is collected weekly from the RWHOIS servers the registries refer to. Its run of 2026-10-08:

| Measure | Value |
|---|---|
| Servers that answered | 89 |
| Networks returned | 171,872 |
| IPv4 addresses they cover | 31.3M |
| Networks smaller than a /24 | 118,321 (68.8%) |
| Networks of a /29 or smaller | 105,782 (61.5%) |
| Distinct holder names | 44,262 |
| Networks with an abuse contact | 10,938 (6.4%) |

Only 5,162 of the 171,867 distinct networks (3.0%) are also in ARIN's whois with the same start and end. Of those smaller than a /24, it's 1,332 of 118,317 (1.1%). For the other 97%, ARIN's whois has no record of the block.

Most of what RWHOIS adds is inside /24s. Its 118,321 networks smaller than a /24 sit in just 7,733 /24s, and 5,221 of those are split between two or more holders, 2,382 between ten or more. Cogent's server alone returned 69,773 networks, for 18,170 distinct customers.

## Who needs the customer

An abuse report about a /29 belongs with the hosting company that runs it, not the transit provider above it. A fraud team learns nothing from "Cogent" or "Hurricane Electric" next to an address, and the customer's name tells it who's actually there. And no registry's bulk files carry that layer, which matters to anyone building IP data.

## Its limits

Every network the servers return is IPv4. Only 6.4% of networks name an abuse contact, so for most of them the abuse address is still the operator's. Servers come and go: 89 answered on 2026-10-08, against 95 on 2026-09-03. And no registry publishes RWHOIS data in bulk: to have it, you ask each server.

## Using it at scale

IP RWHOIS has every one of those networks with its holder, contacts, address and the parent network the server names, as gzipped CSV and MMDB; [its docs](https://docs.internetdata.io/database/ip-rwhois) list the columns. Pair it with [IP Whois](https://internetdata.io/databases/ip-whois) for the registry record and [IP Abuse Contact](https://internetdata.io/databases/ip-abuse-contact) for where reports go. To license them, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).