Skip to content
InternetData

The reassignments registries never see.

Network operators publish the blocks they hand their customers on RWHOIS servers of their own. Every reassignment they publish is here, with the customer, its contacts and its parent block.

Request evaluation

In the lookup API: rwhois, on a paid plan.

Real rows, with what each column means.

See documentation →

The schema and metadata are in the docs. It is published as CSVGZ and MMDB.

start_ipend_ipidnamecitycountryabusehost
23.227.192.19223.227.192.223NET-126051.23.227.192.192/27HIVELOCITY, LLCChicagoUSabuse@hivelocity.netrwhois.hivelocity.net
38.32.15.12838.32.15.135NET4-26200F801DAllata LLCDALLASUSrwhois.cogentco.com
38.87.81.3238.87.81.47NET4-265751201CSoletanche FreyssinetASHBURNUSrwhois.cogentco.com
38.88.216.11638.88.216.117NET4-2658D8741FManatt, Phelps, & Phillips, LLP.COSTA MESAUSrwhois.cogentco.com
216.231.141.0216.231.141.127NET-437.216.231.141.0/25Nexeon Technologies, IncStaffordUSabuse@sbaedge.commy.603.sbaedge.net
ID
ip_rwhois_v1
Entries
191,600
Refresh
Weekly
CSVGZ
5.78 MB
MMDB
10.20 MB

Download it from your code in one call.

Database API reference →

Every official client fetches the current IP RWHOIS build to disk, as a link for your own runner or into memory, and checks it against its published checksums.

download()
Streams the current build to a file, which lands only once the whole transfer has arrived, so a failed one never leaves a truncated file behind.
downloadUrl()
The time-limited link the API redirects to, for your own downloader, a job runner or a CDN pull.
downloadBytes()
The build in memory, for a small database or a pipeline that never touches a filesystem.
metadata()
Row count, file sizes and when the build last updated. Poll it and fetch only when a new one has landed.
checksums()
The md5, sha1, sha256 and sha512 digests of one file, to verify it once it lands.
import os
from internetdata import InternetData
client = InternetData(os.environ["INTERNETDATA_API_KEY"])
# what is in today's build, without moving the file
meta = client.database.metadata("ip_rwhois_v1")
client.database.download("ip_rwhois_v1", "mmdb", "./ip_rwhois_v1.mmdb")
sums = client.database.checksums("ip_rwhois_v1", "mmdb")
print(meta.updated, meta.entries, sums["sha256"])
load.pypip install internetdata
Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

Put it to work in your own systems.

Teams join IP RWHOIS against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.

Customer attribution

See which of an operator's customers holds a block, where the registries name only the operator.

License the full database
Sales will quote on volume, term and whether you need redistribution rights.
Checksums published per file: md5, sha1, sha256 and sha512.
The ID fixes the schema, so a new build never changes the columns your parser reads.
Samples are cut from the current build, not a synthetic extract.

Call the API in your language, with an official client.

All SDKs on GitHub →

Thirteen official clients, one for each language you ship in and one for the browser, plus middleware for fifteen web frameworks. Each answers private addresses without a request, caches what it looks up and splits big batches for you.

On this page

What is RWHOIS?

A whois protocol network operators run on servers of their own to publish the blocks they reassign to customers. A registry usually stops at the operator; RWHOIS names the customer.

00 · Unlimited

Unlimited lookups, no sign-up.

Paste it into a terminal. Any address answers with its country, network, company and hostname, with no key and no daily or monthly cap. ASes and domains answer too.

curl https://api.internetdata.io/8.8.8.8
{
"ip": "8.8.8.8",
"is_tor": false,
"is_anycast": true,
"is_dns_resolver": true,
"location": {
"country": "US", ...
},
"asn": { "asn": 15169, ... },
"hostname": "dns.google"
}
01 · Every field

All of the data on a paid plan.

VPN, proxy, hosting and CDN flags, each naming the operator.
Location to the city, with coordinates and an accuracy radius.
WHOIS records, the whole abuse contact and the services an address runs.
Up to 1,000 addresses, ASes and domains in one request.

A free API key answers every field for its first 100 lookups each day, with no card.