The reassignments registries never see.
Network operators publish the blocks they hand their customers on RWHOIS servers of their own. Every reassignment they publish is here, with the customer, its contacts and its parent block.
In the lookup API: rwhois, on a paid plan.
Real rows, with what each column means.
See documentation →The schema and metadata are in the docs. It is published as CSVGZ and MMDB.
| start_ip | end_ip | id | name | city | country | abuse | host |
|---|---|---|---|---|---|---|---|
| 23.227.192.192 | 23.227.192.223 | NET-126051.23.227.192.192/27 | HIVELOCITY, LLC | Chicago | US | abuse@hivelocity.net | rwhois.hivelocity.net |
| 38.32.15.128 | 38.32.15.135 | NET4-26200F801D | Allata LLC | DALLAS | US | rwhois.cogentco.com | |
| 38.87.81.32 | 38.87.81.47 | NET4-265751201C | Soletanche Freyssinet | ASHBURN | US | rwhois.cogentco.com | |
| 38.88.216.116 | 38.88.216.117 | NET4-2658D8741F | Manatt, Phelps, & Phillips, LLP. | COSTA MESA | US | rwhois.cogentco.com | |
| 216.231.141.0 | 216.231.141.127 | NET-437.216.231.141.0/25 | Nexeon Technologies, Inc | Stafford | US | abuse@sbaedge.com | my.603.sbaedge.net |
Download it from your code in one call.
Database API reference →Every official client fetches the current IP RWHOIS build to disk, as a link for your own runner or into memory, and checks it against its published checksums.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("ip_rwhois_v1")client.database.download("ip_rwhois_v1", "mmdb", "./ip_rwhois_v1.mmdb")sums = client.database.checksums("ip_rwhois_v1", "mmdb")print(meta.updated, meta.entries, sums["sha256"])
Put it to work in your own systems.
Teams join IP RWHOIS against traffic they already log, inside their own infrastructure, and never send an address anywhere to get an answer.
Customer attribution
See which of an operator's customers holds a block, where the registries name only the operator.
Call the API in your language, with an official client.
All SDKs on GitHub →Thirteen official clients, one for each language you ship in and one for the browser, plus middleware for fifteen web frameworks. Each answers private addresses without a request, caches what it looks up and splits big batches for you.
Common questions
What is RWHOIS?
A whois protocol network operators run on servers of their own to publish the blocks they reassign to customers. A registry usually stops at the operator; RWHOIS names the customer.
Whose servers does it cover?
Operators that run a public RWHOIS server of their own. host names the server and source the operator behind each record.
What is the difference between updated and imported?
updated is when the operator last changed the record; imported is the day the record was last collected.
Why is a contact field empty?
Because the operator's server doesn't publish it. A record carries only what the operator filed.
How often is it rebuilt?
Weekly. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV and MMDB, both cut from the same build. The MMDB opens in any MaxMind DB reader.
How do we get it?
Under a Standard or Redistribution license, quoted per database. Get a quote names IP RWHOIS to us, and Request evaluation puts the full current build in your hands to test first. Download sample gets you rows from it now.
Is there a lookup API?
Yes, on a paid plan: an address lookup answers rwhois. A free account's first 100 lookups each day answer it too.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it and when it was last seen. Corrections land in the next build.
Unlimited lookups, no sign-up.
Paste it into a terminal. Any address answers with its country, network, company and hostname, with no key and no daily or monthly cap. ASes and domains answer too.
{"ip": "8.8.8.8","is_tor": false,"is_anycast": true,"is_dns_resolver": true,"location": {"country": "US", ...},"asn": { "asn": 15169, ... },"hostname": "dns.google"}
All of the data on a paid plan.
A free API key answers every field for its first 100 lookups each day, with no card.