Networks
Every registered range with its CIDRs, status, parent allocation, holder and company domain.
Find the smallest range that covers an address.WHOIS
Who holds the address. Answered from the registries.
Registry records for every network, ASN, organisation and abuse contact across the five RIRs, normalised into one schema and delivered daily as Parquet.
Daily snapshot IPv4 & IPv6 · ASNs · Parquet
REGISTRY RECORDS WHOIS
- Address192.0.2.10the lookup
- Network192.0.2.0/24EXAMPLE-NET · reassignment
- HolderExample Hosting LLCEXAMPLE-12 · example.net
- ASNAS64500EXAMPLE-AS · hosting
- Abuseabuse@example.netABUSE1234-ARIN
Seven tables. One archive a day.Networks / ASNs / Organisations / Contacts / Transfers
.parquetOwnership,
not guesswork.
An IP address belongs to a range, the range to a holder, the holder to an abuse desk. Keep that chain next to your traffic, your alerts and your takedown requests.
ASNs
Autonomous systems with holder, country, a classified network type and the confidence behind it.
Tell hosting from access networks.Organisations
The legal holder behind networks and ASNs: name, country, domain and registered address.
Connect infrastructure to its operator.Contacts
Abuse, admin and technical contacts by handle, with their mailboxes, phones and addresses.
Pivot from one mailbox to every range it answers for.Transfers & delegations
Dated transfers between holders and registries, and the delegation blocks ASNs were issued from.
See who held a range, and when.Five registries, one schema
ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC normalised into the same columns, with the source kept on every row.
Query the world without five parsers.A closer look
at the records.
One file per registry object type, joined by handle. Pick a table to see a sample row in the dataset's own column order.
Every registered range: who holds it, under which parent, with its status, company domain and abuse mailbox.
networks.parquetJSON
{
"registry": "arin",
"source": "rdap",
"handle": "NET-192-0-2-0-1",
"start_address": "192.0.2.0",
"end_address": "192.0.2.255",
"cidrs": [
"192.0.2.0/24"
],
"name": "EXAMPLE-NET",
"country": "US",
"status": "reassignment",
"type": "hosting",
"parent_handle": "NET-192-0-0-0-0",
"org_handle": "EXAMPLE-12",
"org_name": "Example Hosting LLC",
"org_domain": "example.net",
"company_domain": "example.net",
"abuse_handle": "ABUSE1234-ARIN",
"abuse_email": "abuse@example.net",
"redacted": false,
"updated_at": "2026-10-28"
}Each autonomous system with its holder, country, a classified network type and how confident that label is.
asns.parquetJSON
{
"registry": "arin",
"asn": 64500,
"name": "EXAMPLE-AS",
"country": "US",
"type": "hosting",
"type_source": "registry",
"type_confidence": 0.94,
"org_handle": "EXAMPLE-12",
"abuse_email": "abuse@example.net",
"as_domain": "example.net",
"updated_at": "2026-10-28"
}The legal holder behind networks and ASNs, with its domain and where its address was sourced.
organisations.parquetJSON
{
"registry": "arin",
"source": "rdap",
"handle": "EXAMPLE-12",
"name": "Example Hosting LLC",
"country": "US",
"domain": "example.net",
"address": "100 Example Street, Springfield, US",
"address_source": "registry"
}Abuse, admin and technical contacts by handle, so one mailbox can be pivoted to every range it answers for.
contacts.parquetJSON
{
"registry": "arin",
"source": "rdap",
"handle": "ABUSE1234-ARIN",
"name": "Example Abuse Desk",
"kind": "abuse",
"emails": [
"abuse@example.net"
],
"phones": [
"+1-202-555-0142"
],
"faxes": [],
"address": "100 Example Street, Springfield, US",
"country": "US"
}Address and ASN transfers between holders and registries, dated, for tracing who held a range and when.
transfers.parquetJSON
{
"registry": "ripencc",
"transferred_at": "2026-09-14",
"type": "RESOURCE_TRANSFER",
"source_registry": "arin",
"recipient_registry": "ripencc",
"source_organization": "Example Hosting LLC",
"recipient_organization": "Example Networks B.V.",
"start_address": "198.51.100.0",
"end_address": "198.51.100.255"
}Registry delegation blocks for ASNs: the country, status and registration date of each allocation.
delegations.parquetJSON
{
"registry": "arin",
"start_asn": 64496,
"end_asn": 64511,
"country": "US",
"status": "assigned",
"registered_on": "2008-12-01",
"holder_id": "EXAMPLE-12"
}Illustrative rows using documentation ranges. Fields a registry does not publish are null, and records it redacts are flagged rather than dropped. A seventh file, maintainers.parquet, lists the maintainer objects that RIPE-style registries reference.
Your warehouse.
Your joins.
Download the day's archive and query it where your data already lives. No per-lookup API call, no rate limit, no registry to scrape.
- Format
- Apache Parquet in one
.tar.gzper day - Tables
networks,asns,organisations,contacts,maintainers,transfers,delegations- Coverage
- ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC · IPv4 and IPv6
- Cadence
- One snapshot a day, dated by the registry day it holds
Every range behind one abuse mailboxSQL
-- DuckDB reads the Parquet files in place.
SELECT n.cidrs, n.name, o.name AS holder, n.abuse_email
FROM 'whois/networks.parquet' AS n
LEFT JOIN 'whois/organisations.parquet' AS o
ON o.registry = n.registry AND o.handle = n.org_handle
WHERE n.abuse_email = 'abuse@example.net'
ORDER BY n.start_address;DuckDB example. Any engine that reads Parquet works the same way: Spark, BigQuery, ClickHouse, pandas.
Registry data,
made usable.
Keep the source on every row.
Each record carries its registry and how it was collected, so a disputed answer can be traced to the object that produced it.
Redacted is not missing.
Records a registry redacts are flagged instead of dropped, and fields it does not publish stay null. Absence is something you can tell apart from silence.
Join it to what you see.
Request a sample and join it against the networks in your own logs: holders, abuse desks and network types for the ranges that actually reach you.
Know who is behind the range.
Evaluate the WHOIS archive on your own traffic and add ownership and abuse context to your investigations.