WHOIS data context

General
1

Original Author: @Max

Origin of WHOIS data

WHOIS data comes from Internet registries, whose purpose is to guarantee the unicity of Internet resources like ASNs (Autonomous System Numbers) and IP addresses across the Internet.

Organizations willing to acquire an ASN or IP addresses will either acquire them directly from a Regional Internet Registry (RIR) or a Local Internet Registry (LIR). LIRs are required to report assignments they make to their RIR.

We fetch and combine WHOIS information from all 5 RIRs: AFRINIC, ARIN, APNIC, LACNIC and the RIPE NCC. In addition a few countries operate National Internet Registries (NIRs), from which we also fetch data: JPNIC, IDNIC, KRNIC and TWNIC.

ARIN and RWHOIS servers

The ARIN region (North America) is special in that it allows ISPs and LIRs to maintain their own database instead of reporting assignments to ARIN. This database is called Referral WHOIS or RWHOIS.

Note that this is purely optional. Some ISPs will report assignments directly to ARIN, while some will maintain their own RWHOIS server.

To cover this case we also fetch data from RWHOIS servers.

Differences between the WHOIS and RWHOIS datasets

Not all the same fields are available depending on the RIR, or if the data comes from a RWHOIS server. The goal of our WHOIS dataset (rir.csv file) is to merge information from all RIRs and RWHOIS servers in a standardized manner.

In particular the WHOIS dataset does not include the organization city, state and country fields as those are only available in the ARIN region.

The RWHOIS dataset (rwhois.csv file) is focused on data obtained from RWHOIS servers. Since this data is usually more standardized across servers, the dataset contains additional fields not available in the WHOIS dataset, such as city, country and email.

In short

WHOIS

  • Data from all RIRs and RWHOIS standardized in a set of common fields across RIRs and RWHOIS data.
  • Covers 100% of allocated IP ranges.

RWHOIS

  • RWHOIS is an ARIN-specificity which covers only North American ranges.
  • Data from RWHOIS servers only, with more detailed data available.
  • Covers only the subset of allocated ranges from ISPs using RWHOIS.
1 Like