How to Read ARIN, RIPE, and APNIC WHOIS Records Accurately
An operational guide to querying Regional Internet Registry (RIR) databases, interpreting object attributes, and extracting authoritative network ownership and abuse contacts.
Quick Answer
Reading RIR WHOIS records requires querying the authoritative registry for the target IP block—ARIN (Americas), RIPE NCC (Europe/Middle East), or APNIC (Asia-Pacific). ARIN structures records using 'NetRange' and 'OrgName' objects, while RIPE and APNIC utilize RPSL 'inetnum', 'netname', and 'status' tags (e.g. ALLOCATED PA vs PI).
- Authoritative server selection: Query the correct regional WHOIS server to avoid referral loops.
- RPSL vs ARIN schema: RIPE/APNIC use Routing Policy Specification Language (inetnum); ARIN uses XML/REST schemas.
- RDAP modern standard: RFC 7480 RDAP delivers machine-readable JSON over HTTPS.
1. The Regional Discrepancy: ARIN vs RIPE/APNIC Syntax
Unlike domain WHOIS which follows ICANN templates, IP address registration is split across five sovereign RIRs. Each registry formats records differently:
2. Comparison of RIR Query Specifications
Compare the server endpoints, syntax standards, and operational parameters across the top three RIRs:
| RIR Name | Geographic Coverage | Port 43 Server | RDAP HTTPS Endpoint | Core Network Object |
|---|---|---|---|---|
| ARIN | United States, Canada, parts of Caribbean | whois.arin.net | https://rdap.arin.net/registry/ip/ | NetRange / OrgName |
| RIPE NCC | Europe, Middle East, Central Asia | whois.ripe.net | https://rdap.db.ripe.net/ip/ | inetnum / netname (RPSL) |
| APNIC | Asia and Pacific region | whois.apnic.net | https://rdap.apnic.net/ip/ | inetnum / netname (RPSL) |
| LACNIC | Latin America and Caribbean | whois.lacnic.net | https://rdap.lacnic.net/rdap/ip/ | inetnum / owner (RPSL) |
| AFRINIC | African continent | whois.afrinic.net | https://rdap.afrinic.net/rdap/ip/ | inetnum / netname (RPSL) |
Authoritative RIR Selection Decision Tree
[ Target IP Address to Investigate ]
|
+-----------------------+-----------------------+
| | |
[ North America ] [ Europe / Mid-East ] [ Asia-Pacific ]
ARIN Database RIPE NCC Database APNIC Database
whois.arin.net whois.ripe.net whois.apnic.net
| | |
Key Objects: Key Objects: Key Objects:
NetRange, OrgName inetnum, netname inetnum, netname
OrgTechHandle descr, status descr, country
| | |
+-----------------------+-----------------------+
|
[ RDAP Unified Query ]
https://rdap.arin.net/registry/ip/...
Returns standardized RFC 7483 JSON
3. Understanding Critical Status Codes: PA vs PI
In RIPE and APNIC databases, the status attribute defines the legal portability and architectural flexibility of the IP block:
- ALLOCATED PA (Provider Aggregatable): The block belongs to an ISP. Downstream customers using these IPs cannot migrate them to another provider. If the customer leaves the ISP, the IPs are reclaimed.
- ALLOCATED PI (Provider Independent): The block is assigned directly to the enterprise end-user. The enterprise can multi-home and announce these IPs across multiple upstream transit providers via BGP.
- SUB-ALLOCATED PA: An ISP has delegated administrative management of a sub-block to a reseller or enterprise customer.
4. Practical Diagnostics: Querying via WHOIS and RDAP
Direct queries to the authoritative regional registries using command-line utilities:
Frequently Asked Questions
Why does querying a European IP against ARIN return a referral message?
ARIN only holds authoritative records for North America. If you query an IP managed by RIPE NCC against whois.arin.net, ARIN returns a referral pointer (e.g., "ReferralServer: whois://whois.ripe.net"). Modern CLI whois clients automatically follow these referrals, but manual scripts must direct queries to the authoritative regional server.
What is RDAP and how does it replace legacy WHOIS (port 43)?
RDAP (Registration Data Access Protocol, RFC 7480–7484) is the RESTful JSON successor to legacy plaintext port 43 WHOIS. RDAP provides standardized JSON data structures, native internationalization, authenticated access tiers, and HTTPS encryption, eliminating screen-scraping inconsistencies.
What does "status: ALLOCATED PA" mean in a RIPE WHOIS record?
PA stands for Provider Aggregatable address space. This indicates the IP block was allocated to an upstream Internet Service Provider or LIR that can sub-assign smaller subnets to downstream end-users. The customer cannot take these IPs with them if they switch providers.
What does "status: ALLOCATED PI" mean?
PI stands for Provider Independent address space. These IP prefixes are assigned directly to an enterprise or end-user by the RIR. The organization owns the assignment rights and can announce the block across any ISP using their own BGP Autonomous System Number.
Data & Technical Sources
- IETF RFC 3912 — WHOIS Protocol Specification
- IETF RFC 7480 — HTTP Usage in the Registration Data Access Protocol (RDAP)
- IETF RFC 7483 — JSON Responses for the Registration Data Access Protocol (RDAP)