RDAP in practice: querying prefix registration without a WHOIS client
RDAP is the structured replacement for WHOIS. Here is how to query prefix ownership and which fields actually help an IP check.
Why RDAP instead of WHOIS
WHOIS output is free-form text, rate-limited per registrar and hard to parse. RDAP (Registration Data Access Protocol, RFC 7480–7484) returns JSON over HTTPS with a documented schema.
curl -s https://rdap.arin.net/registry/ip/45.32.11.8 | jq '{handle, name, startAddress, endAddress, country}'For RIPE, APNIC and LACNIC regions the base URL differs, but the JSON shape is the same.
Fields worth reading
| Field | Why it matters |
|---|---|
| handle / name | network name, often the operator's short code |
| startAddress–endAddress | the exact prefix, not the /24 guess |
| country | registered country — compare with the account country |
| events | registration and last-changed dates |
| entities | abuse contact; useful when you need to report a scanner |
A prefix registered to a hosting provider is a strong signal even before you run any heuristic. A prefix registered to a consumer ISP is not a guarantee — resold space exists.
Practical tips
- Cache responses; RDAP endpoints rate-limit aggressively.
- Follow
linksin the response to get the parent network. - Compare
countrywith the geolocation result. A big mismatch is worth a second look. - Use it as a verification layer, not a verdict: RDAP tells you who registered the block, not who is using it right now.