What changed in the data

219 networks were filed under ARIN though another registry runs their space (RIPE NCC, LACNIC or APNIC). Older crawls had stored the other registry's answer, or ARIN's record from before a transfer, under ARIN. They now come from the registry that holds them, and a lookup that a registry hands to another is no longer stored under the first.

126 placeholder records from the RIPE and APNIC databases are gone too. They stand in for space another registry runs, such as APNIC's "Not allocated by APNIC" and "Early registration addresses" blocks, and an address with no more specific record matched them, so it showed APNIC and Australia.

network.type now says how the block was handed out in the same words for every registry: allocation, assignment, reallocation, reassignment or legacy, and null otherwise. Before, it carried each registry's own word (direct allocation, assigned pa, allocated non-portable), and for many RIPE, APNIC and AFRINIC networks the holder's organization type (lir) instead of the network's. Those networks get their real type as the weekly imports read them again.

ARIN, LACNIC and the bulk-loaded registries also follow one set of rules for the rest of a record now. An abuse contact's country comes from its own address where the registry gives one, and a network with no abuse contact no longer shows its holder's address as an abuse address. A network without a country takes its holder's: ARIN and LACNIC networks carry none of their own, so most of them had no country_code before and get one as the crawl reads them again.

The whois download carries the same type as a new network_type column, and its org_type column keeps the registry's own word.

abuse_contact now lists every email and phone number the registry publishes for the contact, as emails and phones. About 4% of ARIN abuse contacts list more than one email, and a single value dropped the rest. email and phone keep their meaning: the first the registry lists, which also starts each list. Fax numbers are left out. RIPE NCC and APNIC mark a contact's abuse mailboxes (APNIC lists a general address such as a help desk beside them), so for those two only the marked ones are kept.

The lists fill in as records are read again: the weekly RIPE, APNIC and AFRINIC imports, and ARIN's range listing, which re-reads every ARIN record each pass (a few days). LACNIC records get them only when first found.

In CSV, text and HTML answers, array values are now joined with ; instead of a space, since a phone number can hold spaces. This also changes prefixes and services in those formats. The whois download adds abuse_emails and abuse_phones as lists at the end of each row: a JSON array in the CSV, and a list in the JSON, Parquet and MMDB files. The download schema version, shared by every dataset, is now 1.1.0; the whois columns are the only change to the columns.

In every dataset, the JSON, Parquet and MMDB files no longer carry the apostrophe the CSV puts in front of a value a spreadsheet could run as a formula, such as a phone number starting with +. Only the CSV keeps it.

The whole database is now buildable as files. bun run export:datasets streams every table to gzipped CSV, and the geolocation, ASN and datacenter tables also build as MaxMind DB files. Every range table carries network alongside start_ip and end_ip, so importers that only understand integers do not have to parse prefixes.

The MMDB writer is our own implementation of the format: a 128-bit search tree with IPv4 under ::/96, a deduplicated data section, and a standard version 2 metadata block. Any reader that opens a MaxMind file opens ours.

• Geolocation: CSV and MMDB
• ASN organizations: CSV, and MMDB keyed by BGP prefix
• Datacenter and hosting: CSV and MMDB
• VPN and proxy, Tor exits, abuser networks, crawler ranges, whois contacts and the BGP table: CSV

Downloads are included with the Business plan. See Downloads.

Anyone can now report a wrong value at Corrections without an account. Reports land in a review queue and are checked against the source the value came from before anything moves. If you run the network, publishing an RFC 8805 geofeed is still the better fix — we read those on every refresh.

City, region, postcode, coordinates and time zone now come from RFC 8805 geofeeds published by network operators, backed by GeoNames reference data for country, region and city names. Every row carries an accuracy rating from 1 (city level with publisher coordinates) to 5 (country level from the registry allocation), so you can decide how much to trust a given answer instead of guessing.

Networks operated by VPN and proxy services, with the service name, the exit region and a confidence rating that says how the range was established: enumerated from an operator's own list, interpolated from a dense cluster of enumerated addresses, or assumed from a third-party aggregate.

Address ranges published by search engine and AI crawler operators, so a request claiming to be Googlebot can be checked against the ranges Google publishes rather than trusted on its user agent.

Cloud and hosting ranges from provider-published lists, one row per CIDR per source, with the provider, its domain, the region and the service. Keeping the source on every row means a refresh replaces exactly the rows that feed owns and leaves the others alone.

Registry allocations now carry the organization behind them and the abuse contact to report to, parsed from the RIR bulk whois dumps. An RPSL inetnum states an address range rather than a prefix, so a single record can expand into several rows that cover the range exactly.

The Tor Project bulk exit list, refreshed every six hours, and networks on public abuse blocklists with a count of how many independent feeds agree.

Announced prefixes with their originating AS from a public route collector, joined to CAIDA's AS-to-organization mapping. This is what lets an address resolve to a company rather than only to a registry allocation.