Using ARIN’s WhoWas Service
Users can request a WhoWas Report for any IP address or Autonomous System Number (ASN), not just resources issued to their Organization. Because the WhoWas report contains the entire public history of the IP address or ASN, it is much larger and more complex than a Whois query response. Each IP address or ASN could have been a part of multiple networks/AS ranges over time and have been issued to multiple organizations, each with their own associated Points of Contact (POCs).
Please read the WhoWas ReadMe to learn more about interpreting the results.
It is important to note that WhoWas Reports only contain the data that would have been publicly viewable in Whois.
Step 1: Request WhoWas Access
WhoWas functionality is available to ARIN Online users through the Downloads & Services option in the left navigation. You do not need to be linked to a POC or Organization Identifier (Org ID) to request WhoWas access, but you do need an ARIN Online account.
If you don’t have an account, your first step will be registering at:
Once you are logged in at ARIN Online, go to Downloads & Services to submit your request for WhoWas access. This is a one-time request to grant authorization to access WhoWas reports; you will not have to repeat this step to request reports once access is granted. When you submit your request, ARIN Online will issue you a ticket number. Use Tickets & Messages > Tickets to check the status of your request.
Step 2: Review Process
ARIN staff will review your request and respond within two business days. You will be asked to provide additional information to verify your WhoWas access request. The questions include:
- What is your intended use of this WhoWas data?
- How often do you project needing to query for WhoWas data?
- Will your organization be using the data to accomplish advertising or marketing goals or marketing research goals?
ARIN will conduct this correspondence through the Message Center in your ARIN Online account. Upon approval, your account will be marked as authorized to request reports.
For questions about your request, communicate via the Ask ARIN feature of your online account, email to firstname.lastname@example.org or call ARIN's Registration Services Help Desk at +1.703.227.0660.
Step 3: Access Approved/Request a Report
Once authorized, you can request a WhoWas report for an IP Address or ASN. When you log in to ARIN Online and click on Downloads & Services, you will see that a link to “Request WhoWas Report” is now available under the WhoWas Report heading. Before you can submit your initial request, you are required to electronically accept the WhoWas ToU. You will not be asked to do this on subsequent requests unless ARIN releases a new version of the WhoWas ToU. If a new ToU is enacted, you will be required to accept the new version before requesting another WhoWas report.
You may request a WhoWas report for any ASN or IPv4 or IPv6 address. The search will not accept handles or CIDR notation; you must enter the actual number. You cannot request a WhoWas report for an Org ID or POC. Reports are only available for IP addresses and ASNs administered by ARIN, and this does include legacy addresses.
Note: You can also request WhoWas reports using Reg-RWS. Please refer to Registration Records and Reg-RWS page for details.
Step 4: Accessing a WhoWas Report
You will receive notification in your Message Center when your WhoWas report is finished processing. The report will be attached to your ticketed request in a .zip file for you to download. You will be notified if there are no results for the requested address or ASN, and you may submit questions to Ask ARIN via the link in the response if you have questions about the results.
Step 5: Reading a WhoWas Report
For any IP address or ASN, the WhoWas report will contain a separate .tsv file for any Net Handle (direct or reassignment) that the IP Address was ever a part of or any AS Handle that the ASN was ever a part of, any Org Handles (including Customer Orgs) ever associated with those Net or AS Handles, and any POC Handles associated directly with the Net or AS Handles or with the Org Handles. All of these .tsv files are combined into a .zip file, which includes:
- a ReadMe file
- a summary file (lists the Net Handles or AS Handles, Org, Customer and POC Handles for which individual reports are returned)
- individual reports providing the historical registration information for the requested IP Address or ASN
- individual reports providing the historical registration information for the requested resource's associated Organization and POC records
For detailed information on the content and format of the WhoWas report, please see the WhoWas ReadMe documentation. Use the “Ask ARIN” feature of your ARIN Online account to submit any questions about the WhoWas service and reports or the data output.
Search Related Content
- Quick Guide to ARIN's Whois
- Bulk Whois
- Whois Inaccuracy Reporting
- Registry Data Access Protocol (RDAP)
- Number Resource Fraud Reporting
- Provisioning & Maintenance of Registration Records (Reg-RWS)
- Resource Public Key Infrastructure (RPKI)
- CIDR Calculator
- Routing Registry
- Software Repository