Using RDAP to Track IP Address Block Reallocations

The Registration Data Access Protocol (RDAP) has become an essential tool for accessing and analyzing the allocation and management of IP address resources across the internet. One of its most practical applications lies in tracking IP address block reallocations—instances where previously allocated IP ranges are transferred, delegated, or reassigned from one organization to another, either within a single regional internet registry (RIR) or across different jurisdictions. The ability to monitor and analyze these reallocations is critical for a wide range of stakeholders, including network operators, cybersecurity analysts, law enforcement agencies, and researchers who seek to understand the dynamic nature of IP address ownership and utilization.

Unlike WHOIS, which traditionally delivered unstructured text and lacked consistent formatting or object types, RDAP presents a machine-readable, JSON-encoded structure that organizes IP address data into discrete, well-defined objects. Each IP network object retrieved through an RDAP query includes a wealth of information that can be used to assess the status and lineage of the address block. These include attributes such as the start and end addresses of the range, the CIDR notation, the handle or unique identifier, status flags like “allocated” or “assigned,” and most importantly, a set of events that document key lifecycle moments, including registration, last update, and reallocation if applicable.

One of the core mechanisms for tracking IP reallocations via RDAP is analyzing the relationship between parent and child network blocks. In RDAP, IP ranges that are sub-delegated from larger blocks are linked through remarks, links, or nested object hierarchies that specify their parent networks. For instance, a large block allocated by an RIR to an ISP may later be reallocated to a downstream customer or internal department. When querying the RDAP server of the corresponding RIR, the resulting IP network object for the reallocated block may include references to its parent block along with associated entity objects that identify the original allocator and the current holder. By comparing the entity roles and timestamps in the events array, analysts can infer when the reallocation occurred and which organization assumed control.

Furthermore, the entities associated with an IP network object often include administrative, technical, and abuse contacts, each represented as separate RDAP entity objects with roles. These roles can reveal changes in responsibility for address space. For example, if the administrative and abuse contacts change from one entity to another over time while the block’s size and CIDR remain constant, it is a strong indicator of a reallocation event. This is especially useful in identifying when blocks are sold or transferred in the aftermarket, sometimes in ways that are not publicly disclosed through routing announcements or RIR press releases.

RDAP’s inclusion of status fields provides further insight into reallocation activity. Statuses like allocated, assigned, reallocated, or reserved provide semantic labels that clarify the operational purpose of an IP block. When a block transitions from allocated to reallocated, this signals that it has moved from being part of a larger aggregate allocation to a distinct administrative unit. By monitoring status changes over time—through either repeated RDAP queries or archived RDAP data snapshots—an analyst can build a historical map of IP space reallocation patterns, identifying trends in organizational growth, hosting provider changes, or the emergence of new autonomous networks.

Tracking IP block reallocations using RDAP is especially valuable in the context of IPv4 address exhaustion. As available IPv4 space has become increasingly scarce, the secondary market for IP addresses has grown, and with it, the number of reallocation transactions. RDAP provides a transparent and standardized method for tracking how these transactions manifest in registry records. Because RIRs often update RDAP data as part of the transfer approval process, changes in the event timestamps or new links pointing to updated network records can be automatically monitored to detect when reallocation has occurred. This enables visibility into market activity that would otherwise require cross-referencing RIR transfer logs, BGP routing tables, and third-party datasets.

Another layer of analysis involves combining RDAP data with routing information from BGP. By matching RDAP-derived IP blocks with BGP prefix announcements, it is possible to observe when an IP block is first advertised by a new ASN following a reallocation. If the ASN associated with a prefix differs from that listed in RDAP records, it may suggest hijacking, misconfiguration, or an unreported reallocation. Conversely, congruence between the RDAP-assigned entity and the origin ASN supports the legitimacy of the transition. Such correlation is vital for network security investigations and helps identify address blocks being used by malicious actors who exploit temporary control over reallocated ranges.

Tools and automation also enhance the ability to track reallocations at scale using RDAP. Scripts and applications can be built to periodically query known IP ranges of interest, storing changes in RDAP fields in a time-series database. This enables alerting on changes in ownership, contact information, or status flags. Some research groups and security companies already maintain such infrastructure, generating feeds of reallocated IP space that can inform threat intelligence or identify emerging service providers. Visualization tools can render these reallocations on maps or graphs to show how address space shifts over time, revealing macro-level trends such as geographic redistribution of IP resources or concentration among certain hosting firms.

In environments that support authenticated RDAP access, such as through OAuth 2.0, additional data may be available about reallocation events. Authenticated users may receive less-redacted information, including registrant names or contact emails, that offer even more granularity in tracking address block transitions. This is particularly useful for trusted parties such as law enforcement, CERTs, or policy compliance auditors who need verified attribution for IP usage.

While RDAP has improved the ability to track IP address block reallocations, challenges remain. Not all RDAP implementations provide consistent or complete data. Some RIRs may omit certain attributes or delay updates to reflect recent changes. Additionally, reallocation events occurring outside of formal RIR transfer processes—such as informal leasing or sub-delegation within large organizations—may not be visible in RDAP at all. For these reasons, RDAP-based tracking is often most effective when combined with other data sources, including WHOIS legacy data, BGP monitoring tools, and proprietary IP address intelligence datasets.

In conclusion, RDAP provides a structured, efficient, and interoperable means to track IP address block reallocations across the global internet. By leveraging its entity relationships, status annotations, event timestamps, and nested network hierarchies, analysts can detect and understand how IP resources are reassigned over time. This capability supports network security, resource planning, compliance verification, and market intelligence, reinforcing RDAP’s role as a cornerstone of modern internet transparency and governance. As RDAP adoption and data quality improve, its utility for monitoring the dynamic flow of internet address space will only increase in value and scope.

The Registration Data Access Protocol (RDAP) has become an essential tool for accessing and analyzing the allocation and management of IP address resources across the internet. One of its most practical applications lies in tracking IP address block reallocations—instances where previously allocated IP ranges are transferred, delegated, or reassigned from one organization to another, either…