Public IPv4 Transfer Logs: Read Them Like a Pro

By Savvas Bout, Founder of Prefixx. Last updated 13 November 2026.

All IPv4 transfers registered by the 5 Regional Internet Registries ARIN, RIPE NCC, APNIC and LACNIC are documented in publicly accessible IPv4 transfer logs. These logs are mostly unknown to network engineers, though.

Only when in the middle of negotiations to purchase or lease IPv4 addresses , they need to verify a seller’s IP address ownership, they look into the public IP address transfer logs of the respective RIRs. The american registry for internet numbers maintains one of the most frequently consulted transfer databases among the five regional registries.

The logs record all IP address transfers between organizations, who transferred what to whom and when, but don't indicate whether a block of IP addresses is clean or carries a bad IP address reputation.

Furthermore, it is not clear whether all necessary routing objects for the transferred IP addresses exist and have been correctly configured. All this information constitutes the so-called IP address due diligence required for the purchase or leasing of IP addresses. Buyers must verify that routing configurations have been established in accordance with registry policies to ensure proper announcement of the transferred space.

It then describes how to read the publicly accessible logs of the 5 RIRs for IPv4 address space.

What are public IPv4 transfer logs at regional internet registries

The public IPv4 transfer logs are the publicly available transfer logs of regional internet registries. These logs contain the date of a transfer and the size of the IP address block that has been transferred. In addition, the logs indicate the originator and the receiver of the IP address space. These are registration records.

What regional internet registries actually publish on inter RIR transfers

The 5 regional internet registries maintain their own logs of IP number transfers. ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC update these logs on a regular basis. Typically containing data that is structural in nature: who held a block of numbers prior to the transfer, who holds them after the transfer, and when the transfer occurred. Each american registry follows its own publication schedule and format conventions when documenting these structural changes in number resource holdings.

The logs contain records of two types of resource transfers: intra-RIR moves (which stay within a single registry). Additionally, Inter-RIR moves (which cross from one registry to another), with each registry involved in a transfer keeping a record of that transfer. The registries track these resource movements for both IP address blocks and autonomous system numbers under their respective jurisdictions.

Are inter RIR transfers recorded in public transfer logs?

No. The transfer record is a registration log, not a financial log. No mention of price, escrow, etc. is ever made in the transfer registry. All that the relevant regional Internet registry cares about is the IP address’ routing and the change in administrative responsibility. The registry simply records which organization responsible for the resource has changed following the completion of the transfer process.

Market pricing continues to be opaque. A /24 under ARIN can trade at a completely different price to an identical block of IP under RIPE NCC in the same month. Buyers and sellers must create their own valuation frameworks by analyzing comparable transactions across registries and adjusting for regional policy differences.

Inter RIR transfers and address space blocks

This transfer between ARIN and the RIPE NCC set a precedent for other registries. Today, inter-RIR transfers are common for companies that are based in one region but have operations in other regions around the world. With inter RIR transfers, each side keeps a record of the transaction, so you may see the same transaction in two different logs. The first inter RIR transfer demonstrated that address space could move across registry boundaries while maintaining proper registration and routing integrity.

Our team at Prefixx can manage inter-RIR transfer paperwork end-to-end, LOA, RPKI ROA, IRR route objects for example, so you know it will get done.

How RIPE NCC and the five RIRs publish transfer data

The 5 Regional Internet Registries (RIRs) publish transfer data for IPv4 addresses, but the amount of data, the way it is published, and how often it is updated varies from one RIR to another.

These differences in how internet number resources are tracked matter if you want to trace the history of a single block of IPv4 addresses or verify a claim made by a seller. The registries serve as the authoritative record-keepers for internet infrastructure addressing, ensuring that ownership and routing information remains accessible across regions.

Regional internet registries breakdown of internet number resources

How often do RIRs update their transfer logs?

Updates to the internet number resources records for ARIN and RIPE NCC are most current. ARIN’s log of transfers is updated within a few hours of activity, whereas RIPE NCC exports and updates their resources on a daily basis. APNIC updates on a daily basis as well.

There is no dedicated log for number resources updates for LACNIC and AFRINIC, so updates occur at varying times. The american registry for internet numbers maintains one of the most transparent and frequently updated transfer record systems among the regional registries.

What this means for due diligence with regional internet registries

Note that field definitions can vary between registries for e.g. a “transfer date” at ARIN and a “transfer date” at RIPE NCC can refer to different events. Prefixx runs Tixx quality control on every block and cross-referends the data with the respective internet number data from the respective registries.

Important for this verification of internet number resources though is that you know what exactly a log entry consists of and where it fails. Each registry for internet numbers maintains its own schema and update cadence, which means cross-registry comparisons require careful normalization of field semantics.

What the logs actually record: fields and limitations

public IPv4 transfer databases only contain information about what happened as a result of a transfer request and do not provide any information about what may have occurred before the transfer request was submitted. When using transfer logs as transfer market intelligence it is also good to know what information is not included in the transfer logs and what each field means.

What the log entry contains from regional internet registries

1. Transfer completion date: Note that this is the date on which the RIR’s registration records were updated, and not the close date for the transfer. As with most reporting data, allow for a few days or weeks, and treat this as an approximate.
2. Address block. This lists the prefix(es) in CIDR notation for the resources that have moved. Legacy address space may be listed separately here because it is subject to different policy than the newly managed space.
3. Originating and receiving organization. This refers to the originating and receiving organization (the “resource holder” names as they appear in WHOIS, not necessarily the end operator of the networks).
4. Transfer type. This could be an intra-RIR transfer (i.e. ARIN 8.3, ARIN 8.4, etc.) or an inter-RIR transfer. This single field can contain a lot of information for transfer market analysis.

Note: Transaction price, broker involvement, escrow provider, and the reason for the transfer are never recorded. The log captures registration data only.

Intra-rir vs inter RIR transfers what is the difference

An intra-RIR IP address transfer is the process of transferring IP address space between two entities that are both registered with the same Internet Registry (RIR). An inter-RIR IP address transfer is the process of transferring IP space between two entities that are registered with different Internet Registries e.g.

ARIN to RIPE NCC. These transfers require both RIRs to agree to the transfer and can take longer to complete and appear in the IP transfer logs. Both intra-RIR and inter-RIR transfers involve the reallocation of address space from one organization's registry record to another's.

Resource holder: latin america and log limitations

Note that LACNIC covers Latin America. As a result, IP number transfers to/from that region may appear differently in the public logs of individual registries (i.e. some address blocks may be listed under the source registry, others under the destination). The Caribbean Network Information Centre operates under LACNIC's umbrella, so transfers involving Caribbean organizations follow the same regional registration patterns described above.

Thus, organizations which are attempting to develop pricing models for IP number transfers in the region will need to account for this as well as for the general lag in registration information for all RIRs. Also, the differences in these structural elements are further highlighted when viewing the individual log entries for intra-RIR and inter-RIR number transfers.

Reading transfer logs to understand the IPv4 market

RIR transfer logs serve as the closest to a public order book for the internet number market. They detail who moved what IP numbers and when, under which Registry. This data allows for structured analysis of demand as opposed to having to rely on private transaction details. Engineers and analysts studying these patterns gain insight into how address space flows across different networks and organizational boundaries.

What IPv4 transfer volume actually reveals

The RIRs publish a transfer registry for their respective regions. We look at quarterly volumes to spot acceleration vs. contraction. The majority of inter RIR transfers and other volume movements are in a handful of sizes, with /24s by far the most frequently moved size, followed by /20s and /16s which typically signal larger organizational acquisitions.

The shift in proportions between these internet number resources gives us a sense of whether the buyer is looking to consolidate existing entities or to build out 'lean' ones. These size categories represent a limited number of standard allocations that dominate transfer activity across all registries.

The way that the different registry regions are working can vary. For example, historically ARIN has exported more address space than it has received in RIPE NCC territory by way of inter-RIR transfers. Tracking such transfers between three RIRs i.e. ARIN, RIPE NCC.

Additionally, APNIC helps to highlight areas of current growth on the Internet as well as ways in which legacy holders can make money from their address space holdings. Understanding how address resources flow between registries provides insight into regional demand patterns and allocation efficiency.

Why might inter RIR transfers appear in two different RIR logs?

Inter-RIR transfer s are logged independently by the sending and receiving registry for internet numbers. For example, a transfer of a /22 from ARIN to RIPE NCC would result in both ARIN’s database of internet number assignments and RIPE NCC’s database of assigned numbers showing said transfer. These internet number resources should not be counted in raw numbers by analysts unless they have been deduplicated of cross-registry logging of the same transaction.

Block size and regional internet registries price signals

Price information is not published in the logs. Market participants use the frequency of IPv4 address space transfers and broker reported prices to estimate a fair price. Demand for certain prefix lengths is indicated by high transfer market velocity.

A /24 from ARIN space may trade at a different price than an identical size block of RIPE NCC space in the same month. Our Prefixx consultants monitor the log data as well as current deal flow to help buyers understand the current market situation best. Direct communication with our team ensures buyers receive real-time insights into regional pricing variations and block availability.

While market intelligence helps to identify potential opportunities, log data should be analyzed within a structured due-diligence process before a purchase or lease is finalized. Effective due diligence requires cross-referencing multiple address resources to confirm ownership chains and detect inconsistencies that might indicate problems with a block.

How transfer logs affect due diligence before a purchase or lease

IPv4 block transfer request history provides a useful starting point for due diligence. Transfer logs for a particular block of IP addresses can be cross-checked against the seller’s IP address ownership chain to pick up on any discrepancies. It also helps to establish whether a transfer request is currently being processed to transfer the IP address to another third party.

This can be verified prior to the acquisition or leasing of the IP addresses by the buyer or lessee. Buyers should confirm that all prior transfers were completed in accordance with the policies of the relevant registry to avoid complications during their own transfer process.

How do transfer logs help detect fraudulent or hijacked IP addresses?

Fraudulent activity has been known to be facilitated through rapid successive transfers of IP addresses, typically done by illegitimate entities who rapidly flip IP addresses between different registries in a matter of weeks. Identifying three or more of these internet number resources flags in rapid succession will necessitate further investigation prior to approval. Each registry enforces its own policy requirements that govern the approval or rejection of such transfer requests.

In addition to the Whois records, the transfer logs also show which organizations are currently holding a block. A mismatch between Whois and inter RIR transfers logs for a buyer is a red flag they are not verifying enough.

Fitting log review into a broader due-diligence process

This complete review of your internet number resources spans five areas of check: transfer database consistency, Whois ownership, RPKI ROA validity, IRR route object accuracy and blacklisting across all the market standard DNSBLs. Each of these test areas, including IP addresses, catches different errors that would be missed by not testing that area.

How tixx handles inter RIR transfers to remove buyer burden

Analyzing raw logs is time consuming. We run Tixx quality control on every block we put into the market. This checks for ownership, transfer eligibility, routing health and blacklist status on a per address basis across all blocks. This comprehensive approach provides a complete quality assurance solution for organizations entering the IPv4 transfer market.

As a buyer or lessee of IPv4 IP addresses, you don't need to spend time doing this type of analysis. The market for IPv4 moves very fast, Tixx enabled blocks allow you to buy with confidence rather than spend time analyzing. In addition to listing blocks for sale, we also support the full transfer process through to registry. Our team handles coordination and communication with registries to ensure smooth processing of your transfer request.

Working with inter RIR transfers using Prefixx

The transfer of IPv4 resources to be sold via regional internet registries is strictly governed. Navigating the process of buying and selling IPv4 space between ARIN, RIPE NCC, APNIC and LACNIC can hold great risk for both the buyer and the seller of IP space. As a registered broker with all three major regional internet registries Prefixx facilitates LACNIC IPv4 transfers and handles all the required paperwork on behalf of the buyer for their desired IP space acquisition.

• Tixx QC is ran on every block. The block is cleared of ownership, blacklisted and for routing hygiene issues before it is put up for sale by a buyer.
• Escrow-secured transactions. Funds are held in escrow until the inter-RIR or intra-RIR transfer has completed at the respective regional internet registry.
• Full routing paperwork for your network. We create LOA, RPKI ROA and the IRR route objects for you.
• No buyer fees. The seller(s) pay a commission of 3-8% as a seller-only fee. The buyer pays nothing.
• Boutique multi-lingual law firm with sole office in Miami, Florida. All five RIR regions serviced by consultants from the Miami office.

If an IPv4 transfer is part of your plan, explore how Prefixx manages resource transfers or reach out to discuss your specific address space needs.

While transfer logs are the closest to public price information in the IPv4 market, they only represent a part. Since every RIR publishes the same internet number resources information in different formats, processing inter-RIR transfers requires the reconciliation of two databases. The logs contain information about the transfers of internet number resources themselves but not about the commercial conditions that were agreed. Reading the logs for internet number resources well requires knowing what the individual columns are for and also what is deliberately not included.

If you are tracking the market to time a purchase or sale of inter RIR transfers, the logs give you volume and direction. They do not give you price. For that, you need a broker with active deal flow across all five regional internet registries. Prefixx works across ARIN, RIPE NCC, APNIC and LACNIC, handles the full transfer paperwork, and runs Tixx quality checks on every block. Contact the team to get a read on current market conditions before you move.