WHOIS Sub Registration for Lessees: Fix Your Visibility

By Savvas Bout, Founder of Prefixx. Last updated 28 October 2026.

Unlike domain registration, leasing a block of IPv4 addresses does not automatically put your name into the WHOIS record that is made public.

This creates several problems: abuse desks refuse your complaints, geolocation data for websites goes stale, and network peers have no authoritative contact to reach.

In the routing ecosystem, getting your contact information correct isn’t a trivial matter.

A competent lessor will include this in the paperwork as a normal part of the deal.

For a complete overview, explore our whois sub registration for lessees guide.

Understanding WHOIS sub registration for lessees

Leasing an IPv4 block still reports the original owner of the block in the RIR WHOIS database. Sub registering the lessee’s organization in the public WHOIS database for that range of IP addresses means they will be listed as the registrant for that range for purposes of abuse handling.

Domain privacy and IP registration data: a key distinction

IP sub registration is an RIR function. It is separate from domain name registration and DNS functions. Under ARIN this function is known as SWIP. On the RIPE NCC and APNIC databases the function uses assignment objects or sub-allocation objects. A WHOIS lookup of a leased IP address range should return the registrant contact information for the lessee, not the lessor.

Registered domain vs. Registered IP block domain registration data

Confusing these two is common: a registered domain sits in a domain registrar's database, and a registered IP range sits in an RIR database.

Why registration data matters here

Whois lookups by abuse desks and by spam filters aim to identify the responsible party. Without sub registration the lessor gets accused of a violation. Also, correct registrant data is needed for geolocation providers. Accurate registrant data serves legitimate reasons beyond abuse handling, including network troubleshooting and peering coordination.

Who appears as domain name owner in a lookup

Once the sub-lease has been registered the Lessee’s details will appear against the leased range. Note the difference between IP WHOIS records and domain WHOIS records, as most Network Teams will be familiar with the latter.

Domain status codes vs RIR object status: what lessees need to know

Domain WHOIS and IP WHOIS both originated from the WHOIS protocol. Status fields on WHOIS queries for domain registries and IP registries have different meanings. The same protocol is used for lookups on country code tlds and generic tlds, though each registry maintains its own database.

Domain registrar status codes vs RIR object status

Domain status codes like clientTransferProhibited or pendingDelete govern domain transfers and registrar locks.

Domain age and updated date fields in domain WHOIS have RIR equivalents: last-modified and, for leases, the agreement end date.

Checking RIR object status

1. Query the RIR WHOIS directly. Pull the allocation or assignment object for the leased block. Confirm the status reads ASSIGNED or ALLOCATED, not AVAILABLE or any pending-transfer flag. A stale or transitional status means the block is not ready to route.
2. Cross-check WHOIS information against your lease agreement. The last-modified date should post-date your lease start. A record that predates your agreement may indicate the transfer paperwork is incomplete.

Note: Status codes that signal a pending inter-RIR transfer will temporarily make a block unroutable by some upstreams.

Registrant information verification before announcement

1. Confirm RPKI ROA validity. An ASSIGNED object with no matching ROA will show RPKI Invalid in BGP. Prefixx prepares the ROA as part of white-glove service before provisioning.
2. Wait 24 hours and re-query after any record update. RIR records propagate on their own time frame.

Once the object status is confirmed and the ROA activated, practical questions arise, including whose name will be recorded against the object, which a WHOIS lookup can help clarify, and what rights that grants the lessee.

Who is the domain owner in an IPv4 lease: lessor, lessee, or both

The 'domain owner' analogy collapses quickly in IPv4 leasing.

Who the RIR actually recognizes

For leased blocks the legal owner is always the organization registered at the RIR where the lease was set up.

The lessee has no standing in this registration by default. Abuse reports are typically sent to the contact as listed in the WHOIS for that registration, not to the lessee who may actually be announcing the IP addresses from that block. This routing of abuse complaints can create operational friction when security teams at the lessee need to respond quickly to incidents originating from their leased address space.

To determine who controls a space, one must look beyond the domain registration title and use the analogy of a lease on physical space. The registered domain analogy fails because IP address blocks are allocated resources rather than names that can be transferred or sold independently.

Swip and sub-assignment: making the lessee visible

ARIN enables this type of data sharing through SWIP (Shared WHOIS Project).

A sub-registration enables a lessee to verify domain ownership equivalents. By way of example, a sub-registration can be used to prove to a third party that a particular domain name prefix is assigned to a lessee. Verification can be conducted by reference to the applicable WHOIS or RDAP records.

Expiration date and what happens at lease end

Note that a leased block does not have a public expiration date in WHOIS, unlike a domain name. Until then, WHOIS data reveals that the block has been reverted to the lessor but still shows the name of the former lessee. Lessees should confirm with their lessor whether the lease term and renewal conditions are documented separately, since expiry dates are not visible in the public record.

Prefixx’s white-glove service includes LOA and RPKI ROA preparation for you as the lessee. The service also provides access to a secure control panel where lessees can monitor their IP assignments and routing status in real time.

All name servers and routing objects used to verify domain ownership are up-to-date and reflect the current state of affairs as it is registered with the relevant entities. The parties responsible for filing and updating these records, including the registration date, are the RIR equivalent of domain registrars for your domains. Ensuring that name servers point to the correct authoritative zones is part of maintaining accurate records across both DNS and routing infrastructure.

Key takeaways from frequently asked questions

What is WHOIS data for sub registrations and why do lessees need it?

A WHOIS sub registration is a record created by the address block's registered holder (the lessor) inside the RIR database that delegates a portion of the space to the lessee and lists the lessee's contact details. Without accurate registrant data, every abuse complaint, routing inquiry, or spam report lands on the lessor rather than the party actually operating the addresses. Clear lessee records also reduce the risk of ownership disputes by establishing an unambiguous chain of delegation in the public database.

RIRs expect operators to maintain accurate contact data for the networks they announce, so a missing sub registration creates both operational friction and policy risk. It also ensures that network engineers doing due diligence see the correct point of contact for the prefix. A thorough pre-announcement audit can help identify potential issues before they escalate into abuse complaints or routing disputes.

Who appears as the domain owner in an IP WHOIS data lookup?

IP WHOIS is not domain WHOIS: there is no single "owner" field equivalent. What changes is the downstream record, where the lessee's organization name, address, abuse contact, and technical contact appear against the specific prefix or range they are using.

What RIR equivalents of domain status codes appear in WHOIS data for leased IPv4 blocks?

Domain status codes like clientTransferProhibited have no direct RIR counterpart, but each registry uses its own status flags on resource records. In RIPE NCC, an inetnum object carries a "status" attribute, a kind of domain status indicator, with values such as ASSIGNED PA or SUB-ALLOCATED PA, which signals that the space has been delegated downstream by an LIR.

ARIN uses a "Network Type" field (for example, Direct Allocation or Reallocated) on NET records, visible via a WHOIS lookup, to convey the same hierarchy. The registrar URL field that appears in domain WHOIS has no equivalent in RIR databases, which instead rely on the registry's own RDAP or legacy WHOIS service endpoints.

Can an IPv4 lessee hide their contact information in WHOIS records?

No. RIR policy requires that abuse and technical contacts in IP WHOIS be accurate and reachable; proxy or privacy services that mask the real operator are not permitted the way they are for domain registrations. RIPE NCC, ARIN, and APNIC all require a valid abuse-mailbox and a responsive technical contact on every resource record, regardless of registration date. The prohibition on masking operator identity means that IP address lessees cannot rely on the same privacy service mechanisms commonly used to shield domain registrant details.

Providing false or unreachable contact data is a policy violation that can result in the record being flagged or the resource being recalled. Lessees who have legitimate confidentiality concerns should discuss a carefully worded but accurate organizational entry with their lessor rather than attempting to obscure what appears in a WHOIS lookup record.

How long do WHOIS records take to appear after a lease starts?

Once the lessor or their broker submits the sub registration to the relevant RIR, the record typically propagates into the public WHOIS database within a few hours. The practical bottleneck is gathering and submitting the correct lessee contact data, not the registry's processing time.

What happens to the WHOIS data when an IPv4 lease expires?

When a lease ends, the lessor removes or updates the sub registration so the lessee's contact information no longer appear against the prefix. The parent resource record reverts to showing only the lessor's information, and WHOIS data reveals to the broader internet community that the space is no longer operated by the former lessee.

Any LOA issued for the lease period is also revoked, which means the lessee's upstream provider, verifiable via a WHOIS lookup, should withdraw the route announcement. Leaving stale registration details for a sub in place after a lease expires creates abuse-handling confusion and is a policy compliance issue for the lessor.

Does Prefixx handle sub registration paperwork as part of an IPv4 lease?

Yes. Sub registration is part of the white-glove service included with every Prefixx lease. The Prefixx team prepares the correct RIR records, the LOA, RPKI ROAs, and IRR route objects on the lessee's behalf, so the lessee does not need to navigate registry portals or policy documentation themselves. Provisioning is completed within 24 hours of the lease starting. The same team monitors the records from registration date throughout the lease term and removes or updates them cleanly when the lease concludes.

The RIR object for a lessee is registered in the name of the lessor. Details of the lessee’s operation(s) are only recorded in the WHOIS database if the lessor has created a sub-assignment or reassignment record for the lessor.

Such details, much like domain name registrations, will be used by abuse contact, for reputation purposes and to provide evidence of legitimate use of a block of IP addresses or AS numbers. Details of the sponsoring LIR or broker are also recorded in the WHOIS database for the relevant RIR.

If you are leasing a block and want accurate WHOIS records, a non-revocation guarantee, and someone who handles the LOA, RPKI ROA, and IRR objects on your behalf, the next step is to review what Prefixx includes as standard with every lease at Prefixx.net.