Summary

  • APNIC's live RDAP response for 1.1.1.1 contains port43: whois.apnic.net, identifying a legacy WHOIS lookup endpoint for the containing registration object.
  • RFC 9083 gives the field no routing or control semantics; analysts should not treat the server name as evidence of BGP origin, transit, operational authority or resource handover.

One hostname in a registration response can look more consequential than it is. APNIC's RDAP answer for 1.1.1.1, captured on 28 August 2026, describes the network range 1.1.1.0 to 1.1.1.255. Among the record's members is port43, whose value is whois.apnic.net. The same response carries other information—its handle, registered name, status, events and remarks—but the hostname has a deliberately narrow job.

RFC 9083 section 4.7 defines port43 as the fully qualified hostname or IP address of the WHOIS server where the containing object instance may be found. It even cautions that the value is not a URI. The field therefore answers a service-discovery question: if an analyst wants the legacy WHOIS representation of this registration object, which server should receive the query?

The older protocol is equally modest. Under RFC 3912, a WHOIS server listens on TCP port 43, accepts a text request and returns text. APNIC's own Whois documentation describes a searchable registry database holding information about Internet-number resources and responsible contacts. Together, these sources establish an evidence channel, not a network-control channel.

That distinction matters because a hostname can invite several false shortcuts. whois.apnic.net is not thereby the origin of the prefix in BGP. It is not identified as a transit provider, a route controller or the operator of services reached inside the range. Nor does port43 prove a transfer, delegation or corporate relationship. Those propositions require other evidence: routing observations, resource-history records, authenticated operational statements or a separately supported relationship record.

The live APNIC response illustrates another discipline. Its remarks mention a DNS resolver project and global routing by another autonomous system. Those remarks are separate fields and can be evaluated on their own terms. They do not enlarge the semantics of port43. A sound reading keeps each field attached to the claim it can actually support.

Used correctly, port43 is still valuable. It lets investigators reproduce a legacy lookup, compare RDAP and WHOIS presentations, locate contact data, and notice inconsistency between registry surfaces. The gain comes from treating it as provenance for a query path. The risk comes from promoting that path into an unsupported assertion about the network itself.

Sources