Summary

  • ARIN recorded two ChoicePoint transfers at 16:06:35 UTC and three ThreatMetrix transfers at 16:14:01 UTC on 3 November, all to LEXISNEXIS RISK SOLUTIONS INC.
  • The four IPv4 ranges cover 14,336 addresses; a fifth resource is an IPv6 /44. Current RDAP puts the same registrant on all five while retaining legacy network names.

The first pair arrived together: 66.241.32.0/19 and 216.19.96.0/20, both from ChoicePoint, Inc. Seven minutes and 26 seconds later ARIN’s transfer file recorded 192.225.156.0/22, 199.101.156.0/22 and 2620:f3::/44 from ThreatMetrix Inc. Every row is classified MERGER_ACQUISITION; every source and recipient registry is ARIN. Four IPv4 ranges add to 14,336 addresses. The IPv6 /44 is a different kind of asset, not another number in that sum.

Current RDAP tells the second half of the story. All five exact network objects name LEXISNEXIS RISK SOLUTIONS INC. as registrant, under handle LRS-95. Their network-name fields, however, still read CPS-NET00, CHOICEPOINT-PRG, THM-2, THM and THM-IPV6. The old labels survived the administrative move. A reader who stops at the name field gets one history; a reader who checks the registrant gets the current cardholder.

The RDAP change times line up with the transfer timestamps for four objects. The IPv6 object is stamped one second earlier. That one-second difference is far less interesting than the hierarchy of fields: a familiar name can remain while the accountable registrant changes. ARIN’s public records supply no corresponding route-change or service-operation date. A dated operator or BGP record would establish that separate operational step.

Official records: ARIN’s dated transfer file; ChoicePoint /19 RDAP; ChoicePoint /20 RDAP; ThreatMetrix first /22 RDAP; ThreatMetrix second /22 RDAP; ThreatMetrix IPv6 RDAP.