LACNIC: two 327,680-address TIM batches, ARIN and RIPE fields

LACNIC Sent Two Equal TIM Address Batches Through Different RIR Doors

Why it matters

Four June rows say ARIN; five September rows say RIPE NCC. Each batch contains exactly 327,680 IPv4 addresses, and today the June lookups also end at RIPE.

Theo March2 November 2026Reading Time 2 minLast update: 2 November 2026

Two LACNIC TIM-labelled batches contain 327,680 IPv4 addresses each despite different row counts and destination-RIR fields.

Summary

LACNIC lists four 9 June IPv4 transfer rows from TIM S.A. to LARUS LIMITED with recipient_rir=ARIN, and five 16 September rows from TIM SA to Larus Limited with recipient_rir=RIPENCC.
Both batches contain 327,680 addresses. Current end-address RDAP lookups for all four June ranges pass ARIN→LACNIC→RIPE; three September /16s now share one RIPE RDAP interval.

The first ledger surprise is arithmetic: two differently dated batches contain exactly the same number of addresses. LACNIC’s 2 November cumulative transfer file has four 9 June rows under source label TIM S.A. and recipient LARUS LIMITED: three /16s and one /15, or 327,680 IPv4 addresses. Its recipient_rir field says ARIN. Five 16 September rows use TIM SA and Larus Limited: five /16s, again 327,680. Those rows say RIPENCC. The file supplies no organization ID that joins the two source spellings; a registry identity crosswalk would establish whether they name the same legal holder.

The second surprise comes from asking today’s registries about the June addresses. For the end address of each transferred range, ARIN RDAP returns HTTP 303 to LACNIC, LACNIC returns 307 to RIPE NCC, and RIPE returns the matching parent interval. At 177.111.255.255, for example, the final RIPE record spans the entire 177.111.0.0/16. The other end-address queries resolve the two remaining /16s and the full 177.28.0.0/15. These HTTP steps show where a reader finds the current record; a dated registry record would establish when the June batch’s lookup authority changed from the file’s ARIN destination.

September has its own geometry. The three consecutive 187.96.0.0/16, 187.97.0.0/16 and 187.98.0.0/16 transfer rows now fall inside one RIPE RDAP interval from 187.96.0.0 through 187.98.255.255. The 191.133.0.0/16 and 179.77.0.0/16 rows each have their own current interval. Five transfer rows therefore yield three present-day RIPE registration spans. A row count, an address count and a current RDAP object count answer three different questions.

Direct RIR checks: 177.166.255.255, 177.111.255.255, 177.122.255.255, 177.29.255.255; 187.96.0.0, 191.133.0.0, 179.77.0.0.