___________________________________________________________________

APNIC WHOIS AND RDAP QUERY STATISTICS
 (version 1.0 7 July 2026)
___________________________________________________________________


Contents:

 1. About these files
 2. Conditions of use
 3. File names and directory layout
 4. File format
 5. Update schedule


1.      ABOUT THESE FILES
____________________________________________________________________

The directory ftp://ftp.apnic.net/apnic/whois-rdap-stats/ contains
hourly summary statistics derived from APNIC WHOIS and RDAP query
logs.

Each published report covers logging for one hour and contains aggregate
statistics by origin ASN, including query totals, query type
distribution, and distinct source IP counts.

The reports are intended to support operational visibility and
research into usage patterns of APNIC WHOIS and RDAP services.


2.      CONDITIONS OF USE
____________________________________________________________________

The files are freely available for download and use on the condition
that APNIC will not be held responsible for any loss or damage
arising from the use of the information contained in these reports.

APNIC endeavours to the best of its ability to ensure the accuracy
of these reports; however, APNIC makes no guarantee in this regard.


3.      FILE NAMES AND DIRECTORY LAYOUT
____________________________________________________________________

3.1     Latest snapshot
-----------------------

The most recent completed hourly report is published as:

        whois-rdap-stats.json

An MD5 checksum file is published as:

        whois-rdap-stats.json.md5


3.2     Hourly archive
----------------------

Historical files are stored under year/month directories:

        YYYY/MM/whois-rdap-stats-YYYYmmdd-HH00.json.gz
        YYYY/MM/whois-rdap-stats-YYYYmmdd-HH00.json.gz.md5

Example:

        2026/07/whois-rdap-stats-20260707-1300.json.gz


4.      FILE FORMAT
____________________________________________________________________

4.1     Serialization
---------------------

Report files use JSON.

- The latest file is plain UTF-8 JSON text.
- Archived hourly files are gzip-compressed JSON (.json.gz).


4.2     Top-level structure
---------------------------

Each report has two service sections:

        RDAP
        WHOIS

Each section contains:

        date_range - the time interval covered by this report
        total_queries - the total number of queries received
        total_asns - the total number of distinct origin ASNs
        query_type_distribution - a mapping of query type to query count
        asns - a list of per-ASN statistics

Where each item in 'asns' includes:

        asn - the origin ASN
        query_count - the total number of queries from this ASN
        query_count_by_type - a mapping of query type to query count
        distinct_source_ip_count - the number of distinct source IPs from this ASN


4.3     Date range semantics
----------------------------

Each report represents the half-open UTC interval:

        [hour_start, hour_end)

Example:

        start: 2026-07-07T13:00:00Z
        end:   2026-07-07T14:00:00Z


4.4     MD5 file format
-----------------------

MD5 files use this text format:

        MD5 (<filename>) = <32-hex-md5>


5.      UPDATE SCHEDULE
____________________________________________________________________

A new report is generated hourly in UTC.

The latest file is replaced atomically on each successful publication,
and the previous latest file is retained in the monthly archive.


____________________________________________________________________

If you have questions or comments about these reports, please contact
<helpdesk@apnic.net>.

____________________________________________________________________