An RIR allocation is a block of IP addresses that one of the five regional Internet registries — ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America and AFRINIC for Africa — handed to a network operator, together with the country the registry recorded for it and the date it did so. Each registry publishes the whole ledger every day as its delegated-extended statistics file, which is the most authoritative public record of who was given which space and when.
What Spaw answers
Three fields come straight out of those files: registry names the registry (arin, ripencc, apnic, lacnic, afrinic), registry_country the country it recorded, and allocated_at the date. They are facts about the block, not weights. is_unallocated is their negative: an address in none of the five files was never handed out and scores +100. A registry_country that disagrees with the geolocation is worth a second look, and a block allocated or transferred a few weeks ago is a classic tell in fraud reviews — the response states the date and leaves the judgement to you.
What it does not mean
The registry's country is where the operator registered the block, which is not always where the addresses are used; a multinational's space can be registered in one country and deployed in twenty. That is exactly why it sits beside the geolocation rather than replacing it.