From loganaden at gmail.com  Sat Oct  3 09:11:45 2026
From: loganaden at gmail.com (Loganaden Velvindron)
Date: Sat, 3 Oct 2026 13:11:45 +0400
Subject: [DBWG] [rpd] Humble feature request for quarantined/cleaned up
	IP addresses
In-Reply-To: <CAOp4FwTyst7PraDFCCUfG0+wYCMC9K9WNRWJfivB++_CwDPOTg@mail.gmail.com>
References: <CAOp4FwQWPgOX=bNzWpB5xWyN2u2u7_JV8f-4Pm3hiDk_+r=Tdw@mail.gmail.com>
 <e6233154-a830-4d0e-a928-1b6965d2a51c@afrinic.net>
 <CAOp4FwTyst7PraDFCCUfG0+wYCMC9K9WNRWJfivB++_CwDPOTg@mail.gmail.com>
Message-ID: <CAOp4FwS=HXWG_b+sHp45=xQHncCfy1pejEF4sCBEM--rEbCEzg@mail.gmail.com>

Dear James,

Can you please confirm the operational aspects of the feature request ?



Kind regards,



On Tue, 29 Sept 2026, 22:51 Loganaden Velvindron, <loganaden at gmail.com>
wrote:

> On Mon, 28 Sept 2026 at 12:50, James Chirwa <james.chirwa at afrinic.net>
> wrote:
> >
> > Hi Logan, all,
> >
> > Thanks for raising this. I'll address it from two perspectives: what is
> published today, and where it could be improved.
> >
> Dear James, thank you for your reply. It is much appreciated.
> > Like the other RIRs, AFRINIC publishes the status of all Internet number
> resources daily in the NRO extended statistics format:
> https://ftp.afrinic.net/stats/afrinic/
> >
> > The file "delegated-afrinic-extended-latest" shows the status of each
> resource as allocated, assigned, available or reserved (definitions are in
> README-EXTENDED.txt). Historical files are also kept, so users can compare
> snapshots over time and identify status changes between reporting periods,
> as SM's script demonstrated.
> >
> > Reclaimed resources are placed in the reserved state while they go
> through the applicable quarantine and cleanup processes, after which they
> are returned to the available pool. It is important to clarify that a
> reserved (quarantined) resource does not necessarily imply contamination.
> More information on the resource lifecycle status is available here:
> https://afrinic.net/ip-resources-management
> >
> > Based on your explanation, I can notice one limitation of the current
> data is that the reserved status covers several scenarios. It includes
> resources in quarantine after reclamation as well as resources reserved for
> policy or operational reasons (for example, the policy-reserved
> 102.224.0.0/12 block).
> >
> > While I take note the ARIN "cleared blocks" example you shared, we would
> like to better understand your particular requirements, could you clarify:
> >
> > Which transitions are of most interest: delegated ? reserved, reserved ?
> available, or both?
>
> Both.
>
> > Would it be important to publish distinct types of reservation on this
> webpage (reclaimed, operational, policy)?
>
> Yes. I believe that having this information readily available would
> ease automation.
>
> > Would a structured feed (JSON or CSV) with the prefix, previous status,
> new status and effective date meet your requirements?
>
> Yes, it would be acceptable.
>
> > Any additional data points that would be useful.
> I believe that based on the following from the web page of AFRINIC you
> cited:
>
> "How do I determine the different cases of reserved?
> From the extended statistics file, the reserved resources cannot be
> differentiated.
>
> Policy reserved resources - These are registered on the AFRINIC WHOIS
> database, for example, 196.49.0.0/16, 196.60.0.0/16.
>
> Quarantine resources - These are currently kept as internal records.
>
> Temporary Reservations - These are currently kept as internal records.",
>
> This information is already available internally. It would simply be a
> matter of making this information available
> externally to the public.
>
>
> >
> > Your feedback on the questions above, will help us evaluate the best way
> forward.
> >
> > Next step
> > As pointed out by other forum members, this topic concerns how resources
> are represented and published rather than resource policy, so I am also
> exceptionally cross-posting to the DBWG mailing list for the discussion to
> proceed there.
>
> I would be happy to co-author a policy but I believe that since this
> information is already available internally, it's simply an
> operational matter
> to make it available externally.
>
> As a resource member previously said, this information could be useful
> beyond cybersecurity groups.
>
> >
> > Regards,
> >
> > James
> >
> >
> >
> > On 26/09/2026 11:19, Loganaden Velvindron wrote:
> >
> > Hi All,
> >
> > Recently, I was investigating a cyber security incident involving IP
> addresses.
> >
> > A recurring challenge is that even after these IP ranges are returned
> > to AFRINIC for quarantine and cleanup, there is no quick, centralized
> > way for cybersecurity threat intelligence providers or law enforcement
> > agencies to track this status change. I fully appreciate that the
> > AFRINIC team already handles a significant workload.
> >
> > I would therefore kindly request AFRINIC members  to discuss whether
> > putting a dedicated page would be a good idea ? The web page would be
> > for quarantined and cleaned up IP ranges so that Cybersecurity Threat
> > Intelligence Providers and Law enforcement agencies can easily parse
> > those to update their blocklists. CSV format is acceptable but json
> > format would be nice to have especially with the rise of automation.
> >
> > Kind regards,
> > Loganaden Velvindron
> > (Speaking in my own capacity)
> >
> > _______________________________________________
> > RPD mailing list
> > RPD at afrinic.net
> > https://lists.afrinic.net/mailman/listinfo/rpd
> >
> > --
> > James Chirwa
> > Head of Member Services
> > African Network Information Centre (AFRINIC) Limited
> > t: +230 403 51 00 | dir: +230 403 51 42
> > f: +230 466 6758
> > w: www.afrinic.net | tt: @afrinic
> > SM: facebook.com/afrinic | flickr.com/afrinic | youtube.com/afrinicmedia
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/dbwg/attachments/20261003/7b9a8fe2/attachment.html>

From james.chirwa at afrinic.net  Tue Oct  6 05:27:42 2026
From: james.chirwa at afrinic.net (James Chirwa)
Date: Tue, 6 Oct 2026 09:27:42 +0400
Subject: [DBWG] [rpd] Humble feature request for quarantined/cleaned up
 IP addresses
In-Reply-To: <CAOp4FwS=HXWG_b+sHp45=xQHncCfy1pejEF4sCBEM--rEbCEzg@mail.gmail.com>
References: <CAOp4FwQWPgOX=bNzWpB5xWyN2u2u7_JV8f-4Pm3hiDk_+r=Tdw@mail.gmail.com>
 <e6233154-a830-4d0e-a928-1b6965d2a51c@afrinic.net>
 <CAOp4FwTyst7PraDFCCUfG0+wYCMC9K9WNRWJfivB++_CwDPOTg@mail.gmail.com>
 <CAOp4FwS=HXWG_b+sHp45=xQHncCfy1pejEF4sCBEM--rEbCEzg@mail.gmail.com>
Message-ID: <6a059e69-d410-4891-81b7-0a0dea5dde78@afrinic.net>

Dear Logan,

The matter has been referred to the respective internal stakeholders, 
and we will advise you shortly on the way forward.

Regards,

James

On 03/10/2026 13:11, Loganaden Velvindron wrote:
> Dear James,
>
> Can you please confirm the operational aspects of the feature request ?
>
>
>
> Kind regards,
>
>
>
> On Tue, 29 Sept 2026, 22:51 Loganaden Velvindron, 
> <loganaden at gmail.com> wrote:
>
>     On Mon, 28 Sept 2026 at 12:50, James Chirwa
>     <james.chirwa at afrinic.net> wrote:
>     >
>     > Hi Logan, all,
>     >
>     > Thanks for raising this. I'll address it from two perspectives:
>     what is published today, and where it could be improved.
>     >
>     Dear James, thank you for your reply. It is much appreciated.
>     > Like the other RIRs, AFRINIC publishes the status of all
>     Internet number resources daily in the NRO extended statistics
>     format: https://ftp.afrinic.net/stats/afrinic/
>     >
>     > The file "delegated-afrinic-extended-latest" shows the status of
>     each resource as allocated, assigned, available or reserved
>     (definitions are in README-EXTENDED.txt). Historical files are
>     also kept, so users can compare snapshots over time and identify
>     status changes between reporting periods, as SM's script demonstrated.
>     >
>     > Reclaimed resources are placed in the reserved state while they
>     go through the applicable quarantine and cleanup processes, after
>     which they are returned to the available pool. It is important to
>     clarify that a reserved (quarantined) resource does not
>     necessarily imply contamination. More information on the resource
>     lifecycle status is available here:
>     https://afrinic.net/ip-resources-management
>     >
>     > Based on your explanation, I can notice one limitation of the
>     current data is that the reserved status covers several scenarios.
>     It includes resources in quarantine after reclamation as well as
>     resources reserved for policy or operational reasons (for example,
>     the policy-reserved 102.224.0.0/12 <http://102.224.0.0/12> block).
>     >
>     > While I take note the ARIN "cleared blocks" example you shared,
>     we would like to better understand your particular requirements,
>     could you clarify:
>     >
>     > Which transitions are of most interest: delegated ? reserved,
>     reserved ? available, or both?
>
>     Both.
>
>     > Would it be important to publish distinct types of reservation
>     on this webpage (reclaimed, operational, policy)?
>
>     Yes. I believe that having this information readily available would
>     ease automation.
>
>     > Would a structured feed (JSON or CSV) with the prefix, previous
>     status, new status and effective date meet your requirements?
>
>     Yes, it would be acceptable.
>
>     > Any additional data points that would be useful.
>     I believe that based on the following from the web page of AFRINIC
>     you cited:
>
>     "How do I determine the different cases of reserved?
>     From the extended statistics file, the reserved resources cannot be
>     differentiated.
>
>     Policy reserved resources - These are registered on the AFRINIC WHOIS
>     database, for example, 196.49.0.0/16 <http://196.49.0.0/16>,
>     196.60.0.0/16 <http://196.60.0.0/16>.
>
>     Quarantine resources - These are currently kept as internal records.
>
>     Temporary Reservations - These are currently kept as internal
>     records.",
>
>     This information is already available internally. It would simply be a
>     matter of making this information available
>     externally to the public.
>
>
>     >
>     > Your feedback on the questions above, will help us evaluate the
>     best way forward.
>     >
>     > Next step
>     > As pointed out by other forum members, this topic concerns how
>     resources are represented and published rather than resource
>     policy, so I am also exceptionally cross-posting to the DBWG
>     mailing list for the discussion to proceed there.
>
>     I would be happy to co-author a policy but I believe that since this
>     information is already available internally, it's simply an
>     operational matter
>     to make it available externally.
>
>     As a resource member previously said, this information could be useful
>     beyond cybersecurity groups.
>
>     >
>     > Regards,
>     >
>     > James
>     >
>     >
>     >
>     > On 26/09/2026 11:19, Loganaden Velvindron wrote:
>     >
>     > Hi All,
>     >
>     > Recently, I was investigating a cyber security incident
>     involving IP addresses.
>     >
>     > A recurring challenge is that even after these IP ranges are
>     returned
>     > to AFRINIC for quarantine and cleanup, there is no quick,
>     centralized
>     > way for cybersecurity threat intelligence providers or law
>     enforcement
>     > agencies to track this status change. I fully appreciate that the
>     > AFRINIC team already handles a significant workload.
>     >
>     > I would therefore kindly request AFRINIC members? to discuss whether
>     > putting a dedicated page would be a good idea ? The web page
>     would be
>     > for quarantined and cleaned up IP ranges so that Cybersecurity
>     Threat
>     > Intelligence Providers and Law enforcement agencies can easily parse
>     > those to update their blocklists. CSV format is acceptable but json
>     > format would be nice to have especially with the rise of automation.
>     >
>     > Kind regards,
>     > Loganaden Velvindron
>     > (Speaking in my own capacity)
>     >
>     > _______________________________________________
>     > RPD mailing list
>     > RPD at afrinic.net
>     > https://lists.afrinic.net/mailman/listinfo/rpd
>     >
>     > --
>     > James Chirwa
>     > Head of Member Services
>     > African Network Information Centre (AFRINIC) Limited
>     > t: +230 403 51 00 | dir: +230 403 51 42
>     > f: +230 466 6758
>     > w: www.afrinic.net <http://www.afrinic.net> | tt: @afrinic
>     > SM: facebook.com/afrinic <http://facebook.com/afrinic> |
>     flickr.com/afrinic <http://flickr.com/afrinic> |
>     youtube.com/afrinicmedia <http://youtube.com/afrinicmedia>
>
-- 
James Chirwa
Head of Member Services
African Network Information Centre (AFRINIC) Limited
t: +230 403 51 00 | dir: +230 403 51 42
f: +230 466 6758
w:www.afrinic.net | tt: @afrinic
SM: facebook.com/afrinic | flickr.com/afrinic | youtube.com/afrinicmedia
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/dbwg/attachments/20261006/06e062ce/attachment.html>