[DBWG] [rpd] Humble feature request for quarantined/cleaned up IP addresses

Sat Oct 3 09:11:45 UTC 2026

Dear James,

Can you please confirm the operational aspects of the feature request ?

Kind regards,

On Tue, 29 Sept 2026, 22:51 Loganaden Velvindron, <loganaden at gmail.com>
wrote:

> On Mon, 28 Sept 2026 at 12:50, James Chirwa <james.chirwa at afrinic.net>
> wrote:
> >
> > Hi Logan, all,
> >
> > Thanks for raising this. I'll address it from two perspectives: what is
> published today, and where it could be improved.
> >
> Dear James, thank you for your reply. It is much appreciated.
> > Like the other RIRs, AFRINIC publishes the status of all Internet number
> resources daily in the NRO extended statistics format:
> https://ftp.afrinic.net/stats/afrinic/
> >
> > The file "delegated-afrinic-extended-latest" shows the status of each
> resource as allocated, assigned, available or reserved (definitions are in
> README-EXTENDED.txt). Historical files are also kept, so users can compare
> snapshots over time and identify status changes between reporting periods,
> as SM's script demonstrated.
> >
> > Reclaimed resources are placed in the reserved state while they go
> through the applicable quarantine and cleanup processes, after which they
> are returned to the available pool. It is important to clarify that a
> reserved (quarantined) resource does not necessarily imply contamination.
> More information on the resource lifecycle status is available here:
> https://afrinic.net/ip-resources-management
> >
> > Based on your explanation, I can notice one limitation of the current
> data is that the reserved status covers several scenarios. It includes
> resources in quarantine after reclamation as well as resources reserved for
> policy or operational reasons (for example, the policy-reserved
> 102.224.0.0/12 block).
> >
> > While I take note the ARIN "cleared blocks" example you shared, we would
> like to better understand your particular requirements, could you clarify:
> >
> > Which transitions are of most interest: delegated → reserved, reserved →
> available, or both?
>
> Both.
>
> > Would it be important to publish distinct types of reservation on this
> webpage (reclaimed, operational, policy)?
>
> Yes. I believe that having this information readily available would
> ease automation.
>
> > Would a structured feed (JSON or CSV) with the prefix, previous status,
> new status and effective date meet your requirements?
>
> Yes, it would be acceptable.
>
> > Any additional data points that would be useful.
> I believe that based on the following from the web page of AFRINIC you
> cited:
>
> "How do I determine the different cases of reserved?
> From the extended statistics file, the reserved resources cannot be
> differentiated.
>
> Policy reserved resources - These are registered on the AFRINIC WHOIS
> database, for example, 196.49.0.0/16, 196.60.0.0/16.
>
> Quarantine resources - These are currently kept as internal records.
>
> Temporary Reservations - These are currently kept as internal records.",
>
> This information is already available internally. It would simply be a
> matter of making this information available
> externally to the public.
>
>
> >
> > Your feedback on the questions above, will help us evaluate the best way
> forward.
> >
> > Next step
> > As pointed out by other forum members, this topic concerns how resources
> are represented and published rather than resource policy, so I am also
> exceptionally cross-posting to the DBWG mailing list for the discussion to
> proceed there.
>
> I would be happy to co-author a policy but I believe that since this
> information is already available internally, it's simply an
> operational matter
> to make it available externally.
>
> As a resource member previously said, this information could be useful
> beyond cybersecurity groups.
>
> >
> > Regards,
> >
> > James
> >
> >
> >
> > On 26/09/2026 11:19, Loganaden Velvindron wrote:
> >
> > Hi All,
> >
> > Recently, I was investigating a cyber security incident involving IP
> addresses.
> >
> > A recurring challenge is that even after these IP ranges are returned
> > to AFRINIC for quarantine and cleanup, there is no quick, centralized
> > way for cybersecurity threat intelligence providers or law enforcement
> > agencies to track this status change. I fully appreciate that the
> > AFRINIC team already handles a significant workload.
> >
> > I would therefore kindly request AFRINIC members  to discuss whether
> > putting a dedicated page would be a good idea ? The web page would be
> > for quarantined and cleaned up IP ranges so that Cybersecurity Threat
> > Intelligence Providers and Law enforcement agencies can easily parse
> > those to update their blocklists. CSV format is acceptable but json
> > format would be nice to have especially with the rise of automation.
> >
> > Kind regards,
> > Loganaden Velvindron
> > (Speaking in my own capacity)
> >
> > _______________________________________________
> > RPD mailing list
> > RPD at afrinic.net
> > https://lists.afrinic.net/mailman/listinfo/rpd
> >
> > --
> > James Chirwa
> > Head of Member Services
> > African Network Information Centre (AFRINIC) Limited
> > t: +230 403 51 00 | dir: +230 403 51 42
> > f: +230 466 6758
> > w: www.afrinic.net | tt: @afrinic
> > SM: facebook.com/afrinic | flickr.com/afrinic | youtube.com/afrinicmedia
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/dbwg/attachments/20261003/7b9a8fe2/attachment.html>