[DBWG] [rpd] Humble feature request for quarantined/cleaned up IP addresses
James Chirwa
james.chirwa at afrinic.net
Tue Oct 6 05:27:42 UTC 2026
Dear Logan,
The matter has been referred to the respective internal stakeholders,
and we will advise you shortly on the way forward.
Regards,
James
On 03/10/2026 13:11, Loganaden Velvindron wrote:
> Dear James,
>
> Can you please confirm the operational aspects of the feature request ?
>
>
>
> Kind regards,
>
>
>
> On Tue, 29 Sept 2026, 22:51 Loganaden Velvindron,
> <loganaden at gmail.com> wrote:
>
> On Mon, 28 Sept 2026 at 12:50, James Chirwa
> <james.chirwa at afrinic.net> wrote:
> >
> > Hi Logan, all,
> >
> > Thanks for raising this. I'll address it from two perspectives:
> what is published today, and where it could be improved.
> >
> Dear James, thank you for your reply. It is much appreciated.
> > Like the other RIRs, AFRINIC publishes the status of all
> Internet number resources daily in the NRO extended statistics
> format: https://ftp.afrinic.net/stats/afrinic/
> >
> > The file "delegated-afrinic-extended-latest" shows the status of
> each resource as allocated, assigned, available or reserved
> (definitions are in README-EXTENDED.txt). Historical files are
> also kept, so users can compare snapshots over time and identify
> status changes between reporting periods, as SM's script demonstrated.
> >
> > Reclaimed resources are placed in the reserved state while they
> go through the applicable quarantine and cleanup processes, after
> which they are returned to the available pool. It is important to
> clarify that a reserved (quarantined) resource does not
> necessarily imply contamination. More information on the resource
> lifecycle status is available here:
> https://afrinic.net/ip-resources-management
> >
> > Based on your explanation, I can notice one limitation of the
> current data is that the reserved status covers several scenarios.
> It includes resources in quarantine after reclamation as well as
> resources reserved for policy or operational reasons (for example,
> the policy-reserved 102.224.0.0/12 <http://102.224.0.0/12> block).
> >
> > While I take note the ARIN "cleared blocks" example you shared,
> we would like to better understand your particular requirements,
> could you clarify:
> >
> > Which transitions are of most interest: delegated → reserved,
> reserved → available, or both?
>
> Both.
>
> > Would it be important to publish distinct types of reservation
> on this webpage (reclaimed, operational, policy)?
>
> Yes. I believe that having this information readily available would
> ease automation.
>
> > Would a structured feed (JSON or CSV) with the prefix, previous
> status, new status and effective date meet your requirements?
>
> Yes, it would be acceptable.
>
> > Any additional data points that would be useful.
> I believe that based on the following from the web page of AFRINIC
> you cited:
>
> "How do I determine the different cases of reserved?
> From the extended statistics file, the reserved resources cannot be
> differentiated.
>
> Policy reserved resources - These are registered on the AFRINIC WHOIS
> database, for example, 196.49.0.0/16 <http://196.49.0.0/16>,
> 196.60.0.0/16 <http://196.60.0.0/16>.
>
> Quarantine resources - These are currently kept as internal records.
>
> Temporary Reservations - These are currently kept as internal
> records.",
>
> This information is already available internally. It would simply be a
> matter of making this information available
> externally to the public.
>
>
> >
> > Your feedback on the questions above, will help us evaluate the
> best way forward.
> >
> > Next step
> > As pointed out by other forum members, this topic concerns how
> resources are represented and published rather than resource
> policy, so I am also exceptionally cross-posting to the DBWG
> mailing list for the discussion to proceed there.
>
> I would be happy to co-author a policy but I believe that since this
> information is already available internally, it's simply an
> operational matter
> to make it available externally.
>
> As a resource member previously said, this information could be useful
> beyond cybersecurity groups.
>
> >
> > Regards,
> >
> > James
> >
> >
> >
> > On 26/09/2026 11:19, Loganaden Velvindron wrote:
> >
> > Hi All,
> >
> > Recently, I was investigating a cyber security incident
> involving IP addresses.
> >
> > A recurring challenge is that even after these IP ranges are
> returned
> > to AFRINIC for quarantine and cleanup, there is no quick,
> centralized
> > way for cybersecurity threat intelligence providers or law
> enforcement
> > agencies to track this status change. I fully appreciate that the
> > AFRINIC team already handles a significant workload.
> >
> > I would therefore kindly request AFRINIC members to discuss whether
> > putting a dedicated page would be a good idea ? The web page
> would be
> > for quarantined and cleaned up IP ranges so that Cybersecurity
> Threat
> > Intelligence Providers and Law enforcement agencies can easily parse
> > those to update their blocklists. CSV format is acceptable but json
> > format would be nice to have especially with the rise of automation.
> >
> > Kind regards,
> > Loganaden Velvindron
> > (Speaking in my own capacity)
> >
> > _______________________________________________
> > RPD mailing list
> > RPD at afrinic.net
> > https://lists.afrinic.net/mailman/listinfo/rpd
> >
> > --
> > James Chirwa
> > Head of Member Services
> > African Network Information Centre (AFRINIC) Limited
> > t: +230 403 51 00 | dir: +230 403 51 42
> > f: +230 466 6758
> > w: www.afrinic.net <http://www.afrinic.net> | tt: @afrinic
> > SM: facebook.com/afrinic <http://facebook.com/afrinic> |
> flickr.com/afrinic <http://flickr.com/afrinic> |
> youtube.com/afrinicmedia <http://youtube.com/afrinicmedia>
>
--
James Chirwa
Head of Member Services
African Network Information Centre (AFRINIC) Limited
t: +230 403 51 00 | dir: +230 403 51 42
f: +230 466 6758
w:www.afrinic.net | tt: @afrinic
SM: facebook.com/afrinic | flickr.com/afrinic | youtube.com/afrinicmedia
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/dbwg/attachments/20261006/06e062ce/attachment.html>
More information about the DBWG
mailing list