[rpd] Humble feature request for quarantined/cleaned up IP addresses

[James Chirwa]

Hi Logan, all,

Thanks for raising this. I'll address it from two perspectives: what is 
published today, and where it could be improved.

Like the other RIRs, AFRINIC publishes the status of all Internet number 
resources daily in the NRO extended statistics format: 
https://ftp.afrinic.net/stats/afrinic/

The file "delegated-afrinic-extended-latest" shows the status of each 
resource as allocated, assigned, available or reserved (definitions are 
in README-EXTENDED.txt). Historical files are also kept, so users can 
compare snapshots over time and identify status changes between 
reporting periods, as SM's script demonstrated.

Reclaimed resources are placed in the reserved state while they go 
through the applicable quarantine and cleanup processes, after which 
they are returned to the available pool. It is important to clarify that 
a reserved (quarantined) resource does not necessarily imply 
contamination. More information on the resource lifecycle status is 
available here: https://afrinic.net/ip-resources-management

Based on your explanation, I can notice one limitation of the current 
data is that the reserved status covers several scenarios. It includes 
resources in quarantine after reclamation as well as resources reserved 
for policy or operational reasons (for example, the policy-reserved 
102.224.0.0/12 block).

While I take note the ARIN "cleared blocks" example you shared, we would 
like to better understand your particular requirements, could you clarify:

 1. Which transitions are of most interest: delegated → reserved,
    reserved → available, or both?
 2. Would it be important to publish distinct types of reservation on
    this webpage (reclaimed, operational, policy)?
 3. Would a structured feed (JSON or CSV) with the prefix, previous
    status, new status and effective date meet your requirements?
 4. Any additional data points that would be useful.

Your feedback on the questions above, will help us evaluate the best way 
forward.

*Next step*
As pointed out by other forum members, this topic concerns how resources 
are represented and published rather than resource policy, so I am also 
exceptionally cross-posting to the DBWG mailing list for the discussion 
to proceed there.

Regards,

James



On 26/09/2026 11:19, Loganaden Velvindron wrote:
> Hi All,
>
> Recently, I was investigating a cyber security incident involving IP addresses.
>
> A recurring challenge is that even after these IP ranges are returned
> to AFRINIC for quarantine and cleanup, there is no quick, centralized
> way for cybersecurity threat intelligence providers or law enforcement
> agencies to track this status change. I fully appreciate that the
> AFRINIC team already handles a significant workload.
>
> I would therefore kindly request AFRINIC members  to discuss whether
> putting a dedicated page would be a good idea ? The web page would be
> for quarantined and cleaned up IP ranges so that Cybersecurity Threat
> Intelligence Providers and Law enforcement agencies can easily parse
> those to update their blocklists. CSV format is acceptable but json
> format would be nice to have especially with the rise of automation.
>
> Kind regards,
> Loganaden Velvindron
> (Speaking in my own capacity)
>
> _______________________________________________
> RPD mailing list
> RPD at afrinic.net
> https://lists.afrinic.net/mailman/listinfo/rpd

-- 
James Chirwa
Head of Member Services
African Network Information Centre (AFRINIC) Limited
t: +230 403 51 00 | dir: +230 403 51 42
f: +230 466 6758
w:www.afrinic.net | tt: @afrinic
SM: facebook.com/afrinic | flickr.com/afrinic | youtube.com/afrinicmedia
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20260928/9ea2eff4/attachment-0001.html>