[rpd] Humble feature request for quarantined/cleaned up IP addresses

[Loganaden Velvindron]

On Mon, 28 Sept 2026 at 12:50, James Chirwa <james.chirwa at afrinic.net> wrote:
>
> Hi Logan, all,
>
> Thanks for raising this. I'll address it from two perspectives: what is published today, and where it could be improved.
>
Dear James, thank you for your reply. It is much appreciated.
> Like the other RIRs, AFRINIC publishes the status of all Internet number resources daily in the NRO extended statistics format: https://ftp.afrinic.net/stats/afrinic/
>
> The file "delegated-afrinic-extended-latest" shows the status of each resource as allocated, assigned, available or reserved (definitions are in README-EXTENDED.txt). Historical files are also kept, so users can compare snapshots over time and identify status changes between reporting periods, as SM's script demonstrated.
>
> Reclaimed resources are placed in the reserved state while they go through the applicable quarantine and cleanup processes, after which they are returned to the available pool. It is important to clarify that a reserved (quarantined) resource does not necessarily imply contamination. More information on the resource lifecycle status is available here: https://afrinic.net/ip-resources-management
>
> Based on your explanation, I can notice one limitation of the current data is that the reserved status covers several scenarios. It includes resources in quarantine after reclamation as well as resources reserved for policy or operational reasons (for example, the policy-reserved 102.224.0.0/12 block).
>
> While I take note the ARIN "cleared blocks" example you shared, we would like to better understand your particular requirements, could you clarify:
>
> Which transitions are of most interest: delegated → reserved, reserved → available, or both?

Both.

> Would it be important to publish distinct types of reservation on this webpage (reclaimed, operational, policy)?

Yes. I believe that having this information readily available would
ease automation.

> Would a structured feed (JSON or CSV) with the prefix, previous status, new status and effective date meet your requirements?

Yes, it would be acceptable.

> Any additional data points that would be useful.
I believe that based on the following from the web page of AFRINIC you cited:

"How do I determine the different cases of reserved?
>From the extended statistics file, the reserved resources cannot be
differentiated.

Policy reserved resources - These are registered on the AFRINIC WHOIS
database, for example, 196.49.0.0/16, 196.60.0.0/16.

Quarantine resources - These are currently kept as internal records.

Temporary Reservations - These are currently kept as internal records.",

This information is already available internally. It would simply be a
matter of making this information available
externally to the public.


>
> Your feedback on the questions above, will help us evaluate the best way forward.
>
> Next step
> As pointed out by other forum members, this topic concerns how resources are represented and published rather than resource policy, so I am also exceptionally cross-posting to the DBWG mailing list for the discussion to proceed there.

I would be happy to co-author a policy but I believe that since this
information is already available internally, it's simply an
operational matter
to make it available externally.

As a resource member previously said, this information could be useful
beyond cybersecurity groups.

>
> Regards,
>
> James
>
>
>
> On 26/09/2026 11:19, Loganaden Velvindron wrote:
>
> Hi All,
>
> Recently, I was investigating a cyber security incident involving IP addresses.
>
> A recurring challenge is that even after these IP ranges are returned
> to AFRINIC for quarantine and cleanup, there is no quick, centralized
> way for cybersecurity threat intelligence providers or law enforcement
> agencies to track this status change. I fully appreciate that the
> AFRINIC team already handles a significant workload.
>
> I would therefore kindly request AFRINIC members  to discuss whether
> putting a dedicated page would be a good idea ? The web page would be
> for quarantined and cleaned up IP ranges so that Cybersecurity Threat
> Intelligence Providers and Law enforcement agencies can easily parse
> those to update their blocklists. CSV format is acceptable but json
> format would be nice to have especially with the rise of automation.
>
> Kind regards,
> Loganaden Velvindron
> (Speaking in my own capacity)
>
> _______________________________________________
> RPD mailing list
> RPD at afrinic.net
> https://lists.afrinic.net/mailman/listinfo/rpd
>
> --
> James Chirwa
> Head of Member Services
> African Network Information Centre (AFRINIC) Limited
> t: +230 403 51 00 | dir: +230 403 51 42
> f: +230 466 6758
> w: www.afrinic.net | tt: @afrinic
> SM: facebook.com/afrinic | flickr.com/afrinic | youtube.com/afrinicmedia