<html class="apple-mail-supports-explicit-dark-mode"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">I don’t know anything about what law enforcement agencies do. I doubt that they feel the need to keep their own IP databases and I would imagine they only investigate IPs when associated with a crime, but I don’t know anything about this field. Hence made no comment. I’m not sure how your suggestion would help them hence my asking what is the problem you are trying to solve. <div><br id="lineBreakAtBeginningOfSignature"><div dir="ltr">Sent from my iPhone</div><div dir="ltr"><br><blockquote type="cite">On 26 Sep 2026, at 17:37, Loganaden Velvindron <loganaden@gmail.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="auto"><div>Hi Ben,</div><div dir="auto"><br></div><div dir="auto">Thank you for your email.</div><div dir="auto"><br></div><div dir="auto">I agree with you but it's not only about putting into blocklists. It's also about removing quarantine IPs from blocklists. </div><div dir="auto"><br></div><div dir="auto">Having a page on afrinic website where this information can be obtained easily and quickly and machine readable makes the job of cyberthreat intelligence companies - which often work closely with law enforcement agencies - much easier and much more accurate. </div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">I also mentioned law enforcement agencies and you didn't respond on this item. Is there a reason for this ?</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br><div class="gmail_quote gmail_quote_container" dir="auto"><div dir="ltr" class="gmail_attr">On Sat, 26 Sept 2026, 12:23 Ben Roberts - AfriNIC, <<a href="mailto:ben.roberts@afrinic.net">ben.roberts@afrinic.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Logan,<br>
It might be wrong to assume that all quarantined and returned space is contaminated. I’m sure that cyber threat blacklist companies have their own methods of determining address space with threats. I might be wrong to just ask to block all returned space (thus rendering it potentially useless to a future user who has been allocated the space). <br>
<br><br>
Is there a particular problem that you are trying to solve ?<br>
<br>
Kind regards<br>
Ben<br>
Sent from my iPhone<br>
<br>
> On 26 Sep 2026, at 10:21, Loganaden Velvindron <<a href="mailto:loganaden@gmail.com" target="_blank" rel="noreferrer">loganaden@gmail.com</a>> wrote:<br>
> <br>
> Hi All,<br>
> <br>
> Recently, I was investigating a cyber security incident involving IP addresses.<br>
> <br>
> A recurring challenge is that even after these IP ranges are returned<br>
> to AFRINIC for quarantine and cleanup, there is no quick, centralized<br>
> way for cybersecurity threat intelligence providers or law enforcement<br>
> agencies to track this status change. I fully appreciate that the<br>
> AFRINIC team already handles a significant workload.<br>
> <br>
> I would therefore kindly request AFRINIC members to discuss whether<br>
> putting a dedicated page would be a good idea ? The web page would be<br>
> for quarantined and cleaned up IP ranges so that Cybersecurity Threat<br>
> Intelligence Providers and Law enforcement agencies can easily parse<br>
> those to update their blocklists. CSV format is acceptable but json<br>
> format would be nice to have especially with the rise of automation.<br>
> <br>
> Kind regards,<br>
> Loganaden Velvindron<br>
> (Speaking in my own capacity)<br>
> <br>
> _______________________________________________<br>
> RPD mailing list<br>
> <a href="mailto:RPD@afrinic.net" target="_blank" rel="noreferrer">RPD@afrinic.net</a><br>
> <a href="https://lists.afrinic.net/mailman/listinfo/rpd" rel="noreferrer noreferrer" target="_blank">https://lists.afrinic.net/mailman/listinfo/rpd</a><br>
</blockquote></div></div></div>
</div></blockquote></div></body></html>