AFRINIC: when an IPv4 record drifts, networks feel it

A record drifts, and the network notices

A mail server begins deferring messages from a customer subnet. The server is up, the customer's SPF record looks right, but the reverse DNS zone no longer matches the address block. A validating router drops a route because the ROA does not cover the prefix being announced. An abuse mailbox that was current years ago goes unanswered while a compromised virtual machine keeps sending. A geolocation row still places a data centre in the wrong country, so a content service serves the wrong catalogue. These are not dramatic failures. They are ordinary consequences of a registry record that has stopped describing the network.

That is why AFRINIC's IPv4 scarcity rules and its contested leasing dispute matter beyond the registry world. The issue is not only whether addresses are scarce. It is whether the registry can still see who is using them, who is accountable for them, and what happens when the formal record and the operating network move apart.

What AFRINIC is and what its record says

AFRINIC is the Regional Internet Registry for Africa. Its statistics page says it allocates resources to members who satisfy Internet resource policy requirements. Its policy page says anyone may propose and discuss policy, regardless of location, gender and race; discussion happens mainly on the rpd mailing list and at twice-yearly Public Policy Meetings. The Policy Development Working Group discusses proposals that AFRINIC implements for IPv4, IPv6 and ASN distribution in Africa.

That is coordination, not sale. The registry keeps records, applies policy and tries to ensure the same address is not promised to two networks. When addresses are plentiful, the job is mostly administrative. When they are scarce, every record becomes a small allocation of economic value.

Scarcity became a rulebook

AFRINIC's exhaustion page records the chronology. In February 2011, IANA allocated two large blocks to APNIC, and the global pool fell to a critically low level. Each RIR then received one /8. By 24 September 2015, four of the five RIRs had exhausted their free pools. AFRINIC entered Soft-landing Phase 1 on 31 March 2017 and Phase 2 on 13 January 2020.

In Phase 2, the minimum allocation or assignment is /24 and the maximum is /22. Additional requests require at least 90% efficient use of space already delegated. A 2019 AFRINIC news item adds that Phase 2 begins when no more than one /11 of non-reserved space remains in the final /8, and that use outside the service region should solely support connectivity back to the region, citing CPM section 5.4.6.2.

These are policy conditions, not market observations. They tell an operator what the registry will consider a justified request. They do not tell an operator what the address is worth to someone else, or whether a downstream customer will still be reachable if the record changes.

The fee page is not a market price

AFRINIC's fee page describes a membership and cost-recovery model. New members are evaluated, then pay an allocation or assignment fee and an annual membership fee based on billable resources held. The schedule is dated 2008 unless amended. It describes exceptional transfers under merger-and-acquisition guidelines, with accounts in good standing before review.

Those rules tell an applicant what membership costs. They do not set a market price. That distinction matters because a lease can look expensive or cheap next to the fee schedule without telling anyone whether the arrangement is recognised, who is responsible for abuse handling, or what happens if the registry record is later questioned.

Why leasing creates a visibility gap

When addresses are scarce and allocation is administrative, a gap can open between the entity named in the registry and the entities actually using the addresses. A member may hold a block and assign capacity to customers. It may use a first-party lessor to supply and operate addresses downstream. The registry sees the member; the market may see an internet provider, a hosting platform, a reseller and an end customer.

'Shadow allocation' can describe that gap if it is used carefully. It is not a finding of fraud, theft or record manipulation. It is a visibility problem: the economically relevant user of a block is not always the entity the registry sees as the formal holder.

What LARUS says, and what it does not settle

LARUS publicly markets first-party IPv4 leasing as a continuity product for ISPs, hosting platforms, data centres and network operators. Its homepage says it handles RPKI/ROA, rDNS, geolocation, reputation and abuse with one team. Its leasing page says Continuity Critical includes Guaranteed Renewal and a named escalation path.

Those are company claims. They are useful evidence of how a lessor frames the product: not merely addresses, but continuity, support and renewal. They are not proof of market consensus, and they do not resolve the legal question of what the registry must recognise.

The legal record is narrower than the marketing

LARUS's court-order page identifies an 11 June 2025 Supreme Court of Mauritius order in SC/COM/MOT/000399/2025. It says the order directed rectification of AFRINIC's members register to add Cloud Innovation Ltd, updated registrar records, and recorded the Receiver's undertaking to rectify AFRINIC's records within 15 days.

AFRINIC's 9 May 2026 communiqué says the order did not establish, approve, recognise or create any 'Court-Ordered Shareholder-Position Continuity Structure'. AFRINIC says it may seek clarification about whether the relevant register was its resource register or its statutory members register. The two accounts describe different legal effects from the same document.

On 15 May 2026, AFRINIC said the Supreme Court on 14 May 2026 issued an Interim Order against Cloud Innovation Ltd following false and misleading statements disseminated through Larus Ltd, including a representation that the court had sanctioned leasing of AFRINIC-allocated resources. AFRINIC reiterates that those resources are governed by registration policies, contracts and RIR principles. The same communiqué says ICANN was allowed to intervene in the July 2025 winding-up petition, SC/COM/PET/000508/2025.

These are AFRINIC's statements. The orders themselves are not in the supplied record. A 2025 order does not by itself establish a 2026 holding, and a company's characterisation is not the court's text.

Why a lease inherits registry risk

The practical point is that a lease on AFRINIC space inherits registry-recognition risk. A customer may have a contract, but the registry record, policy interpretation and any later court clarification can affect whether the block remains usable as expected.

That does not make leasing illegitimate. It makes operational diligence necessary. A lessee should know who is responsible for abuse handling, reverse DNS and routing support, and what happens if the registry record is challenged. A lessor should be able to explain how it keeps those functions working without pretending that the contract replaces the registry.

For a network operator, the visible test is not whether the contract is signed. It is whether the block still passes the ordinary checks that keep a service online: reverse DNS that matches, ROAs that validate, an abuse contact that answers, and a geolocation record that sends users to the right service.

What proportionate governance would ask

Three questions matter more than a moral verdict on leasing.

First, can the registry distinguish categories of use? Direct operational use, ordinary customer assignment, first-party leasing, brokered leasing, temporary assignment, transfer pending approval and disputed entitlement are not the same. A binary test — formal record alone, or every customer contract — invites either opacity or litigation.

Second, can the registry identify who is accountable for the operational facts that policy actually cares about? Abuse handling, reverse DNS, RPKI/ROA and geolocation correction can be verified without disclosing every commercial term.

Third, can remedies be proportional? A stale abuse contact is not a fabricated record. A regional-use dispute is not address theft. A customer-facing continuity problem may need a transition path before revocation, especially where innocent downstream users exist.

What remains uncertain

The full Consolidated Policy Manual is not captured, so exact registration, transfer, regional-use and enforcement rules cannot be quoted. The 2025 and 2026 orders are not supplied; only the parties' characterisations are available. LARUS's captured pricing page says 'Live pricing is loading' and gives no numeric rate, so no market price can be attributed. The IANA registry is /8-level and does not resolve sub-allocations or the 45.96.0.0–45.111.255.255 recovered-pool allocation beyond AFRINIC's 2018 news item.

The narrower conclusion is more useful. AFRINIC runs a policy-based registry under IPv4 scarcity. Leasing exists because operators need continuity and holders see value in addresses that remain operationally important. The registry's difficulty is visibility: it must see enough to enforce narrow rules without claiming a permanent veto over every commercial arrangement. A source-bounded reading does not declare leasing good or bad.

It asks whether the registry can distinguish a documented operating relationship from a record that no longer describes the network — the same question that shows up, eventually, in a deferred message, a dropped route or an unanswered abuse report.