Summary

  • AFRINIC said parts of reserved, unallocated 102.224.0.0/12 appeared in global route announcements.
  • Its 9 March notice listed responses but did not confirm full withdrawal or containment.

AFRINIC published an incident notice on 9 March 2026 about what it called unauthorised use of reserved IPv4 address space. The registry identified 102.224.0.0/12 as the affected parent block and said it had not been allocated to any AFRINIC member. AFRINIC policy provides for a reserved /12 within its final IPv4 /8.

The notice said smaller portions of the block had recently been observed in the global Internet routing system. It did not name the more-specific prefixes, their origin autonomous systems or the networks accepting them. Those technical identifiers therefore remain outside the frozen public record used for this article.

According to AFRINIC, ARIN informed it of the issue after an ARIN network operator reported that its ASN appeared in the announcements without the resource holder's consent. AFRINIC also said its own review indicated that entries in a public Internet Routing Registry supported the announcements and may have helped them propagate through networks that use IRR data to filter routes. These are attributed institutional statements. The source set does not contain a separate ARIN statement, route-view export or copy of the relevant IRR objects.

AFRINIC reported four responses: it requested and obtained removal of the related IRR entries; contacted major transit providers; asked the party it believed had created the entries to end the unauthorised announcements immediately; and intensified monitoring to confirm that the routes were being fully withdrawn. The notice did not provide timestamps, affected-route counts or operator acknowledgements for those steps.

The notice date is known. The alert date, observation window and response-action dates are not. In its 9 March notice, AFRINIC said the block remained unallocated and reserved and that it continued working with network operators to ensure full containment. That language does not establish that every route had already disappeared or that the incident was later closed.