APNIC Restored WHOIS and RDAP Statistics, but Left the Incident Open

Summary

APNIC’s October archive lists all 24 hourly WHOIS/RDAP statistics files for 16 October as modified on 29 October at 10:16.
The service notice says generation was disabled after log-processing problems, but its End Time and Duration fields remain blank; the archive shows recovery more clearly than the incident page does.

Analysis

The useful part of an outage notice is not the apology at the bottom. It is the moment a reader can stop treating a missing or suspect feed as an active risk. APNIC’s public record leaves that moment to be inferred from a different system.

On 16 October, APNIC posted a service announcement for its Whois and RDAP statistics. It says log-processing problems made the statistics incomplete from 10:00 that day in UTC+10, that generation was disabled, and that affected files would be republished after the processing problems were fixed. The notice provides no end time or duration. Its service-updates index still lists the item under the same title, without a closure entry attached.

The archive supplies the next piece. APNIC’s README says each report is an hourly aggregate from query logs, grouped by origin ASN and containing query totals, query-type distribution and distinct source-IP counts. It describes the data as useful for operational visibility and research. The 2026/10 directory now lists every hourly file for 16 October. Each file and its MD5 companion carries the same 29 October 10:16 modification time. The archive continues through 31 October, and the live directory has a later current snapshot.

That is strong evidence of a backfill, not a repair certificate. A directory timestamp establishes when the file was published or replaced; it does not show when APNIC fixed the processor, whether every source log was recovered, or whether the aggregates were independently checked. But it does let a reader see that the service resumed producing a historical series after the announced gap.

The distinction matters because this dataset is itself an operational instrument. Researchers use it to compare query activity over time; network teams may use it to understand who is asking APNIC’s registration systems what. If a chart drops to zero or a day disappears, an analyst needs to know whether the networks went quiet, the logs were incomplete, or the generator was switched off. Here APNIC disclosed the failure, and the files later reveal the recovery. The public record makes readers join those dots themselves.

Closing the loop would take little: record the actual restoration time, state which intervals were rebuilt, and link the affected archive range from the notice. If some intervals remain unverified, say which ones. A blank end-time field turns a resolved data problem into an open question for every person who relies on the archive.