Summary

  • APNIC now publishes an hourly JSON archive of aggregate WHOIS and RDAP usage.
  • The feed reports query totals, query-type mix, source ASN and distinct-source-IP counts, but not raw source IP addresses.
  • Resolution 2025-32 did not endorse the proposed MyAPNIC per-resource view because cost, resourcing and privacy concerns outweighed its immediate benefit.

APNIC marks prop-167 as Implemented after completing the implementation on 30 June 2026. The first public archive begins with the 03:00–04:00 UTC interval that day. The current product is a public aggregate visibility layer, not a window into every query made against a particular resource holder’s records.

The distinction matters because version 2 of the proposal described two related products. One was a public, machine-readable hourly report separated by service and query type, with statistics for at least the top 1,000 source ASNs. The other was a MyAPNIC feature intended to show resource holders how often their own IP addresses or ASNs were queried, with query type and source ASN where possible.

APNIC’s Executive Council endorsed Resolution 2025-32 on 4 December 2025, after consensus at APNIC 60 and final call. The resolution endorsed real-time or near-real-time public directory-usage statistics, but explicitly treated the MyAPNIC per-resource feature as not feasible at that time. The reasons recorded were cost, resourcing and potential privacy concerns.

The live data contract is narrower and concrete. Each hourly report has separate RDAP and WHOIS sections, totals, query-type distributions and per-origin-ASN statistics. For each ASN, the schema exposes the ASN, total queries, counts by query type and the number of distinct source IP addresses. It does not expose those addresses.

At the reporting freeze, the latest completed file covered 15:00–16:00 UTC on 5 September 2026. It recorded 1,170,356 RDAP queries from 3,730 origin ASNs and 3,296,523 WHOIS queries from 5,966 origin ASNs. Each service section contained 1,000 per-ASN rows. These are observations from one hour only, not a daily rate, user count or stable baseline.

A source ASN identifies the network from which traffic was observed. It does not reliably identify the individual or organisation responsible for every query. Shared infrastructure, cloud services, proxies and compromised systems can all complicate attribution. Nor does a large query count or distinct-source-IP count, by itself, establish harvesting, abuse or a policy violation.