Summary

  • The cited 41% is the share of RDAP queries assigned to the hourly leader, summed across the selected observations. It does not mean one unchanged ASN generated 41% of all queries in the window.
  • The requested “year” contains 1,914 hourly observations beginning on 30 June 2026, and the underlying records do not identify a person, customer, organization, purpose or abuse.

On 20 September, APNIC policy proposer Jonathan Brewer wrote that one ASN accounted for 41% of RDAP queries and the top ten for 81.5%. The figures entered a debate about acceptable-use terms for APNIC’s directory services. “One ASN” is the most consequential part of the sentence. It sounds as though one network identity accumulated that share across the period. The published concentration series does not measure that proposition.

The dashboard that produced the series describes its method as the share of hourly traffic from the highest-ranked ASNs. It also says membership can change every hour. Its Rank 1 numerator is therefore a sum of hourly winners: at 10:00 the winner may be ASN A, at 11:00 ASN B, and at noon ASN C. The 41% is a moving seat. It is not the period total of one fixed ASN.

That is not a criticism of ranking. The two calculations answer useful but different questions. A moving Rank 1 share asks what fraction of traffic was handled by the largest source in each hour. A fixed-ASN share asks what fraction came from a named origin ASN over the whole period. The first can describe how much activity sits at the top of each hourly distribution; the second can describe persistence by an identified network source. Substituting one for the other turns a workload statistic into an attribution the numerator never made.

The period also deserves its label checked. The API request was for a year ending on 20 September 2026, with a requested start of 20 September 2025. Its oldest observation is 30 June 2026 at 03:00 UTC. The response contains 1,914 valid hourly points for WHOIS and RDAP and reports 51 excluded hours. That is roughly 82 days of observations, not 365. The label describes the requested window; the data describe the available window.

In that response, the dashboard sums 861,938,383 RDAP queries into Rank 1 out of 2,101,407,717 total, or 41.017%. Its top-ten band is 80.144%. These are the dashboard’s own aggregates over its retained points. A week, month and day request produce different Rank 1 RDAP shares—about 31%, 26% and 29%. Concentration depends on the window as well as the rank definition; a percentage without both is incomplete.

The 80.144% top-ten result is also below the 81.5% in the proponent’s post. The post does not preserve a matching API response, exact cutoff or exclusion list, so the difference cannot be resolved from the public record reviewed here. It is a reason to cite the captured window and source, not to declare either figure false.

APNIC’s public hourly reports make it possible to test the identity boundary. APNIC says each report summarizes one half-open UTC hour, aggregating query counts by origin ASN. A replay of current archived reports at the dashboard’s 1,914 timestamps found 15 different RDAP ASNs occupying first place. ASN 4134 led 1,289 hours; ASN 45102 led 227. Across the same timestamps, the fixed-period shares of those two ASNs were 16.286% and 24.403%, respectively. By contrast, summing the current archive’s hourly leaders again gives 41.1415%.

The replay is a cross-check, not a perfect reproduction of the dashboard’s historical snapshot. The current archive’s RDAP total differs from the API by about 0.55%. In 53 fetched hours, its per-ASN rows sum to more than the service total, while the API reports 51 excluded hours. The mismatch is real in these captured records; its cause is unknown. The near agreement in the two Rank 1 ratios does not resolve the count discrepancy, and it should not be used to claim that the API is exactly reproducible from the archive as it now stands.

The distinction matters because APNIC’s statistics and prop-173 occupy different steps in a possible decision chain. Prop-167, now listed as implemented, led to publication of usage statistics. Prop-173 remains a proposal on the Policy SIG mailing list. It would establish versioned acceptable-use terms for ordinary WHOIS, RDAP and web-directory access. The September concentration claim may help explain interest in service workload. It is not an APNIC finding that an ASN abused a service, and it does not establish that the proposed terms have been adopted.

An origin ASN is a routing attribution unit. It is not a person. It may be associated with a network that serves customers, but the aggregate does not identify which customer generated a request, whether multiple clients share infrastructure, who operates a tool, or what purpose a query served. APNIC’s hourly report includes distinct source-IP counts by ASN for that hour; it does not supply a globally deduplicated set of unique users across the entire window. Nor does a source IP, by itself, settle legal identity or intent.

The appropriate conclusion is narrower than either accusation or dismissal. A large hourly leader share is a signal about how query volume is distributed. It may justify examining capacity, resilience, query classes and controls. It cannot, without additional evidence, be converted into a claim about one enduring ASN’s share, a single organization’s behavior, abuse or harm. If the number is to inform a limit or enforcement decision, the record should say which unit is counted, how rank is assigned, what observations were retained, what was excluded and how a source identity is linked to an accountable party.

Sources

The 41.017% and 80.144% figures are the third-party API’s reported aggregates. The fixed-ASN replay and its mismatch caveat are derived from the current APNIC archive files at the same reported timestamps.