One Company Accounts for 80% of AFRINIC's IP Addresses Being Used Outside Africa

On October 28, 2026, an address in a block registered to a network in the Democratic Republic of the Congo answered a ping from Lisbon in 0.28 milliseconds. At that speed, it can only be within about 30 kilometers of the city. Its registration says Africa, but it is in Portugal. This is one example of a broader discrepancy between where IP addresses are registered and where they're actually used.

Every IP address on the Internet is registered with one of five regional registries, each serving roughly a continent. Many firewalls, fraud checks, and sanctions screens rely on the IP address's country listed in that registration. We ran the same test across all five registries. Almost every address block is where its registry says. Africa's registry, AFRINIC, is the exception, and most of its out-of-region space sits in four blocks registered to one company.

We measure this with WHEREIS, a study that Head of Research Oliver Gasser wrote with Robert Beverly of San Diego State University and Amreesh Phokeer of the Internet Society. A WHOIS record works like a car's license plate. It tells you where the car was registered, not where it is parked tonight. WHEREIS checks how often the two differ, using the speed of light as a ruler.

Oliver and Rob presented the WHEREIS paper at the ACM Internet Measurement Conference (IMC) in Karlsruhe, Germany, in October. The presentation was well received and led to follow-up discussions, which we cover in our IMC 2026 recap. Our WHEREIS report runs the same method every week on ProbeNet, our Internet measurement network.

What we found (TL;DR):

• AFRINIC has the highest share of address space used outside its region: 2.4% of the IPv4 addresses we could measure on October 24, 2026, mostly stable week to week since August.
• 81% of those addresses sit inside four blocks registered to one company, Cloud Innovation Ltd, which has been in court with AFRINIC since 2021. Without them, AFRINIC's share would be 0.5%, lower than ARIN's.
• These addresses weren't moved to another registry. AFRINIC's own records show them handed on to customers, mostly hosting companies, while the registries' country lists still place them in Africa.
• Across all five registries, most address blocks are where their registry says: in the paper, 98.2% of the IPv4 blocks audited were fully consistent. On October 24, 2026, the WHEREIS report found 7.37 million IPv4 addresses answering from outside their registry's region.

How We Use the Speed of Light to Locate IP Addresses

A block is one registration in a registry's WHOIS database: a range of addresses that maps to a single prefix, such as 102.207.144.0/24. It can be any size, from a single address to millions, so it is not the same as a /24 or as a route announced in BGP. Each address we measure counts toward the most specific registration that covers it. IPv4 and IPv6 blocks are defined the same way.

To measure a block, we first need at least one IP address that responds to our probes. ProbeNet pings that address from many locations and keeps the fastest reply from each. Light in fiber travels at about two-thirds of its speed in a vacuum, the figure both the paper and the report use, so a round trip of 10 milliseconds means the address is at most about 1,000 kilometers from that probe. Each measurement narrows the possible location. By combining measurements from multiple probes, we can determine where an address could physically be located.

We compare that area with two fields in the block's registration: the service region of the registry that issued it, and the country written in its WHOIS record. When the record's country agrees with the registry but the measurement puts the block elsewhere, we call the block "registry inconsistent." When all three disagree, we call it "fully inconsistent."

The test is cautious on purpose. If even one address in a block could be inside the registry's region, the whole block counts as in region. Anycast addresses, which are set up to answer from several locations, are left out, and so are blocks split across several routes in BGP, the Internet's routing system. Every count in this post is a minimum.

The paper ran the method on RIPE Atlas, a public measurement network, and then on ProbeNet. On the blocks both platforms measured, 74.1% of the inconsistent IPv4 blocks were found only by ProbeNet, against 0.3% found only by RIPE Atlas. ProbeNet has more points of presence close to the targets and can send many more measurements.

Here is that test for the block from the start of this post, 102.207.144.0/24, whose registration record was created on November 1, 2025. Besides Lisbon, its one responsive address answered in 4.6 milliseconds from Braga, against 68 from Lagos and 132 from Johannesburg. It is also the example the report suggests in its "Check a prefix" box.

AFRINIC Has the Highest Share of Out-of-Region Addresses

Applied to all five registries, our measurement mostly confirms what the records say. In the paper, AFRINIC was the one registry well below the rest: 92.2% of its IPv4 blocks were fully consistent, against 98.8% for ARIN.

Our measurements show the same order. This post counts addresses rather than blocks, because one block can hold 256 addresses or a million. By addresses, AFRINIC has the highest share used outside its region, 2.43% of the IPv4 addresses we could measure, followed by ARIN at 1.46%, RIPE NCC (Europe and the Middle East) at 0.40%, LACNIC (Latin America) at 0.39%, and APNIC (Asia-Pacific) at 0.16%. The report itself counts blocks and puts AFRINIC at 2.46% of its blocks.

The largest volume is ARIN's: 4.67 million ARIN addresses answer from somewhere else, almost two-thirds of the 7.37 million total.

The weekly report also demonstrates change over time. Across all registries, out-of-region blocks rose slightly, from 21,766 on August 12 to 23,348 on October 24, while the number of blocks we can audit barely moved (up 0.2%). Some of that rise likely comes from ProbeNet itself. Over the same weeks, the number of addresses it measured grew by 21%, and more measurements can catch mismatches that earlier runs missed. AFRINIC's share has been mostly stable, between 2.4% and 3.0% of its measured addresses every week. Two months is too short to call either a trend, so we'll check back in a couple of months.

Most of Africa's Out-of-Region Space Sits in Four Blocks

AFRINIC's out-of-region space is smaller than ARIN's, 461,393 addresses, but it is concentrated. By where we measured it, 45% is in Asia-Pacific, 26% in Europe and the Middle East, and 23% in North America.

Most of it sits inside four address blocks that AFRINIC allocated to Cloud Innovation Ltd between 2013 and 2016. The four blocks hold 6,291,456 addresses and are registered to a company in the Seychelles. Of the part of those blocks we can measure, 13.5% answers from outside Africa.

AFRINIC's policy says its addresses are for use in its service region, except to support connectivity back to Africa. AFRINIC tried to reclaim Cloud Innovation's addresses, and the two have been in court in Mauritius since 2021.

The dispute has frozen AFRINIC's bank accounts for a time, put the registry under a court-appointed receiver since 2023, and led Cloud Innovation to ask the court to wind AFRINIC up, a petition that is still open (AFRINIC's latest update). Both sides have published their own accounts of the rulings.

The paper looked at AFRINIC more closely than the other registries. Its authors shared 106 inconsistent AFRINIC blocks with the registry, which confirmed 77 of them as use its policy does not allow. That sample came from all of AFRINIC's space, not only these four blocks.

How the Addresses Got There

If AFRINIC's addresses are abroad, the first explanation to test is a transfer to another registry, but the records rule it out. AFRINIC's transfer log has 277 IPv4 records since 2018, and none of them moved addresses to or from another registry. Only one of the 461,393 out-of-region addresses sits in a block with a logged transfer, and that 2023 transfer stayed inside AFRINIC.

Instead, most of the space was reassigned through WHOIS records, block by block, mostly to hosting companies. A reassignment records which organization uses part of a block, without changing the registry responsible for it. Networks classed as hosting announce 85% of these addresses, and 87% sit in WHOIS records created or updated in 2025 or 2026, which suggests current use rather than old records nobody updated. Inside Cloud Innovation's blocks, the largest announcers were four hosting networks: DXTL Tseung Kwan O Service and Power Line Datacenter in Hong Kong, and Tcloudnet and Zillion Network in the United States. For 379,024 of the out-of-region addresses, the WHOIS record itself lists a country outside Africa.

Where the Out-of-Region Addresses Are Being Used

The addresses that fail the test cluster in a few countries. Among out-of-region blocks that our measurements pin to a single country, the United States hosts 27.1%, Brazil 21.0%, and Japan 8.3%. That ranking follows where data centers and hosting providers sit, so countries with fewer of them are less likely to show up as destinations.

Each registry has its own pattern. The paper found that about three-quarters of ARIN's inconsistent blocks were in the Asia-Pacific or European regions. Our measurements agree: of ARIN's out-of-region addresses that we can pin to one region, 92% are in the APNIC or RIPE NCC regions. Latin America runs the other way, with 79% of LACNIC's out-of-region addresses answering from ARIN's region, mostly North America.

What This Means for Anyone Who Relies on Registry Country

The mismatch matters to anyone who relies on country information from the registries' own data. Each registry publishes daily delegation files that list every block it hands out, with a country code. For 98.6% of AFRINIC's out-of-region addresses, that code is African, most often the Seychelles. A firewall rule, sanctions screen, or fraud check built on those files places these addresses in Africa when they answer from Asia, Europe, or North America.

IP geolocation that measures performs better. Of AFRINIC's out-of-region blocks, IPinfo already places 99% outside Africa, DB-IP 88%, and MaxMind 61%, according to the report's comparison panel. In the paper, IPinfo detected the most out-of-region blocks in all five regions. 

For anyone who uses a registry's country today, three changes help:

• Use the registry's country for who issued a block, not for where it is used.
• Check where an address actually answers from, for example with ProbeNet Live, before blocking or allowing traffic by country.
• Look up any block you depend on in the report's "Check a prefix" box.

How to Use the WHEREIS Report

The WHEREIS findings show why registration records alone can't establish where IP addresses are being used. Most address space remains consistent with its registry's region, but the exceptions can be substantial.

By measuring these discrepancies every week, we can see where registration and observed usage diverge, how those patterns change, and which assumptions about IP location deserve a closer look.

The numbers in this post are a snapshot of October 24, 2026, from the WHEREIS report at ipinfo.io/reports/whereis. The report updates every week, so the numbers you see there will differ from the ones here. Its snapshot date sits under the headline count. Type an IP address or a block into the "Check a prefix" box to see which registry issued it, the country in its WHOIS record, and where our measurements place it. The map and the flow chart count only blocks that can be pinned to one country or one region, and the page counts blocks, while this post counts addresses.

Methodology: IPinfo's WHEREIS measurements with ProbeNet, October 24, 2026, counting IPv4 addresses in blocks we could reach. A block counts as out of region only if none of its measured addresses can be inside its registry's region. Registry data: WHOIS records, delegation files, and transfer logs from the five registries. Example pings: ProbeNet, October 28, 2026. Method: R. Beverly, A. Phokeer, and O. Gasser, "WHEREIS: IP Address Registration Geo-Consistency," ACM IMC 2026.