Cloudflare's IPv6 footprint, mapped: 47 announced /48s and 12 we couldn't trace back

If you only read one paragraph: the IPv4 secondary market in Q1 2026 was unusually concentrated. Three recipient organizations absorbed 41% of all addresses transferred this quarter, the long tail of small transfers continued to thin out, and one network - we'll call it the surprise - picked up a /15 from a registry it has never previously held resources in.

A summary in one paragraph

In total, 2,847,168 IPv4 addresses changed hands across all five regional registries between 2026-01-01 and 2026-03-31. That's down 12% from Q4 2025, but the median transfer size is up 30% - a smaller number of larger deals.

The shape of the quarter

Three patterns dominated Q1:

• Cloud absorption. One hyperscaler took two /15s and four /16s - all from organizations that hadn't routed those prefixes in 18+ months.
• Holding-company restructure. Several previously distinct organization handles within ARIN merged under the same parent, with the addresses re-issued accordingly.
• Cross-RIR motion. Eight transfers crossed registry boundaries (mostly RIPE → APNIC), a 33% increase quarter-over-quarter.

The transfer log is a financial paper trail rendered in pipe-delimited text. If you read it casually it looks like noise; if you read it carefully it tells you about restructures, about cloud expansion plans, and occasionally about whose IPv4 holdings have gone permanently dark. - from the asn.zone methodology page

Three patterns

1. Hyperscaler absorption

The same three companies appear at the top of the recipient list every quarter, and Q1 was no exception. What changed: their pace. The hyperscaler that took the most addresses this quarter took twice as much as in any prior quarter - entirely from US-resident organizations that had stopped advertising those blocks.

-- top recipients by IPv4 hosts received in Q1 2026
select
  to_org_name,
  sum(ipv4_hosts) as hosts_in,
  count(*) as n_transfers
from transfers
where transfer_date between '2026-01-01' and '2026-03-31'
  and ipv4_hosts is not null
group by 1 order by hosts_in desc limit 10;

2. Holding-company restructure

This is the quietest of the three patterns and probably the most informative. Where you see a single organization suddenly owning prefixes that previously sat under five different handles, you're almost always looking at the aftermath of a financial event - most often a private-equity rollup or a divestment.

3. Cross-RIR motion

RIPE → APNIC remains the dominant cross-border direction; the reverse is rare. The size distribution of cross-RIR transfers has shifted toward smaller blocks (mostly /22 and /24) - consistent with the working theory that what's being moved here is operational capacity for specific subsidiaries, not strategic warehousing.

The new one

One organization - a network that has, for as long as we have data, only ever held LACNIC resources - picked up a /15 from a RIPE-region seller. The post-transfer routing tells the story: the new holder is announcing the prefix from PoPs in São Paulo and Buenos Aires, but with origins set as if the prefix originated from the European holder.

This is the kind of pattern that the transfer log alone wouldn't reveal - you need the BGP layer to see what's happening operationally. We'll cover the technical mechanics, and the implications for everyone running RPKI ROAs, in the next post.

Methodology

All numbers in this report come from the public RIR transfer logs (ARIN's specified-transfers.json, RIPE's transfers.json, APNIC's per-day transfers_*.json) and our own ingestion of the BGP RIS RIB at four-hour cadence. Methodology details & reproducibility on the about page →

Reproducible queries

If you have an asn.zone API key, you can pull every datapoint in this report yourself. The endpoint is /v1/transfers; filter by date_from, date_to, and optionally by resource_type. The full Python notebook used to generate the figures is on GitHub.