IPv4 Transfers in 2026: YTD Data and Trends

Data through September 30, 2026 · Updated October 3, 2026 · Coverage: ARIN and RIPE NCC recipient registries

From January 1 through September 30, 2026, ARIN and RIPE NCC recipient registries recorded 65,698,816 transferred IPv4 addresses across 6,176 records. The same nine months of 2025 held 116,876,064 addresses across 6,514 records. Recorded volume was 43.8% lower, the record count 5.2% lower, and the median record size did not change at 1,024 addresses. This compares recorded transfers year to date. It is not a forecast for the full year and not a price analysis.

The main point: the two registries did not move together. ARIN volume fell 60.1%, while RIPE NCC volume rose 56.5%. The gap between the two years also holds when the biggest records, or the biggest pairs of companies, are taken out of both years. These are findings about the registry data used here, not evidence that demand fell everywhere.

What changed with September: the gap widened from 27.6% after eight months to 43.8% after nine. September 2025 alone held 31,609,632 addresses, or 27.0% of the January–September 2025 total, and 81.3% of that month came from a single pair of names, PSINet → Cogent Communications. September 2026 recorded 3,955,712.

This page keeps the same URL as each finished month is added, and it becomes the full-year report once December has closed and the snapshots cover it. Every comparison uses the same calendar months in both years. This edition covers January–September 2026 against January–September 2025.

Check the figures: download the monthly CSV, download the totals and source fingerprints as JSON, or read the counting rules.

ARIN and RIPE NCC moved in opposite directions

The combined fall of 51,177,248 addresses is a 60,404,992-address drop in ARIN, partly cancelled out by a 9,227,744-address rise in RIPE NCC.

Both volume and record count fell in ARIN and rose in RIPE NCC. So the combined figure cannot be read as a slowdown in both registries. Each transfer is counted in the registry that received it, not where the customers or the equipment are, and these figures on their own do not explain why activity changed.

The drop holds up when the biggest transfers are removed

One very large record can drive a whole year-over-year comparison on its own. The first check is what happens to the change when that record is taken out of both years.

The biggest single record made up 14.4% of volume in the 2025 period, against 3.2% in 2026. Take the biggest record out of each year and 63,601,664 addresses remain in 2026 against 100,098,848 in 2025 — still 36.5% lower. Take out the five biggest records and 56,261,632 remain against 74,933,024, or 24.9% lower.

Counting by pairs of companies instead of by single records gives a second view. A pair here is one published sender name and one published recipient name, with all their records added together.

A handful of very large 2025 records explains part of the headline fall, but not all of it. These figures only show what is left after the biggest transfers are taken out. They do not reveal an “underlying” market, and they do not say why the change happened.

The monthly path was uneven

The nine-month total hides how different the months were. June had the highest address volume, at 12,860,160, and March the lowest, at 2,822,528 — more than four times apart. September was the second-lowest, at 3,955,712. By record count, though, July led with 756 and March was close behind with 752. Calling March the quietest month would miss how many records it held.

A different pair of companies stood behind each of the heaviest months, so this was not one steady pattern. Vodafone Italia → Fastweb made up 80.8% of January, T-Mobile USA → Amazon.com made up 79.3% of February, and Frontier Communications of America → Verizon Business made up 66.1% of August. September had no dominant pair: the largest, BT Americas → Transaction Network Services, held 17.5% of the month across 18 records.

The largest pairs of companies

Grouping the records by the exact sender and recipient names published in the logs shows where the year-to-date volume sat.

The five biggest pairs together held 43.4% of year-to-date volume, down from 55.3% a year earlier. The single biggest pair held 14.0%, against 22.0% for PSINet → Cogent Communications in 2025. On both of these name-based measures, volume was spread across more participants in 2026 than in 2025. Neither measure says how ownership is spread across corporate groups.

Two details matter for reading this table. Names are grouped exactly as published, so the two Frontier entities stay separate and no subsidiary is folded into a parent company. And the record counts show why calling any of these rows “one deal” is misleading — the largest Frontier pair is spread over 72 records, while T-Mobile and Amazon moved more addresses in 10.

More M&A-labelled records, smaller M&A volume share

Records labelled MERGER_ACQUISITION rose from 1,576 to 2,001, an increase of 27.0%. Their share of volume moved the other way, falling from 64.2% to 42.6%: 28,003,968 addresses, against 75,002,624 a year earlier. More records under that label did not mean more transferred addresses.

The registry label and the corporate calendar are also two different things. Frontier’s customer bulletin places the closing of the Verizon acquisition on January 20, 2026. The transfer dates recorded for related names fall months later; they should not be described as new corporate closings in those months. The 2025 comparison has a sharper case: all 140 PSINet → Cogent Communications records are dated September 23, 2025, while Cogent’s annual report for 2002 states that its purchase of certain PSINet assets closed on April 2, 2002. The logs do not say which agreement those records relate to. This report uses MERGER_ACQUISITION as published rather than independently reconstructing each corporate event.

Small blocks appeared in more records

Canonical /24 blocks accounted for 569,088 addresses year to date, against 523,520 a year earlier. Records containing a /24 rose from 1,994 to 2,167, and their share of all records from 30.6% to 35.1%.

Two cautions apply to the size figures. Ranges inside each record are merged and then split into canonical CIDR blocks, so one record can hold several sizes at once, and the record shares for different sizes must never be added together. And a canonical /24 is an address range, not a sales lot — the CIDR chart shows the arithmetic behind prefix sizes.

A named AI-cloud recipient, not a measure of AI demand

On June 17 the ARIN snapshot records 3,145,728 addresses across two records from The Prudential Insurance Company of America to CoreWeave, Inc, a company that describes its business as AI cloud infrastructure. That is a named recipient and a measured volume.

One transfer does not prove an AI buying wave. The logs do not say what industry a company is in, and they do not link subsidiaries to their parents, so they cannot support a wider count. That work can be done separately, but the industry labels, the coverage and the sources behind them would have to be written down. The transfer itself does not say what the address space is used for.

What the data supports, and what it does not

Nine months of records support a narrow reading: combined volume was lower, ARIN and RIPE NCC moved in opposite directions, the median record size did not change, and the biggest name and the top five names held less of the volume than a year earlier. How large the fall looks depends heavily on which months are compared: adding September widened the gap by about 16 percentage points, and nearly all of that came from records dated a single day in September 2025. The combined fall stays in place when the same biggest transfers are removed from both years. Those checks show the finding does not rest on one large record. They say nothing about the economic reason behind it.

Four things stay out of reach. Registry data holds no prices and no contract terms. It does not say why a buyer acted. The number of corporate deals cannot be counted from records or from grouped names. And volume is the sum of address movements in the period, not a count of unique addresses that changed hands, because the same space can move more than once.

If you need the process rather than the market data, our guide to how IPv4 transfers work at each RIR covers the process, while IPv4 acquisition support and seller-side transfer help cover the transaction itself.

Coverage, snapshots and counting rules

Sources: ARIN NRO transfer log and RIPE NCC NRO transfer log, using snapshots archived on October 3, 2026 (ARIN 03:59 UTC, RIPE NCC 18:00 UTC).

The versioned JSON holds both periods, the monthly series, the size breakdown, the largest pairs of names (counterparty_groups), the calculation version and SHA-256 fingerprints of the source documents. The monthly CSV holds the headline series. The January–August edition stays available as JSON and CSV. These files let readers check the published arithmetic; rebuilding individual records needs the archived snapshots, because the live RIR links may already serve a newer edition.

• Unit of count. A “record” is a registry record, not a proven purchase or corporate transaction.
• Coverage. Recipient-registry records in ARIN and RIPE NCC, including incoming inter-RIR records. Only the receiving registry’s entry is counted. Transfers received by APNIC, LACNIC or AFRINIC are left out; transfers from those registries into ARIN or RIPE NCC are counted where the recipient recorded them. This says which registry recorded the transfer, not where the end users are.
• Period. January 1 to September 30 in each year, compared like for like.
• Duplicates. Records that share a UTC timestamp, RIR direction, canonical ranges, transfer type and published sender and recipient names are counted once. Different timestamps or different names stay separate, including repeated movements of the same space. ARIN’s decimal octets with leading zeros are normalized before counting.
• Sizes. Ranges within a record are merged and split into canonical CIDR blocks before size shares are worked out.
• Names. Pairs of names are taken exactly as published and are not a verified count of corporate events.
• Revisions. RIRs may revise past snapshots, so this analysis is tied to the archived inputs above, not to whatever the live files hold today.

Update log

Published figures are not edited silently: when a monthly update changes an earlier number, the change is recorded in this log.