Live data from Hacker News

Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

circleid.com

11–20 of 155 posts

Re: Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

#11
What is interesting to me is that you can’t really “revoke” an IP. ARIN’s authority really only comes from ISPs that listen to their recommendations in creating prefix filters.

ARIN doesn’t give you any rights to an IP, because there is no such thing.

Re: Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

#12
post #2

I always wondered if someone had created a biz for the purpose of hoarding IPv4 with intent to “sell them”. We talked about this kind of abuse back in the 90s when I worked for a hosting company. Part of my job was filling out ARIN templates and SWIP and all that nonsense. Justification was easy, but it occurred to me how easy it would be to fake requests and just pay the trivial fees. There were already some busines…

There is an active, mature market for IPv4 addresses (just google "IPv4 address broker"), so it stands to reason that there are people hoarding them for speculation.

It's not free money, of course -- it's entirely possible that the value goes down, as things that reduce the pressure on the IPv4 address space slowly come online (CGNAT and IPv6)

That said, I'm a bit confused by this story. ARIN ran out of addresses in 2015, and it was my impression that since then you can't just get IPv4 addresses for free from them, which is why the above-mentioned markets exist. So, how were they able to keep running this scam after 2015?

Re: Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

#13
post #11

What is interesting to me is that you can’t really “revoke” an IP. ARIN’s authority really only comes from ISPs that listen to their recommendations in creating prefix filters. ARIN doesn’t give you any rights to an IP, because there is no such thing.

ARIN controls WHOIS which is relevant since this fraudster was selling the IPs. If I was buying some IP space I would certainly check WHOIS to see if the seller owns what they are selling.

Also, it seems like the Microsoft/Nortel case established that there is some such thing as ownership rights over IPs.

Re: Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

#14
post #11

What is interesting to me is that you can’t really “revoke” an IP. ARIN’s authority really only comes from ISPs that listen to their recommendations in creating prefix filters. ARIN doesn’t give you any rights to an IP, because there is no such thing.

It's an example of human cooperation for a greater good.

Re: Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

#15

I've often wondered how much of the IPv4 address space is legacy allocations that are not at all being fully utilized. Perhaps the market for IPv4 addresses has worked this out, and anyone that has such an allocation has cashed in.

The IPs in question were directly assigned to the defendant by ARIN based on fraudulent requests. They weren't fraudulently transferred from existing allocations.

Re: Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

#17
post #2

I always wondered if someone had created a biz for the purpose of hoarding IPv4 with intent to “sell them”. We talked about this kind of abuse back in the 90s when I worked for a hosting company. Part of my job was filling out ARIN templates and SWIP and all that nonsense. Justification was easy, but it occurred to me how easy it would be to fake requests and just pay the trivial fees. There were already some busines…

There is an active, mature market for IPv4 addresses (just google "IPv4 address broker"), so it stands to reason that there are people hoarding them for speculation. It's not free money, of course -- it's entirely possible that the value goes down, as things that reduce the pressure on the IPv4 address space slowly come online (CGNAT and IPv6) That said, I'm a bit confused by this story. ARIN ran out of addresses in…

Though they ran out of "new" allocations, ARIN is still assigning addresses, apparently from those that are "recycled" / returned to the pool. See https://lists.arin.net/pipermail/arin-issued/ for recent assignments.

Re: Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

#18

Is ARIN going to assign these to people who are waiting? I certainly haven't seen 2960 /24s being released. They have NOT announced anything like this. Maybe they will "transfer" them for $13 to $19 per IP with a third party facilitator?

I would imagine it would be prudent to wait a bit before reassigning these, in case of appeal.
Post reply on HN