Regional Internet registries and their service areas. The described fraud occurred in the ARIN zone.
In the early days of the internet, IPv4 addresses were distributed freely in large subnets. But today, companies queue up at the regional registrar to acquire even a small address space. On the black market, one IP costs between $13 and $25, leading registrars to struggle against numerous shadow brokers whose business is straightforward: obtain new blocks of IP addresses under false pretenses and then resell them to spammers. In May 2019, the regional registrar ARIN , who has been criminally charged.
Approximately 735,000 IP addresses were returned to the registry. This is the first case of IP addresses being confiscated from fraudsters after a court trial.
On May 14, the South Carolina Attorney General charged Amir Golestan with wire fraud, which he committed through his company Micfo LLC and a network of shell companies. Subnets of IPv4 were registered to them, which were then .
In lists 20 cases of fraud. In some instances, the price at which Golestan sold the addresses is mentioned. For example, he sold one subnet of 65,536 addresses for $13 each, totaling $851,896. He had another contract for the sale of 327,680 addresses at $19 each for a total of $6.22 million, but the last transaction was blocked.
Interestingly, Micfo itself initiated a lawsuit late last year against ARIN (the American Registry for Internet Numbers). Prior to this, the registrar informed Golestan of the discovery of shell companies and threatened to revoke approximately 735,000 IP addresses if Micfo did not agree to provide more information about its operations and clients.
Since by that time Micfo had already sold some addresses to spammers, it refused to provide this information. As a result, the court .
However, due to the agreement signed by Micfo with ARIN, any further disputes had to be resolved through arbitration. On May 13, the arbitration commission ordered Micfo to pay $350,000 for ARIN's legal services and to return 735,000 IP addresses that the company had not yet sold.
Here is a list of some of the shell companies and fictitious individuals fabricated by Golestan for the distribution of IPv4 subnets (from court documents):
Websites were created for the companies and fictitious individuals, email addresses were registered, and so on. Requests for IPv4 subnets were submitted to ARIN on their behalf. In such a statement, the company must describe the nature of its activities, list the names of employees, and provide other information about the firm. Golestan fabricated all the documents.
Through this scheme, he acquired approximately 757,760 addresses from ARIN, with a market value estimated by the prosecution to be between $9,850,880 and $14,397,440. The scheme had been operating since 2014. The table below lists successful requests to ARIN for the allocation of IP ranges, and Golestan began selling the addresses in 2017.
According to , Micfo registered 11 shell companies across the United States and intentionally created false identities for the fictitious executives of these companies to fraudulently extract IPv4 resources from ARIN.
"It was a complex operation," Stephen Ryan, a former federal prosecutor who represented ARIN in this case. "All eleven shell companies for Micfo are still online, where you see all these wonderful people who supposedly work there. And we obtained notarized affidavits for these fictitious names."
Independent experts say that Micfo is not the only shadow broker that has fraudulently obtained subnets from ARIN. For many years, the American Registry for Internet Numbers has not been very active in combating fraud.
It is possible that schemes with shell companies are also happening in Russia, although such mass extractions of subnets from shadow brokers have not yet occurred. To claim a block of /22 IPv4 addresses from the European registrar RIPE NCC, one must (LIR) and pay a membership fee. The LIR status is typically granted to internet service providers, telecommunications companies, large enterprises, and academic institutions. LIRs receive blocks of addresses from RIPE NCC and assign IP addresses to their clients.
Consulting companies operate in Russia that assist clients in registering an LIR for a small fee of around 36,000 rubles (plus 15,000 rubles annual support). Clearly, the cost of a /22 block of IPv4 addresses is much higher, even at a minimum estimate of $12 each. /22 blocks .
It is quite possible that someone is engaged in such a business. According to , the speed of IPv4 address allocation in Europe grew according to a quadratic function. RIPE NCC explains this by the increasing number of local registrars being registered. A record number of new LIRs were registered in the UK, Germany, and Russia.
In November 2015, RIPE , but this did not help, so in May 2016 the restriction was lifted. By that time, organizations began registering new legal entities to obtain /22 blocks. Reportedly, a certain RIPE NCC member managed to acquire 66 /22 blocks, although only one was issued for each local registrar.
A year ago, RIPE announced the , but there remained "recovered" addresses (i.e., addresses reclaimed from former owners). According to the Coordination Center's calculations, this should last for about two more years, if /22 blocks are issued to local registrars each.
Many organizations have registered enormous ranges of IPv4 addresses that they hardly use and do not intend to give up (for instance, 16.8 million addresses in the 44.0.0.0/8 block, registered , or 218 million IP addresses held by the U.S. Department of Defense: 11.0.0.0/8, 22.0.0.0/8, 26.0.0.0/8, 28.0.0.0/8, 29.0.0.0/8, 30.0.0.0/8, and 33.0.0.0/8).
Other blocks are used very intensively. For example, clearly shows how the address space from approximately 4.2 billion (2³²) addresses is distributed.
Distribution of IPv4 address space, April 2018 ()
For comparison, here is how the distribution of IPv6 address space looks.
Distribution of IPv6 address space, April 2018
Source: habr.com
