{"id":34057,"date":"2019-10-31T21:56:11","date_gmt":"2019-10-31T18:56:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr\/"},"modified":"2019-10-31T21:56:11","modified_gmt":"2019-10-31T18:56:11","slug":"u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr","title":{"rendered":"A hacker had 735,000 IPv4 addresses taken away and returned to the registry.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"A
\nRegional internet registries and their service areas. The described fraud occurred in the ARIN zone.<\/i><\/p>\n

In the early days of the Internet, IPv4 addresses were distributed to everyone in large subnets. But today, companies are lining up at the regional registrar to acquire even a small address space. On the black market, one IP costs between $13 and $25, so registrars are battling numerous shadow brokers, whose business is simple: to obtain new blocks of IP addresses under false pretenses, and then resell them to spammers. In May 2019, the regional registrar ARIN managed to seize IP addresses from a shadow broker.<\/a><\/noindex>, who has been criminally charged.<\/p>\n

About 735,000 IP addresses were returned to the registry. This is the first case where IP addresses have been seized from scammers following a court proceeding.
\n<\/a><\/noindex>
\nOn May 14, the South Carolina prosecutor charged Amir Golestan with fraud using electronic communication (wire fraud), which he committed through his firm Micfo LLC and a network of shell companies. Subnets of IPv4 were registered in their names, and then resold to spammers.<\/a><\/noindex>.<\/p>\n

\u00cen In the statement of the criminal case<\/a><\/noindex> 20 cases of fraud were listed. In some instances, the price at which Golestan sold the addresses was indicated. For example, one subnet of 65,536 addresses was sold for $13 each, earning $851,896. He also had another contract to sell 327,680 addresses for $19 each for a total of $6.22 million, but the last transaction was blocked.<\/p>\n

Interestingly, Micfo itself initiated a lawsuit at the end of last year, suing ARIN (the American Internet Number Registrar). Before that, the registrar informed Golestan about the discovery of shell companies and threatened to revoke about 735,000 IP addresses if Micfo did not agree to provide more information about its operations and clients.<\/p>\n

Since by that time Micfo had already sold part of the addresses to spammers, it refused to provide this information. As a result, the court rejected the company's request.<\/a><\/noindex>.<\/p>\n

\u00cens\u0103, conform contractului semnat de Micfo cu ARIN, orice disput\u0103 ulterioar\u0103 trebuia solu\u021bionat\u0103 prin arbitraj. Pe 13 mai, comisia de arbitraj a obligat Micfo s\u0103 pl\u0103teasc\u0103 350.000 USD pentru serviciile juridice ale ARIN \u0219i s\u0103 returneze 735.000 de adrese IP pe care compania nu le-a v\u00e2ndut \u00eenc\u0103.<\/p>\n

Iat\u0103 o list\u0103 cu unele companii fictive \u0219i personaje inventate pe care Golestan le-a creat pentru a distribui subre\u021bele IPv4 (din documentele judiciare):<\/p>\n

\"A
\nPentru companii \u0219i personaje fictive erau create website-uri, se \u00eenregistrau adrese de email \u0219i a\u0219a mai departe. \u00cen numele lor, erau trimise cereri la ARIN pentru ob\u021binerea subre\u021belor IPv4. \u00centr-o astfel de cerere, compania trebuie s\u0103 descrie natura activit\u0103\u021bilor sale, s\u0103 listeze numele angaja\u021bilor \u0219i alte informa\u021bii despre firm\u0103. Golestan a falsificat toate documentele.<\/p>\n

Prin aceast\u0103 schem\u0103, el a ob\u021binut de la ARIN aproximativ 757.760 de adrese, valoarea de pia\u021b\u0103 a c\u0103rora a fost estimat\u0103 de procuratur\u0103 \u00eentre 9.850.880 USD \u0219i 14.397.440 USD. Schema a func\u021bionat din 2014. \u00cen tabelul de mai jos sunt enumerate cererile de succes la ARIN pentru alocarea de intervale IP, iar Golestan a \u00eenceput s\u0103 v\u00e2nd\u0103 adresele din 2017.<\/p>\n

\"A
\nConform comunicatului de pres\u0103 ARIN<\/a><\/noindex>, Micfo a \u00eenregistrat 11 companii fictive pe \u00eentreg teritoriul SUA \u0219i a creat inten\u021bionat identit\u0103\u021bi false pentru persoanele fictive ale acestor companii, pentru a ob\u021bine \u00een mod fraudulos resursele IPv4 de la ARIN.<\/p>\n

\u201eA fost o opera\u021biune complex\u0103, \u2014 a spus<\/a><\/noindex> Stephen Ryan, fost procuror federal, care a reprezentat interesele ARIN \u00een acest proces. \u2014 Toate cele unsprezece companii fictive pentru Micfo sunt \u00eenc\u0103 pe internet, unde vede\u021bi to\u021bi ace\u0219ti oameni minuna\u021bi care pretind c\u0103 lucreaz\u0103 acolo. \u0218i noi primeam declara\u021bii oficiale notariale pentru aceste nume fictive.\u201d<\/p>\n

Exper\u021bii independen\u021bi spun c\u0103 Micfo nu este singurul broker umbr\u0103 care a ob\u021binut fraudulos subre\u021bele de la ARIN. De-a lungul anilor, Registrul American de Numere Internet nu a luptat foarte activ \u00eempotriva fraudei.<\/p>\n

Este posibil ca schemele cu companii fictive s\u0103 func\u021bioneze \u0219i \u00een Rusia, de\u0219i nu au avut loc astfel de exproprieri masive de subre\u021bele de la brokerii umbra. Pentru a solicita ob\u021binerea unui bloc \/22 de adrese IPv4 de la registrul european RIPE NCC, trebuie s\u0103 te \u00eenregistrezi ca registru local de internet<\/a><\/noindex> (LIR) \u0219i a pl\u0103ti taxa de membru. Statutul LIR este de obicei ob\u021binut de furnizorii de internet, companiile de telecomunica\u021bii, mari companii \u0219i institute academice. LIR-urile primesc blocuri de adrese de la RIPE NCC \u0219i aloc\u0103 IP-uri clien\u021bilor lor.<\/p>\n

\u00cen Rusia, exist\u0103 companii de consultan\u021b\u0103 care ajut\u0103 clien\u021bii s\u0103 \u00eenregistreze LIR la un cost modest de aproximativ 36.000 RUB (plus 15.000 RUB pentru suport anual). Este evident c\u0103 pre\u021bul unui bloc \/22 de adrese IPv4 este mult mai mare, chiar \u0219i la estimarea minim\u0103 de 12 USD pe unitate. Blocurile \/22 sunt v\u00e2ndute \u0219i \u00eenchiriate<\/a><\/noindex>.<\/p>\n

Este foarte posibil ca cineva s\u0103 se ocupe de un astfel de business. Pe statisticile din perioada 2012\u22122018<\/a><\/noindex>, rata aloc\u0103rii adreselor IPv4 \u00een Europa a crescut conform unei func\u021bii cuadratice. RIPE NCC explic\u0103 c\u0103 tot mai mul\u021bi registratori locali s-au \u00eenregistrat. Un num\u0103r record de LIR-uri noi a fost \u00eenregistrat \u00een Regatul Unit, Germania \u0219i Rusia.<\/p>\n

\"A
\n
\n\u00cen noiembrie 2015, RIPE a interzis \u00eenregistrarea de noi registratori locali de c\u0103tre membrii RIPE NCC<\/a><\/noindex>, dar acest lucru nu a ajutat, a\u0219a c\u0103 \u00een mai 2016 restric\u021bia a fost ridicat\u0103. La acea vreme, organiza\u021biile au \u00eenceput s\u0103 \u00eenregistreze noi entit\u0103\u021bi juridice pentru a ob\u021bine blocuri \/22. Se raportase c\u0103 un membru RIPE NCC a reu\u0219it s\u0103 ob\u021bin\u0103 66 de blocuri \/22, de\u0219i se alocau doar c\u00e2te unul pentru fiecare registrar local.<\/p>\n

Acum un an, RIPE a anun\u021bat distribuirea ultimului bloc \/22 din ultimul bloc \/8<\/a><\/noindex>, dar \u00een rezerva RIPE NCC au r\u0103mas 9 milioane<\/a><\/noindex> \"recuperate\" (adic\u0103 adrese luate de la fo\u0219ti proprietari). Potrivit Centrului de Coordonare, acestea vor fi suficiente pentru \u00eenc\u0103 aproximativ doi ani, dac\u0103 se aloc\u0103 c\u00e2te un bloc \/22 fiec\u0103rui registrator local.<\/p>\n

Foarte multe organiza\u021bii au \u00eenregistrat un num\u0103r imens de intervale IPv4 care, \u00een prezent, nu sunt practicat folosite \u0219i nu inten\u021bioneaz\u0103 s\u0103 fie returnate (de exemplu, 16,8 milioane de adrese \u00een blocul 44.0.0.0\/8, \u00eenregistrate pretins pentru radioamatorism<\/a><\/noindex>, sau 218 milioane de adrese IP la Ministerul Ap\u0103r\u0103rii al SUA: 11.0.0.0\/8, 22.0.0.0\/8, 26.0.0.0\/8, 28.0.0.0\/8, 29.0.0.0\/8, 30.0.0.0\/8 \u0219i 33.0.0.0\/8).<\/p>\n

Alte blocuri sunt utilizate foarte intensiv. De exemplu, vizualizarea prin curbe Hilbert<\/a><\/noindex> arat\u0103 bine cum este distribuit spa\u021biul de adrese din cele aproximativ 4,2 miliarde (2\u00b3\u00b2) adrese.<\/p>\n

\"A<\/a><\/noindex>
\nDistribu\u021bia spa\u021biului de adrese IPv4, aprilie 2018 (clicabil\u0103<\/a><\/noindex>)<\/i><\/p>\n

Pentru compara\u021bie, iat\u0103 cum arat\u0103 distribu\u021bia spa\u021biului de adrese IPv6.<\/p>\n

\"A
\nDistribu\u021bia spa\u021biului de adrese IPv6, aprilie 2018<\/i><\/p>\n

\n\"A<\/a><\/noindex>
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u0443\u0440\u044b \u0438 \u0437\u043e\u043d\u044b \u0438\u0445 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u044f. \u041e\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e \u0432 \u0437\u043e\u043d\u0435 ARIN \u0412 \u0440\u0430\u043d\u043d\u0438\u0435 \u0434\u043d\u0438 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0430\u0434\u0440\u0435\u0441\u0430 IPv4 \u0440\u0430\u0437\u0434\u0430\u0432\u0430\u043b\u0438 \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c \u0431\u043e\u043b\u044c\u0448\u0438\u043c\u0438 \u043f\u043e\u0434\u0441\u0435\u0442\u044f\u043c\u0438. \u041d\u043e \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u044b\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043a \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443, \u0447\u0442\u043e\u0431\u044b \u0440\u0430\u0437\u0434\u043e\u0431\u044b\u0442\u044c \u0445\u043e\u0442\u044c \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u043e. \u041d\u0430 \u0447\u0451\u0440\u043d\u043e\u043c \u0440\u044b\u043d\u043a\u0435 \u043e\u0434\u0438\u043d IP \u0441\u0442\u043e\u0438\u0442 \u043e\u0442 $13 \u0434\u043e $25, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0431\u043e\u0440\u044e\u0442\u0441\u044f \u0441 \u043c\u0430\u0441\u0441\u043e\u0439 \u0442\u0435\u043d\u0435\u0432\u044b\u0445 \u0431\u0440\u043e\u043a\u0435\u0440\u043e\u0432, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25709,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34057","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Fraudatorului i-au fost confiscate 735 000 de adrese IPv4 \u0219i au fost returnate \u00een registru | ProHoster","description":"Regionale.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u043a\u0430 \u043e\u0442\u043e\u0431\u0440\u0430\u043b\u0438 735 000 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4 \u0438 \u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0432 \u0440\u0435\u0435\u0441\u0442\u0440 | ProHoster","og:description":"\u0420\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:56:11+00:00","article:modified_time":"2019-10-31T18:56:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34057","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 17:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:29:42","updated":"2026-01-21 17:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/34057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=34057"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/34057\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/25709"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=34057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=34057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=34057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}