{"id":34057,"date":"2019-10-31T21:56:11","date_gmt":"2019-10-31T18:56:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr\/"},"modified":"2019-10-31T21:56:11","modified_gmt":"2019-10-31T18:56:11","slug":"u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr","title":{"rendered":"En bedragare fick 735 000 IPv4-adresser konfiskerade och de \u00e5terl\u00e4mnades till registret.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"En
\nRegional internet registries and their service areas. The described fraud occurred in the ARIN zone.<\/i><\/p>\n

In the early days of the Internet, IPv4 addresses were distributed to anyone who wanted them in large blocks. But today, companies are lining up at the regional registrar to obtain even a small address space. On the black market, one IP costs between $13 and $25, so registrars are battling numerous shadow brokers, whose business is simple: to acquire new blocks of IP addresses under false pretenses and then resell them to spammers. In May 2019, the regional registrar ARIN managed to reclaim IP addresses from a shadow broker<\/a><\/noindex>, who faced criminal charges.<\/p>\n

Approximately 735,000 IP addresses were returned to the registry. This is the first case where IP addresses have been reclaimed from fraudsters following a legal proceeding.
\n<\/a><\/noindex>
\nOn May 14, the South Carolina Attorney's Office charged Amir Golestan with wire fraud, which he orchestrated through his company Micfo LLC and a network of shell companies. They were registered with IPv4 subnets and then resold to spammers.<\/a><\/noindex>.<\/p>\n

I The criminal complaint<\/a><\/noindex> lists 20 instances of fraud. In some cases, the price at which Golestan sold the addresses is indicated. For example, he sold one subnet of 65,536 addresses for $13 each, totaling $851,896. He had another contract for the sale of 327,680 addresses for $19 each, amounting to $6.22 million, but that last transaction was blocked.<\/p>\n

Interestingly, Micfo initiated litigation itself at the end of last year, suing ARIN (the American Registry for Internet Numbers). Prior to this, the registrar had informed Golestan about the discovery of shell companies and threatened to revoke approximately 735,000 IP addresses if Micfo did not agree to provide more information about its operations and clients.<\/p>\n

By that time, since Micfo had already sold part of the addresses to spammers, it refused to provide this information. As a result, the court dismissed the company's request.<\/a><\/noindex>.<\/p>\n

However, under the agreement signed by Micfo with ARIN, any further disputes were to be settled through arbitration. On May 13, the arbitration panel ordered Micfo to pay $350,000 for ARIN's legal fees and return 735,000 IP addresses that the company had not yet sold.<\/p>\n

H\u00e4r \u00e4r en lista \u00f6ver n\u00e5gra av de falska f\u00f6retagen och p\u00e5hittade personerna som Golestan skapade f\u00f6r att distribuera IPv4-subn\u00e4t (fr\u00e5n r\u00e4ttsdokument):<\/p>\n

\"En
\nF\u00f6r dessa f\u00f6retag och p\u00e5hittade personer skapades webbplatser, registrerades e-postadresser och s\u00e5 vidare. \u00c5t deras v\u00e4gnar skickades f\u00f6rfr\u00e5gningar till ARIN om att f\u00e5 IPv4-subn\u00e4t. I en s\u00e5dan f\u00f6rfr\u00e5gan m\u00e5ste f\u00f6retaget beskriva sin verksamhet, lista namn p\u00e5 anst\u00e4llda och annan information om firman. Golestan f\u00f6rfalskade alla dokument.<\/p>\n

Genom detta system fick han cirka 757 760 adresser fr\u00e5n ARIN, vars marknadsv\u00e4rde \u00e5klagarmyndigheten uppskattade till mellan 9 850 880 och 14 397 440 dollar. Systemet har varit aktivt sedan 2014. Tabellen nedan listar framg\u00e5ngsrika f\u00f6rfr\u00e5gningar till ARIN om tilldelning av IP-omr\u00e5den, och Golestan b\u00f6rjade s\u00e4lja adresser fr\u00e5n 2017.<\/p>\n

\"En
\nEnligt pressmeddelande fr\u00e5n ARIN<\/a><\/noindex>, Micfo registrerade 11 falska f\u00f6retag \u00f6ver hela USA och skapade avsiktligt falska identiteter f\u00f6r de p\u00e5hittade ledarna f\u00f6r dessa f\u00f6retag f\u00f6r att bedr\u00e4gligt f\u00e5 IPv4-resurser fr\u00e5n ARIN.<\/p>\n

\"Det var en komplex operation, \u2014 sade<\/a><\/noindex> Stephen Ryan, tidigare federal \u00e5klagare som representerade ARIN i denna r\u00e4ttsprocess. \u2014 Alla elva falska f\u00f6retag f\u00f6r Micfo finns fortfarande p\u00e5 internet, d\u00e4r du ser alla dessa fantastiska m\u00e4nniskor som p\u00e5st\u00e5s arbeta d\u00e4r. Och vi fick notariserade intyg p\u00e5 dessa p\u00e5hittade namn.\"<\/p>\n

Oberoende experter s\u00e4ger att Micfo inte \u00e4r den enda skuggm\u00e4klaren som bedr\u00e4gligt har f\u00e5tt subn\u00e4t fr\u00e5n ARIN. Under m\u00e5nga \u00e5r har den amerikanska internetnummerregistratorn inte varit s\u00e4rskilt aktiv i kampen mot bedr\u00e4gerier.<\/p>\n

Det \u00e4r m\u00f6jligt att systemen med falska f\u00f6retag ocks\u00e5 fungerar i Ryssland, \u00e4ven om det inte har f\u00f6rekommit s\u00e5dana massuttag av subn\u00e4t fr\u00e5n skuggm\u00e4klare \u00e4nnu. F\u00f6r att kunna ans\u00f6ka om en block \/22 av IPv4-adresser hos den europeiska registratorn RIPE NCC m\u00e5ste man registrera sig som en lokal internetregistrator<\/a><\/noindex> (LIR) och betala en medlemsavgift. LIR-status ges vanligtvis till internetleverant\u00f6rer, telekommunikationsf\u00f6retag, stora f\u00f6retag och akademiska institutioner. LIR f\u00e5r block av adresser fr\u00e5n RIPE NCC och tilldelar IP-adresser till sina klienter.<\/p>\n

I Ryssland finns det konsultf\u00f6retag som hj\u00e4lper kunder att registrera LIR till en l\u00e5g kostnad runt 36 000 RUB (plus 15 000 RUB \u00e5rlig support). Det \u00e4r uppenbart att kostnaden f\u00f6r ett block av \/22 IPv4-adresser \u00e4r mycket h\u00f6gre, \u00e4ven enligt en minimal uppskattning av $12 per styck. Block av \/22 s\u00e4ljs och hyrs ut<\/a><\/noindex>.<\/p>\n

Det \u00e4r mycket m\u00f6jligt att n\u00e5gon bedriver s\u00e5dan verksamhet. Enligt statistik fr\u00e5n \u00e5ren 2012\u22122018<\/a><\/noindex>, v\u00e4xte hastigheten p\u00e5 tilldelningen av IPv4-adresser i Europa i enlighet med en kvadratisk funktion. RIPE NCC f\u00f6rklarar detta med att allt fler lokala registrarer registrerades. Det rekordantal nya LIR registrerades i Storbritannien, Tyskland och Ryssland.<\/p>\n

\"En
\n
\nI november 2015 f\u00f6rbj\u00f6d RIPE registrering av ytterligare lokala registrarer av medlemmar i RIPE NCC<\/a><\/noindex>, men detta hj\u00e4lpte inte, s\u00e5 i maj 2016 h\u00e4vdes begr\u00e4nsningen. Vid den tiden b\u00f6rjade organisationer registrera nya juridiska enheter f\u00f6r att f\u00e5 block av \/22. En medlem av RIPE NCC s\u00e4gs ha lyckats f\u00e5 66 block av \/22, \u00e4ven om det endast utf\u00e4rdades ett av varje lokal registrator.<\/p>\n

F\u00f6r ett \u00e5r sedan meddelade RIPE om f\u00f6rdelningen av det sista blocket av \/22 fr\u00e5n det sista blocket av \/8<\/a><\/noindex>, men i RIPE NCC:s pool \u00e5terstod 9 miljoner<\/a><\/noindex> \u00ab\u00e5terst\u00e4llda\u00bb adresser (det vill s\u00e4ga adresser som tagits tillbaka fr\u00e5n tidigare \u00e4gare). Enligt ber\u00e4kningar fr\u00e5n Koordineringscentret kommer detta att r\u00e4cka i ytterligare cirka tv\u00e5 \u00e5r, om lokala registratorer f\u00e5r ett \/22 var.<\/p>\n

M\u00e5nga organisationer har registrerat stora IPv4-intervall som knappt anv\u00e4nds och som de inte avser att avyttra (till exempel 16,8 miljoner adresser i blocket 44.0.0.0\/8, registrerat p\u00e5st\u00e5tt f\u00f6r amat\u00f6rradio<\/a><\/noindex>, eller 218 miljoner IP-adresser hos USA:s f\u00f6rsvarsministerium: 11.0.0.0\/8, 22.0.0.0\/8, 26.0.0.0\/8, 28.0.0.0\/8, 29.0.0.0\/8, 30.0.0.0\/8 och 33.0.0.0\/8.)<\/p>\n

Andra block anv\u00e4nds mycket intensivt. Till exempel visualisering med Hilbert-kurvor<\/a><\/noindex> visar tydligt hur adressutrymmet \u00e4r f\u00f6rdelat bland cirka 4,2 miljarder (2\u00b3\u00b2) adresser.<\/p>\n

\"En<\/a><\/noindex>
\nF\u00f6rdelning av IPv4-adressutrymmet, april 2018 (klickbar<\/a><\/noindex>)<\/i><\/p>\n

F\u00f6r j\u00e4mf\u00f6relse, s\u00e5 h\u00e4r ser f\u00f6rdelningen av IPv6-adressutrymmet ut.<\/p>\n

\"En
\nF\u00f6rdelning av IPv6-adressutrymmet, april 2018<\/i><\/p>\n

\n\"En<\/a><\/noindex>
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u0443\u0440\u044b \u0438 \u0437\u043e\u043d\u044b \u0438\u0445 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u044f. \u041e\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e \u0432 \u0437\u043e\u043d\u0435 ARIN \u0412 \u0440\u0430\u043d\u043d\u0438\u0435 \u0434\u043d\u0438 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0430\u0434\u0440\u0435\u0441\u0430 IPv4 \u0440\u0430\u0437\u0434\u0430\u0432\u0430\u043b\u0438 \u0432\u0441\u0435\u043c \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c \u0431\u043e\u043b\u044c\u0448\u0438\u043c\u0438 \u043f\u043e\u0434\u0441\u0435\u0442\u044f\u043c\u0438. \u041d\u043e \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u044b\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043a \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443, \u0447\u0442\u043e\u0431\u044b \u0440\u0430\u0437\u0434\u043e\u0431\u044b\u0442\u044c \u0445\u043e\u0442\u044c \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u043e. \u041d\u0430 \u0447\u0451\u0440\u043d\u043e\u043c \u0440\u044b\u043d\u043a\u0435 \u043e\u0434\u0438\u043d IP \u0441\u0442\u043e\u0438\u0442 \u043e\u0442 $13 \u0434\u043e $25, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0431\u043e\u0440\u044e\u0442\u0441\u044f \u0441 \u043c\u0430\u0441\u0441\u043e\u0439 \u0442\u0435\u043d\u0435\u0432\u044b\u0445 \u0431\u0440\u043e\u043a\u0435\u0440\u043e\u0432, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25709,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34057","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 En bedragare fick 735 000 IPv4-adresser beslagtagna och \u00e5terl\u00e4mnade till registret | ProHoster","description":"Regionala.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u043a\u0430 \u043e\u0442\u043e\u0431\u0440\u0430\u043b\u0438 735 000 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 IPv4 \u0438 \u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0432 \u0440\u0435\u0435\u0441\u0442\u0440 | ProHoster","og:description":"\u0420\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/u-moshennika-otobrali-735-000-adresov-ipv4-i-vernuli-v-reestr","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:56:11+00:00","article:modified_time":"2019-10-31T18:56:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34057","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 17:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:29:42","updated":"2026-01-21 17:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/34057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=34057"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/34057\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/25709"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=34057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=34057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=34057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}