48 ms·

Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

337 points by pencilingin 7y ago

spydum 7y ago
I always wondered if someone had created a biz for the purpose of hoarding IPv4 with intent to “sell them”. We talked about this kind of abuse back in the 90s when I worked for a hosting company. Part of my job was filling out ARIN templates and SWIP and all that nonsense. Justification was easy, but it occurred to me how easy it would be to fake requests and just pay the trivial fees. There were already some businesses buying up smaller companies for access to their old legacy allocations. Then the massive cloud build ours started and IP consumption became a real concern.
- umanwizard 7y ago
  There is an active, mature market for IPv4 addresses (just google "IPv4 address broker"), so it stands to reason that there are people hoarding them for speculation. It's not free money, of course -- it's entirely possible that the value goes down, as things that reduce the pressure on the IPv4 address space slowly come online (CGNAT and IPv6) That said, I'm a bit confused by this story. ARIN ran out of addresses in 2015, and it was my impression that since then you can't just get IPv4 addresses for free from them, which is why the above-mentioned markets exist. So, how were they able to keep running this scam after 2015?
  - icedchai 7y ago
    Though they ran out of "new" allocations, ARIN is still assigning addresses, apparently from those that are "recycled" / returned to the pool. See https://lists.arin.net/pipermail/arin-issued/ https://lists.arin.net/pipermail/arin-issued/ for recent assignments.
  - Arnt 7y ago
    IIRC you can get a laughably small number from ARIN if you say the right things, and you could get a slightly less laughably number in the past. Try saying you're an ISP and all your customers are dualstack already but you need 128 v4 addresses for compatibility or CGNAT or your DNS caches or something.
    - icedchai 7y ago
      Good luck routing anything more specific than a /24 (256 addresses) globally.
    - akvadrako 7y ago
      I doubt they are assigning anybody less than a /24 - it's not globally reachable.
- alexpotato 7y ago
  This reminds me of a conversation I had with the AC repairman last year. Backstory: we have an old AC unit that uses freon. The repairman mentioned that freon is no longer available for new AC units. I asked if you could still buy freon and he said yes, existing supplies were grandfathered in. I then commented that the price of freon must have sky-rocketed and he said: "yes, it did for a while but then it became cheaper to just get a new unit rather than fill up an old unit with freon." I would imagine that as the price of IPv4 addresses crosses some threshold, people will just start going to IPv6. As Michael Crichton once said in one of his books: "There was no subsidy that caused people to switch from horses to cars". They were just cheaper and easier to operate.
  - freedomben 7y ago
    I had an 88 Chevy Pickup Truck that used the old style freon (R12). Man that stuff worked so good. In 100 degree heat that truck would stay nice and cold. It took over 20 years before the alternatives were competitive.
    - natermer 7y ago
      Propane makes a good substitute for R12 with very little modifications. I wouldn't use it inside a home or anything like that, but I have used it to make older vehicles blow cold. It's extremely good refrigerant. The biggest problem people have is that it ends up too cold and icing up the system. It sounds dangerous, but it's really not. Propane is only flammable with the correct mixture of air. Otherwise you couldn't light it with a blow torch. Even if you have a leaky system it isn't going to leak fast enough to cause a issue. Also propane is significantly heavier then air so anything that leaks out is going to go to ground. And the amount of propane you use is not very significant. Cars that end up having issues with propane are typically home built propane fuel conversions with no ventilation under the tanks or connections. The propane can then pool in the low places and build up enough to cause a explosion.
      - freedomben 7y ago
        This might be the most amazing and interesting comment I've ever seen. Thank you :-) What you say makes good sense too since many RVs have propane refrigerators. I've long wondered how it works exactly. Probably time for a DuckDuckGo search.
- iDemonix 7y ago
  I work for a UK based ISP. We have millions of unused addresses, largely because back in the 90s they were practically giving them away. We're still expanding and using up new IPs daily, but we often sell blocks when the department needs a boost...
pencilingin 7y ago
Link Updated May 15, 2019: "Charleston Man and Business Indicted in Federal Court in Over $9M Fraud" — The indictment charges that, through this scheme, defendant obtained the rights to approximately 757,760 IP addresses, with a market value between $9,850,880.00 and $14,397,440.00."
just_steve_h 7y ago
Does anyone know the address ranges that are affected?
- gruez 7y ago
  http://www.circleid.com/pdf/golstan_indict_filed_20190515.pdf http://www.circleid.com/pdf/golstan_indict_filed_20190515.pd... page 9
- pencilingin 7y ago
  Yes they are listed in the indictment document released today. Link to doc is in the updated section of the post.
- gregmac 7y ago
  Converted (OCR) from PDF: IP Block Entity Number of IP addresses ------------------- ------------------- ---------------------- 104.166.96.0/19 OppoBox 8,192 104.247.96.0/19 OppoBox 8,192 104.250.224.0/19 OppoBox 8,192 172.98.0.0/18 Telentia 16,384 174.136.192.0/18 Telentia 16,384 45.41.0.0/18 OppoBox 16,384 45.41.192.0/18 OppoBox 16,384 45.59.128.0/18 OppoBox 16,384 104.167.192.0/18 OppoBox 16,384 104.224.0.0/18 OppoBox 16,384 104.249.128.0/18 OppoBox 16,384 155.254.192.0/18 OppoBox 16,384 172.110.128.0/18 OppoBox 16,384 172.111.0.0/18 OppoBox 16,384 169.197.128.0/18 Border Technology 16,384 172.81.0.0/18 Border Technology 16,384 107.181.64.0/20 Contina 4,096 167.160.96.0/19 Contina 8,192 209.161.96.0/20 Telentia 4,096 104.128.16.0/20 Telentia 4,096 104.143.192.0/19 Telentia 8,192 104.222.192.0/19 Telentia 8,192 104.247.0.0/19 Telentia 8,192 107.190.160.0/20 OppoBox 4,096 107.182.112.0/20 OppoBox 4,096 104.207.64.0/19 OppoBox 8,192 155.254.96.0/19 OppoBox 8,192 167.88.96.0/20 Virtuzo 4,096 104.128.128.0/20 Virtuzo 4,096 104.156.192.0/19 Virtuzo 8,192 104.222.128.0/19 Virtuzo 8,192 104.143.16.0/20 Roya 4,096 104.237.80.0/20 Univera Network 4,096 45.62.32.0/19 Univera Network 8,192 45.61.32.0/20 Border Technology 4,096 173.44.0.0/19 Border Technology 8,192 172.97.80.0/20 Fiber Galaxy 4,096 206.223.224.0/19 Fiber Galaxy 8,192 172.102.128.0/20 Queen Systems 4,096 209.209.224.0/19 Queen Systems 8,192 172.110.208.0/20 Fairway Network 4,096 207.189.0.0/19 Fairway Network 8,192
rmbryan 7y ago
UPDATE May 15, 2019: "Charleston Man and Business Indicted in Federal Court in Over $9M Fraud" – United States Department of Justice issues a statement annoucing Amir Golestan, 36, of Charleston, and Micfo, LLC, were charged in federal court in a twenty-count indictment. The indictment charges twenty counts of wire fraud, with each count punishable by up to 20 years imprisonment.
jonawesomegreen 7y ago
I've often wondered how much of the IPv4 address space is legacy allocations that are not at all being fully utilized. Perhaps the market for IPv4 addresses has worked this out, and anyone that has such an allocation has cashed in.
- icedchai 7y ago
  There are tons of legacy allocations from the 90's and earlier than are not being routed / utilized. Many are also assigned to defunct entities. To confirm this, you can poke around WHOIS a little bit. Because many of them actually predate ARIN's formation in 1997, they are considered "legacy" allocations and aren't charged a fee by ARIN unless the organization has opted into an agreement.
- toast0 7y ago
  The IPs in question were directly assigned to the defendant by ARIN based on fraudulent requests. They weren't fraudulently transferred from existing allocations.
  - jonawesomegreen 7y ago
    Thank you. I misread the article. I edited my post to take out the incorrect part.
- brianwawok 7y ago
  For enough dollars you can sample 100k address at random and have a decent guess? Not everyone responds to a ping but I suspect most do
  - freedomben 7y ago
    ICMP is blocked by default now in many firewall setups, so unless the admin specifically allows ICMP the packets will likely be dropped. Also, be careful as "host discovery" can be viewed as a type of "hacking" depending on who you are and who is watching/judging you.
chriscappuccio 7y ago
Is ARIN going to assign these to people who are waiting? I certainly haven't seen 2960 /24s being released. They have NOT announced anything like this. Maybe they will "transfer" them for $13 to $19 per IP with a third party facilitator?
- toast0 7y ago
  I would imagine it would be prudent to wait a bit before reassigning these, in case of appeal.
sneak 7y ago
What is interesting to me is that you can’t really “revoke” an IP. ARIN’s authority really only comes from ISPs that listen to their recommendations in creating prefix filters. ARIN doesn’t give you any rights to an IP, because there is no such thing.
- wmf 7y ago
  ARIN controls WHOIS which is relevant since this fraudster was selling the IPs. If I was buying some IP space I would certainly check WHOIS to see if the seller owns what they are selling. Also, it seems like the Microsoft/Nortel case established that there is some such thing as ownership rights over IPs.
- jcoffland 7y ago
  It's an example of human cooperation for a greater good.
bvdba 7y ago
If we could recover all IP addresses that are not in use now (especially from those who got a /8) we would breath some air, given that ipv6 is basically not happening.
- martindale 7y ago
  It's used widely in meshnets.
- icedchai 7y ago
  How is IPv6 not happening? Google shows pretty good growth: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
  - metalliqaz 7y ago
    It's interesting that the number fluctuates so much every weekend. I guess it's caused by people accessing the Internet from home instead of from the office. It's more than I expected.
  - freedomben 7y ago
    I've been seeing more and more pressure to support IPv6 in the various SaaS companies I've worked at. I do think it's happening. That said I tend to think LANs and VPCs will continue to use IPv4 internally for decades even if the load balancer does IPv6.
    - fermuch 7y ago
      I'm at a home connection from a normal provider on brasil (third world country) and my router assigns a public ipv6 for each connection. I think all big providers have ipv6 enabled by default over here.
      - freedomben 7y ago
        Do they also provide an IPv4 address? If not, have you run into any problems with sites that don't yet support IPv6?
nowandlater 7y ago
For anyone interested, this a pretty good write up on "Bogons": http://www.potaroo.net/ispcol/2004-04/2004-04-isp.htm http://www.potaroo.net/ispcol/2004-04/2004-04-isp.htm
martindale 7y ago
IPv4 lives!
codexon 7y ago
Anyone here know a good place to buy or lease ipv4? Is this going to lower the prices?
- wmf 7y ago
  https://www.arin.net/resources/registry/transfers/stls/registered_facilitators/ https://www.arin.net/resources/registry/transfers/stls/regis... This looks like a blip compared to demand so I wouldn't expect prices to drop.
  - codexon 7y ago
    This seems like a huge amount of addresses to me, the price should drop if supply goes up. I don't expect it to tank though. Is there a recommended broker or website? I googled a few of those "transfer facilitators" and they looked sketchy to me with many of them asking you to contact them for a price.
_JamesA_ 7y ago
Not sure if it's related or not but I was receiving spammy e-mails for a while from "Admiral Hosting": "Mike Watson here, from Admiral Hosting. I'm touching base regarding a business opportunity. Have you ever thought about turning your IP's into profit on a monthly basis? Admiral Hosting handles dozens of such B2B projects and its dedicated technical team oversees each project’s implementation."
gwbas1c 7y ago
Am I the only person who gets an HTTPS error when trying to open the link to circleid.com?
- cesarb 7y ago
  The link is http, so you're using something (perhaps HTTPS Everywhere?) which is converting it to an https link. According to the Qualys SSL tester (https://www.ssllabs.com/ssltest/analyze.html?d=www.circleid.com https://www.ssllabs.com/ssltest/analyze.html?d=www.circleid....), the IPv6 server for www.circleid.com has "Certificate not valid for domain name" (and the IPv4 server gets an F grade), so you're probably either using IPv6, or using IPv4 with a browser which no longer accepts the obsolete TLS 1.0 version.
jtchang 7y ago
One thing that is annoying is that ARIN recently raised the amount of money it costs to maintain a /24. I was unexpectedly hit with a $500 bill when previous prices were $100. Was quite annoying considering is very little cost in providing these allocations (they really beef up their headcount). Been thinking about trying to get on the board but it is near impossible.
codedokode 7y ago
20 years seems a little too much for the crime that doesn't involve violence. 2 or 3 years and a solid fine should be fair punishment in my opinion.
- deleted 7y ago
  [deleted]
- paulmd 7y ago
  US prison sentences are ridiculously long in general. In principle the key word is supposed to be "up to", the judge is supposed to use their discretion. In practice, it's used as a lever to force plea deals. If you waste the government's time and money with a trial, you probably still won't win, but now you will be doing up to 20 years. Sign here and spare us the trial and you'll get 5 years. Of course then you have the people who are truly innocent but are forced to plea out anyway at threat of spending a significant chunk of their lives in jail... There is also the view that extreme prison sentences are supposed to be a deterrent and thus are unfair by nature. If know you are at risk of spending 20 years in jail, you won't do the crime. Of course in many cases criminals do not really consider the risk of getting caught, and likely wouldn't know the exact penalties for a given crime anyway...
  - distances 7y ago
    > There is also the view that extreme prison sentences are supposed to be a deterrent and thus are unfair by nature. If know you are at risk of spending 20 years in jail, you won't do the crime. Of course in many cases criminals do not really consider the risk of getting caught, and likely wouldn't know the exact penalties for a given crime anyway... I'm pretty sure it has been proven multiple times over that harsher sentences don't reduce crime. They serve just as retribution.
    - edoo 7y ago
      The prison industry is huge. The prison guard union even lobbied against decriminalization, it is nuts. Most every jail releases inmates right after midnight so they can charge the state for a full extra day. It is a business.
gscott 7y ago
I once applied for a position at what I found out to be a spam marketing company. In order to send their spam they worked with a local hosting company that would take unused legacy ip addresses and put them in their router so the spam could be sent over them. They would just burn the ip's and move on to the next set. My job would be to update their firewall with the new ips, update their mailing software with the current set of ip's each day. They made their own mailing software it had an interface like a stoplight where red meant the mail wasn't going out, yellow a lot of it was getting blocked (so move to the next ip's) and green is things are good. I didn't end up taking the position. This was around 12 years ago.
- dennisgorelik 7y ago
  Today if you try to send a lot of emails from new IP address - most of these emails will go to spam folders (even if emails are legitimate). In order to send large numbers of emails from an IP address -- you need to gradually ramp up number of emails sent (and have low complaint rate and low bounce rate).
  - joering2 7y ago
    > In order to send large numbers of emails from an IP address -- you need to gradually ramp up number of emails sent As a spammer you would not go for dedicated IP; you would rather want to use a shared pool as pissing in a big pool plenty of people who hold their liquids to themselves will help your pee to be less visible and detectable. Here are samples of my spam box from this week so far, courtesy of Sparkpost (their complaint/spam/abuse mailbox is probably going into null, as I have never received a single response and majority of spam I see these days comes from them) cristo.cumplirmideseo.com mta609d.sparkpostmail.com diana.unavidaprospera.com mta678b.sparkpostmail.com michele.felicidadyprosperidad.com mta717d.sparkpostmail.com alexa.umavidaprospera.com mta678b.sparkpostmail.com to.believeinmyfuture.com outbound40.sparkpostmail.com These are shared pools and finding abusers is harder when you stay in large pool.
    - Dolores12 7y ago
jvsg 7y ago
My firefox 66.0.4 doesn't trust the certificate for the website you posted. Edit: Oh wait the link doesnt work for me even!
closetohome 7y ago
I love that they desperately tried to file for a restraining order the day before Christmas. Why do grifters like this always get so defensive? If he'd just played it cool he would absolutely have had time to wind down his operation and move the money somewhere safe. Now he's just going to go to jail.
- VectorLock 7y ago
  They're greedy enough to be defrauding people they're greedy enough to want to try to keep their shady business rolling.
nihil75 7y ago
I think my next Halloween costume will be that generic hoodied-hacker-with-numbers-background image
anvarik 7y ago
lol they don't even have https
broknbottle 7y ago
Wow, I dealt with this guy / company Micfo LLC at my previous employer a few years back. He had our DC announce a range and all his documents checked out. Some other dude reached out to our ipadmin address saying we were announcing his range. The Micfo guys had forged the documents or something shady and we removed the announcement for his range. He was very upset and claimed the other party was sour over some deal. He ended up leaving when we pushed back on him announcing new ranges. He provided more excuses on why he didn't have things then actual documentation. He tried to come back a couple years later but we told him to kick rocks.
- jstarfish 7y ago
  Micfo provides infrastructure to anonymizing VPNs (among other things). Their network is one of the more prolific sources of fraud I've ever dealt with. It got so bad we would preemptively block all of their BGP prefixes. I'm not surprised in the least that they would resort to owning IP spaces they didn't.
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]

337 points by pencilingin 7y ago

I always wondered if someone had created a biz for the purpose of hoarding IPv4 with intent to “sell them”. We talked about this kind of abuse back in the 90s when I worked for a hosting company. Part of my job was filling out ARIN templates and SWIP and all that nonsense. Justification was easy, but it occurred to me how easy it would be to fake requests and just pay the trivial fees. There were already some businesses buying up smaller companies for access to their old legacy allocations. Then the massive cloud build ours started and IP consumption became a real concern.

umanwizard 7y ago
There is an active, mature market for IPv4 addresses (just google "IPv4 address broker"), so it stands to reason that there are people hoarding them for speculation. It's not free money, of course -- it's entirely possible that the value goes down, as things that reduce the pressure on the IPv4 address space slowly come online (CGNAT and IPv6) That said, I'm a bit confused by this story. ARIN ran out of addresses in 2015, and it was my impression that since then you can't just get IPv4 addresses for free from them, which is why the above-mentioned markets exist. So, how were they able to keep running this scam after 2015?
- icedchai 7y ago
  Though they ran out of "new" allocations, ARIN is still assigning addresses, apparently from those that are "recycled" / returned to the pool. See https://lists.arin.net/pipermail/arin-issued/ https://lists.arin.net/pipermail/arin-issued/ for recent assignments.
- Arnt 7y ago
  IIRC you can get a laughably small number from ARIN if you say the right things, and you could get a slightly less laughably number in the past. Try saying you're an ISP and all your customers are dualstack already but you need 128 v4 addresses for compatibility or CGNAT or your DNS caches or something.
  - icedchai 7y ago
    Good luck routing anything more specific than a /24 (256 addresses) globally.
  - akvadrako 7y ago
    I doubt they are assigning anybody less than a /24 - it's not globally reachable.
alexpotato 7y ago
This reminds me of a conversation I had with the AC repairman last year. Backstory: we have an old AC unit that uses freon. The repairman mentioned that freon is no longer available for new AC units. I asked if you could still buy freon and he said yes, existing supplies were grandfathered in. I then commented that the price of freon must have sky-rocketed and he said: "yes, it did for a while but then it became cheaper to just get a new unit rather than fill up an old unit with freon." I would imagine that as the price of IPv4 addresses crosses some threshold, people will just start going to IPv6. As Michael Crichton once said in one of his books: "There was no subsidy that caused people to switch from horses to cars". They were just cheaper and easier to operate.
- freedomben 7y ago
  I had an 88 Chevy Pickup Truck that used the old style freon (R12). Man that stuff worked so good. In 100 degree heat that truck would stay nice and cold. It took over 20 years before the alternatives were competitive.
  - natermer 7y ago
    Propane makes a good substitute for R12 with very little modifications. I wouldn't use it inside a home or anything like that, but I have used it to make older vehicles blow cold. It's extremely good refrigerant. The biggest problem people have is that it ends up too cold and icing up the system. It sounds dangerous, but it's really not. Propane is only flammable with the correct mixture of air. Otherwise you couldn't light it with a blow torch. Even if you have a leaky system it isn't going to leak fast enough to cause a issue. Also propane is significantly heavier then air so anything that leaks out is going to go to ground. And the amount of propane you use is not very significant. Cars that end up having issues with propane are typically home built propane fuel conversions with no ventilation under the tanks or connections. The propane can then pool in the low places and build up enough to cause a explosion.
    - freedomben 7y ago
      This might be the most amazing and interesting comment I've ever seen. Thank you :-) What you say makes good sense too since many RVs have propane refrigerators. I've long wondered how it works exactly. Probably time for a DuckDuckGo search.
iDemonix 7y ago
I work for a UK based ISP. We have millions of unused addresses, largely because back in the 90s they were practically giving them away. We're still expanding and using up new IPs daily, but we often sell blocks when the department needs a boost...

pencilingin 7y ago

Link Updated May 15, 2019: "Charleston Man and Business Indicted in Federal Court in Over $9M Fraud" — The indictment charges that, through this scheme, defendant obtained the rights to approximately 757,760 IP addresses, with a market value between $9,850,880.00 and $14,397,440.00."

just_steve_h 7y ago

Does anyone know the address ranges that are affected?

gruez 7y ago
http://www.circleid.com/pdf/golstan_indict_filed_20190515.pdf http://www.circleid.com/pdf/golstan_indict_filed_20190515.pd... page 9
pencilingin 7y ago
Yes they are listed in the indictment document released today. Link to doc is in the updated section of the post.
gregmac 7y ago
Converted (OCR) from PDF: IP Block Entity Number of IP addresses ------------------- ------------------- ---------------------- 104.166.96.0/19 OppoBox 8,192 104.247.96.0/19 OppoBox 8,192 104.250.224.0/19 OppoBox 8,192 172.98.0.0/18 Telentia 16,384 174.136.192.0/18 Telentia 16,384 45.41.0.0/18 OppoBox 16,384 45.41.192.0/18 OppoBox 16,384 45.59.128.0/18 OppoBox 16,384 104.167.192.0/18 OppoBox 16,384 104.224.0.0/18 OppoBox 16,384 104.249.128.0/18 OppoBox 16,384 155.254.192.0/18 OppoBox 16,384 172.110.128.0/18 OppoBox 16,384 172.111.0.0/18 OppoBox 16,384 169.197.128.0/18 Border Technology 16,384 172.81.0.0/18 Border Technology 16,384 107.181.64.0/20 Contina 4,096 167.160.96.0/19 Contina 8,192 209.161.96.0/20 Telentia 4,096 104.128.16.0/20 Telentia 4,096 104.143.192.0/19 Telentia 8,192 104.222.192.0/19 Telentia 8,192 104.247.0.0/19 Telentia 8,192 107.190.160.0/20 OppoBox 4,096 107.182.112.0/20 OppoBox 4,096 104.207.64.0/19 OppoBox 8,192 155.254.96.0/19 OppoBox 8,192 167.88.96.0/20 Virtuzo 4,096 104.128.128.0/20 Virtuzo 4,096 104.156.192.0/19 Virtuzo 8,192 104.222.128.0/19 Virtuzo 8,192 104.143.16.0/20 Roya 4,096 104.237.80.0/20 Univera Network 4,096 45.62.32.0/19 Univera Network 8,192 45.61.32.0/20 Border Technology 4,096 173.44.0.0/19 Border Technology 8,192 172.97.80.0/20 Fiber Galaxy 4,096 206.223.224.0/19 Fiber Galaxy 8,192 172.102.128.0/20 Queen Systems 4,096 209.209.224.0/19 Queen Systems 8,192 172.110.208.0/20 Fairway Network 4,096 207.189.0.0/19 Fairway Network 8,192

rmbryan 7y ago

UPDATE May 15, 2019: "Charleston Man and Business Indicted in Federal Court in Over $9M Fraud" – United States Department of Justice issues a statement annoucing Amir Golestan, 36, of Charleston, and Micfo, LLC, were charged in federal court in a twenty-count indictment. The indictment charges twenty counts of wire fraud, with each count punishable by up to 20 years imprisonment.

jonawesomegreen 7y ago

I've often wondered how much of the IPv4 address space is legacy allocations that are not at all being fully utilized. Perhaps the market for IPv4 addresses has worked this out, and anyone that has such an allocation has cashed in.

icedchai 7y ago
There are tons of legacy allocations from the 90's and earlier than are not being routed / utilized. Many are also assigned to defunct entities. To confirm this, you can poke around WHOIS a little bit. Because many of them actually predate ARIN's formation in 1997, they are considered "legacy" allocations and aren't charged a fee by ARIN unless the organization has opted into an agreement.
toast0 7y ago
The IPs in question were directly assigned to the defendant by ARIN based on fraudulent requests. They weren't fraudulently transferred from existing allocations.
- jonawesomegreen 7y ago
  Thank you. I misread the article. I edited my post to take out the incorrect part.
brianwawok 7y ago
For enough dollars you can sample 100k address at random and have a decent guess? Not everyone responds to a ping but I suspect most do
- freedomben 7y ago
  ICMP is blocked by default now in many firewall setups, so unless the admin specifically allows ICMP the packets will likely be dropped. Also, be careful as "host discovery" can be viewed as a type of "hacking" depending on who you are and who is watching/judging you.

chriscappuccio 7y ago

Is ARIN going to assign these to people who are waiting? I certainly haven't seen 2960 /24s being released. They have NOT announced anything like this. Maybe they will "transfer" them for $13 to $19 per IP with a third party facilitator?

toast0 7y ago
I would imagine it would be prudent to wait a bit before reassigning these, in case of appeal.

sneak 7y ago

What is interesting to me is that you can’t really “revoke” an IP. ARIN’s authority really only comes from ISPs that listen to their recommendations in creating prefix filters. ARIN doesn’t give you any rights to an IP, because there is no such thing.

wmf 7y ago
ARIN controls WHOIS which is relevant since this fraudster was selling the IPs. If I was buying some IP space I would certainly check WHOIS to see if the seller owns what they are selling. Also, it seems like the Microsoft/Nortel case established that there is some such thing as ownership rights over IPs.
jcoffland 7y ago
It's an example of human cooperation for a greater good.

bvdba 7y ago

If we could recover all IP addresses that are not in use now (especially from those who got a /8) we would breath some air, given that ipv6 is basically not happening.

martindale 7y ago
It's used widely in meshnets.
icedchai 7y ago
How is IPv6 not happening? Google shows pretty good growth: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
- metalliqaz 7y ago
  It's interesting that the number fluctuates so much every weekend. I guess it's caused by people accessing the Internet from home instead of from the office. It's more than I expected.
- freedomben 7y ago
  I've been seeing more and more pressure to support IPv6 in the various SaaS companies I've worked at. I do think it's happening. That said I tend to think LANs and VPCs will continue to use IPv4 internally for decades even if the load balancer does IPv6.
  - fermuch 7y ago
    I'm at a home connection from a normal provider on brasil (third world country) and my router assigns a public ipv6 for each connection. I think all big providers have ipv6 enabled by default over here.
    - freedomben 7y ago
      Do they also provide an IPv4 address? If not, have you run into any problems with sites that don't yet support IPv6?

nowandlater 7y ago

For anyone interested, this a pretty good write up on "Bogons": http://www.potaroo.net/ispcol/2004-04/2004-04-isp.htm http://www.potaroo.net/ispcol/2004-04/2004-04-isp.htm

martindale 7y ago

IPv4 lives!

codexon 7y ago

Anyone here know a good place to buy or lease ipv4? Is this going to lower the prices?

wmf 7y ago
https://www.arin.net/resources/registry/transfers/stls/registered_facilitators/ https://www.arin.net/resources/registry/transfers/stls/regis... This looks like a blip compared to demand so I wouldn't expect prices to drop.
- codexon 7y ago
  This seems like a huge amount of addresses to me, the price should drop if supply goes up. I don't expect it to tank though. Is there a recommended broker or website? I googled a few of those "transfer facilitators" and they looked sketchy to me with many of them asking you to contact them for a price.

_JamesA_ 7y ago

Not sure if it's related or not but I was receiving spammy e-mails for a while from "Admiral Hosting": "Mike Watson here, from Admiral Hosting. I'm touching base regarding a business opportunity. Have you ever thought about turning your IP's into profit on a monthly basis? Admiral Hosting handles dozens of such B2B projects and its dedicated technical team oversees each project’s implementation."

gwbas1c 7y ago

Am I the only person who gets an HTTPS error when trying to open the link to circleid.com?

cesarb 7y ago
The link is http, so you're using something (perhaps HTTPS Everywhere?) which is converting it to an https link. According to the Qualys SSL tester (https://www.ssllabs.com/ssltest/analyze.html?d=www.circleid.com https://www.ssllabs.com/ssltest/analyze.html?d=www.circleid....), the IPv6 server for www.circleid.com has "Certificate not valid for domain name" (and the IPv4 server gets an F grade), so you're probably either using IPv6, or using IPv4 with a browser which no longer accepts the obsolete TLS 1.0 version.

jtchang 7y ago

One thing that is annoying is that ARIN recently raised the amount of money it costs to maintain a /24. I was unexpectedly hit with a $500 bill when previous prices were $100. Was quite annoying considering is very little cost in providing these allocations (they really beef up their headcount). Been thinking about trying to get on the board but it is near impossible.

codedokode 7y ago

20 years seems a little too much for the crime that doesn't involve violence. 2 or 3 years and a solid fine should be fair punishment in my opinion.

deleted 7y ago
[deleted]
paulmd 7y ago
US prison sentences are ridiculously long in general. In principle the key word is supposed to be "up to", the judge is supposed to use their discretion. In practice, it's used as a lever to force plea deals. If you waste the government's time and money with a trial, you probably still won't win, but now you will be doing up to 20 years. Sign here and spare us the trial and you'll get 5 years. Of course then you have the people who are truly innocent but are forced to plea out anyway at threat of spending a significant chunk of their lives in jail... There is also the view that extreme prison sentences are supposed to be a deterrent and thus are unfair by nature. If know you are at risk of spending 20 years in jail, you won't do the crime. Of course in many cases criminals do not really consider the risk of getting caught, and likely wouldn't know the exact penalties for a given crime anyway...
- distances 7y ago
  > There is also the view that extreme prison sentences are supposed to be a deterrent and thus are unfair by nature. If know you are at risk of spending 20 years in jail, you won't do the crime. Of course in many cases criminals do not really consider the risk of getting caught, and likely wouldn't know the exact penalties for a given crime anyway... I'm pretty sure it has been proven multiple times over that harsher sentences don't reduce crime. They serve just as retribution.
  - edoo 7y ago
    The prison industry is huge. The prison guard union even lobbied against decriminalization, it is nuts. Most every jail releases inmates right after midnight so they can charge the state for a full extra day. It is a business.

gscott 7y ago

I once applied for a position at what I found out to be a spam marketing company. In order to send their spam they worked with a local hosting company that would take unused legacy ip addresses and put them in their router so the spam could be sent over them. They would just burn the ip's and move on to the next set. My job would be to update their firewall with the new ips, update their mailing software with the current set of ip's each day. They made their own mailing software it had an interface like a stoplight where red meant the mail wasn't going out, yellow a lot of it was getting blocked (so move to the next ip's) and green is things are good. I didn't end up taking the position. This was around 12 years ago.

dennisgorelik 7y ago
Today if you try to send a lot of emails from new IP address - most of these emails will go to spam folders (even if emails are legitimate). In order to send large numbers of emails from an IP address -- you need to gradually ramp up number of emails sent (and have low complaint rate and low bounce rate).
- joering2 7y ago
  > In order to send large numbers of emails from an IP address -- you need to gradually ramp up number of emails sent As a spammer you would not go for dedicated IP; you would rather want to use a shared pool as pissing in a big pool plenty of people who hold their liquids to themselves will help your pee to be less visible and detectable. Here are samples of my spam box from this week so far, courtesy of Sparkpost (their complaint/spam/abuse mailbox is probably going into null, as I have never received a single response and majority of spam I see these days comes from them) cristo.cumplirmideseo.com mta609d.sparkpostmail.com diana.unavidaprospera.com mta678b.sparkpostmail.com michele.felicidadyprosperidad.com mta717d.sparkpostmail.com alexa.umavidaprospera.com mta678b.sparkpostmail.com to.believeinmyfuture.com outbound40.sparkpostmail.com These are shared pools and finding abusers is harder when you stay in large pool.
  - Dolores12 7y ago

jvsg 7y ago

My firefox 66.0.4 doesn't trust the certificate for the website you posted. Edit: Oh wait the link doesnt work for me even!

closetohome 7y ago

I love that they desperately tried to file for a restraining order the day before Christmas. Why do grifters like this always get so defensive? If he'd just played it cool he would absolutely have had time to wind down his operation and move the money somewhere safe. Now he's just going to go to jail.

VectorLock 7y ago
They're greedy enough to be defrauding people they're greedy enough to want to try to keep their shady business rolling.

nihil75 7y ago

I think my next Halloween costume will be that generic hoodied-hacker-with-numbers-background image

anvarik 7y ago

lol they don't even have https

broknbottle 7y ago

Wow, I dealt with this guy / company Micfo LLC at my previous employer a few years back. He had our DC announce a range and all his documents checked out. Some other dude reached out to our ipadmin address saying we were announcing his range. The Micfo guys had forged the documents or something shady and we removed the announcement for his range. He was very upset and claimed the other party was sour over some deal. He ended up leaving when we pushed back on him announcing new ranges. He provided more excuses on why he didn't have things then actual documentation. He tried to come back a couple years later but we told him to kick rocks.

jstarfish 7y ago
Micfo provides infrastructure to anonymizing VPNs (among other things). Their network is one of the more prolific sources of fraud I've ever dealt with. It got so bad we would preemptively block all of their BGP prefixes. I'm not surprised in the least that they would resort to owning IP spaces they didn't.

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]