Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked | Hacker News Reader

Close to 735k Fraudulently Obtained IP Addresses Uncovered and Revoked

circleid.com

337 pointspencilingin147 comments

I once applied for a position at what I found out to be a spam marketing company. In order to send their spam they worked with a local hosting company that would take unused legacy ip addresses and put them in their router so the spam could be sent over them. They would just burn the ip's and move on to the next set. My job would be to update their firewall with the new ips, update their mailing software with the current set of ip's each day. They made their own mailing software it had an interface like a stoplight where red meant the mail wasn't going out, yellow a lot of it was getting blocked (so move to the next ip's) and green is things are good. I didn't end up taking the position. This was around 12 years ago.

Today if you try to send a lot of emails from new IP address - most of these emails will go to spam folders (even if emails are legitimate).

In order to send large numbers of emails from an IP address -- you need to gradually ramp up number of emails sent (and have low complaint rate and low bounce rate).

> In order to send large numbers of emails from an IP address -- you need to gradually ramp up number of emails sent

As a spammer you would not go for dedicated IP; you would rather want to use a shared pool as pissing in a big pool plenty of people who hold their liquids to themselves will help your pee to be less visible and detectable.

Here are samples of my spam box from this week so far, courtesy of Sparkpost (their complaint/spam/abuse mailbox is probably going into null, as I have never received a single response and majority of spam I see these days comes from them)

cristo.cumplirmideseo.com mta609d.sparkpostmail.com

diana.unavidaprospera.com mta678b.sparkpostmail.com

michele.felicidadyprosperidad.com mta717d.sparkpostmail.com

alexa.umavidaprospera.com mta678b.sparkpostmail.com

to.believeinmyfuture.com outbound40.sparkpostmail.com

These are shared pools and finding abusers is harder when you stay in large pool.

Finding abuser is not hard, every message sent have customer id encoded in headers.

It is not hard to identify each abuser, my point is that in a large pool you will have lots of small abusers to go thru and vet. When someone is using dedicated IP that's what it is. Its dedicated so you immediately know whether the actors acts in bed faith or not (perhaps sent a few more-than-usually-spam-looking messages).

I don't know whats going on with Sparkpost honestly. I actually uncovered a large international scam artist (CNN did an investigative reporting on similar one milking population to the tune of $400MM/annul) with over 30 dedicated IPs running thru Sparkpost network, but frankly they don't care. I reported that multiple times and also tried to talk to them about it over twitter but they quickly banned me. I think their rules in terms of anti-spam/anti-scam are more guidelines than rules they abide by. I would imagine someone with such vast setup brings tens of thousands of dollars in revenue, so that makes sense why they would turn a blind eye. Its sad actually, the CNN reporting was about broken families and suicides that were to some degree a result of emails' content that perpetrators sent (like romance-type scams send to seniors in hopes to get them send money oversees).

I guess if Rich Harris sleeps well at night knowing his company abides in scam artists pushing senior citizens into taking their own lives, then the business continues as usual. But its sad IMHO nonetheless...

I wonder if governments could somehow vouch for emails addresses being a little like verified twitter accounts, so that we can have a good whitelist of legit email addresses.

Right now it seems gmail is benefiting from the chaos because they have the training data that allows them to know if a mail is spam. I just wish that the internet could adopt more security standards and processes. You can't trust only google now.

I prefer an Internet where people can do what they want without needing approval. This also invites bad actors, but I think that's a necessary evil.

As for spam, Thunderbird's filter works quite well for me.

No thank you. I don't want to need a government sanctioned e-mail address to send an anonymous (whistleblower) e-mail for example.

Whistleblowing is the last of my concerns. I live in Italy and PEC is a thing, it’s a government certified email with legal value.

Technical rules for the formation, transmission and validation are mandatory: read receipts are automatic.

To use the service you must have a PEC box with one of the authorized managers. The publication of the list of authorized operators, the supervision and coordination is entrusted to the “Agency for digital Italy” (AgID).

This means that every citizen with a pec is paying to obtain an email from a bunch of friends of friends of the government, in a market with virtually no competition, and that your mail box is heavily surveilled but left unsecured.

To be fair, email is a very poor medium for whistleblowers in any case.

The notion of a regulated "official" communications channel (akin to postal mail) for bills and such isn't a terrible idea, although it would make more sense to build something new for this. Email has too many weaknesses to be a good choice.

Email addresses aren't relevant, because they're not authenticated unless DKIM/SPF etc are in place. It's the IP addresses that matter.

I'm glad you didn't. Tech doesn't really have the ethics standards that more mature fields like law or medicine have, but they should, and that sort of thing shouldn't pass muster.

I always wondered if someone had created a biz for the purpose of hoarding IPv4 with intent to “sell them”. We talked about this kind of abuse back in the 90s when I worked for a hosting company. Part of my job was filling out ARIN templates and SWIP and all that nonsense. Justification was easy, but it occurred to me how easy it would be to fake requests and just pay the trivial fees. There were already some businesses buying up smaller companies for access to their old legacy allocations. Then the massive cloud build ours started and IP consumption became a real concern.

This reminds me of a conversation I had with the AC repairman last year.

Backstory: we have an old AC unit that uses freon.

The repairman mentioned that freon is no longer available for new AC units. I asked if you could still buy freon and he said yes, existing supplies were grandfathered in.

I then commented that the price of freon must have sky-rocketed and he said: "yes, it did for a while but then it became cheaper to just get a new unit rather than fill up an old unit with freon."

I would imagine that as the price of IPv4 addresses crosses some threshold, people will just start going to IPv6.

As Michael Crichton once said in one of his books: "There was no subsidy that caused people to switch from horses to cars". They were just cheaper and easier to operate.

I find the CFC situation to be rather interesting because it not only made it illegal to intentionally release them into the atmosphere (which would, if anything, just cause people to release them from things like old fridges and ACs even more frequently so as not to be caught with the "prohibited substance"), but by stopping production and keeping it legal to continue to use, created a market for recovering/reselling/reusing that helps to keep them out of the atmosphere.

It's the difference between saying "it's bad for the environment so don't release it", and "it's rare and valuable so don't let it escape, but recover, resell, and reuse" --- not everyone believes in global warming or cares as much about the former, but the latter is a powerful motivation.

Can we do that with carbon? It's rare and valuable, let's try to contain it as much as possible! We're basically releasing TONS of what is basically black gold to the sky!!

Unfortunately coal is not rare and not very valuable and pricing in the massive externalities to make it so is "bad for jobs".

If carbon was placed under a cap and trade system, where it had a price, and entities which emit CO2 pay for that privilege, then that externality won't be so external, those who do the most damage pay the highest price, and those who can perform carbon capture and storage can realise a revenue stream.

> I would imagine that as the price of IPv4 addresses crosses some threshold, people will just start going to IPv6.

Instead we see "carrier grade NAT" and I end up with IP addresses like 10.X.X.X on some of my cellular devices...

'If I had asked people what they wanted, they would have said faster horses.' -- Henry Ford

Henry Ford didn't actually say that, though it was in line with his thinking, perhaps.

https://hbr.org/2011/08/henry-ford-never-said-the-fast

The article didn't say Ford didn't say the phrase but that there's no evidence Ford ever said that. So, the truth is (as with many historical things) that no one really knows the truth.

Stackexchange already did that line of thinking (and cite this article). Enlightening comments. https://skeptics.stackexchange.com/questions/37637/did-henry...

A mix of the two seems more likely -- ipv6-only to the device, with nat64/dns64 used to handle ipv4 traffic.

T-Mobile has been ipv6-only for devices supporting 464xlat since 2014.

I know someone who was hoarding banned freon and selling it on the side. The government eventually had caught on that people were doing it, but they also understood that punishing people even harder for selling it wouldn't work. So instead they started to provide incentives to convert refrigeration units to not use that kind of freon. It's been a few years so not sure how effective that was, but I thought it was interesting.

See ebay listings for how you can buy R-12 by stating you are a reseller:

https://www.ebay.com/itm/R12-Refrigerant-12-Virgin-Pure-R-12...

>An EPA certificate is required to purchase R12 Refrigerant "OR" a statement saying you are purchasing this for "Resale Only". The "Resale Only" statement can be in the form of an e-mail.

Pretty easy for Joe Handyman to buy.

Yes, it's easy to buy, but as I mentioned in another comment here, the price compels everyone to be cautious in using it and not let it escape. You can even find plenty of DIY videos on YouTube of people building their own refrigerant recovery machines (basically a compressor and a tank), so I'd say everyone recognises the importance of not just venting it into the atmosphere.

The last time I heard, the EPA certificate is itself very easy to obtain too; the fee is around $20, and it's a short open-book multiple-choice exam. Not really a hindrance considering that a gauge set and vacuum pump, which is obligatory if you intend to do anything with refrigeration, costs far more.

Yeah I like the strong warning of needing a certification then the "OR just say it's for resale" part.

In my case it was in a different (European) country. I think they may be slightly more strict there.

This is how I feel climate change will be tackled (whether too late or not). It will just become cheaper to go green and being green is just a side effect.

Yet initiatives like Carbon tax have been shot down (Australia) by big money, putting dangerous delays into the schedule.

I think carbon taxes are the opposite of what the OP is talking about. Carbon taxes are artificial barriers to using fossil fuels.

On the other hand, when technology improves so that electric cars cost less per mile than gasoline cars, people won't necessarily buy them to be green, they'll buy them because they're a cheaper form of transportation that happens to be greener.

Same with wind and solar power. When a solar farm on 10 acres of land can produce more energy than a coal plant on the same 10 acres, then power companies will build them instead of coal - not to be "green", but to make more money.

Carbon taxes aren't artificial barriers. There are real costs to emitting carbon. Putting a price on negative externalities helps align incentives properly so the people making the coal plant have to consider the full costs of their actions.

Why not talk to the coal plant owner directly? Or how about the other 100(!) private citizens living around the world who control the companies that are responsible 70% of the greenhouse emissions of the entire Earth?

> Why not talk to the coal plant owner directly?

Well, merely talking to them isn't going to achieve any change, so the plan is to tax them?

Talking to them doesn't change the economic incentives. No matter how stern of a talking to I give them, they'll still be making a large personal profit at the expense of a larger cost spread across everyone else.

Do you think no one has tried talking to any of these people about climate change yet?

> Carbon taxes are artificial barriers to using fossil fuels.

> On the other hand, when technology improves so that electric cars cost less per mile than gasoline cars, people won't necessarily buy them to be green, they'll buy them because they're a cheaper form of transportation that happens to be greener.

Carbon taxes are like trash disposal fees. If your business dumps trash into the landfill or carbon into the atmosphere, the public should not have to subsidize your business by paying for that. You should pay to manage your own waste.

Gas cars are cheaper than electric at least partly because we're all subsidizing them by allowing them to dump waste for free into the air that we all own, and paying on their behalf for all the damages that causes (asthma, climate change, flooding, etc). A carbon tax would remove that subsidy and make fossil fuels compete on a level playing field.

And yes, once the subsidy is removed, the market can sort it out.

> When a solar farm on 10 acres of land can produce more energy than a coal plant on the same 10 acres

This is energetically impossible, I'm afraid. Even if you count the area of the plant plus the area of its corresponding mine and the transport links between them. Because the energy density of coal is so incredibly high.

On the other hand, now that Drax has switched to burning wood, you might get more energy efficiency from the same (huge) area of woodland by direct solar farming instead. Annoyingly I can't find any numbers, other than an estimate that if Drax was limited to domestic wood (rather than importing it from the US, using oil-fired shipping) it would consume every tree in the UK within a year.

Fair point, and an important one!

As we're running out of time we ideally need both to happen, but it's good that green tech is becoming increasingly more financially viable. As a little gem, just about all reports from the SA Tesla battery installation make for simply fantastic reading.

Cars are a red herring. Even gasoline and diesel car aren't really contributing that much to world pollution compared to the real culprits, such as ocean liners and huge cargo ships. These ships alone pollute more than all the cars on Earth.

What do you think about going after the things that are actually harmful, instead of following a red herring? I mean, sure, cars should of course be dealt with also, but if you really want to lower carbon emissions fast, then shouldn't we go for the big fish first?

> These ships alone pollute more than all the cars on Earth.

Do you have a link to figures that show this?

I was intrigued - seems it could be because ships use heavy oil

https://www.quora.com/Is-it-true-that-the-15-biggest-ships-i...

> https://www.quora.com/Is-it-true-that-the-15-biggest-ships-i....

Thanks for the link. So it isn't carbon emissions that exceed those of cars but SOx and NOx (which are still a problem).

Politicians trying to save the environment: Policitian #1: Um, I can't think of anything. Can you? Policitian #2: I got it! Let's make a new tax! It'll annoy these guys, while we'll insure our state jobs, and it'll make state finances look a ton better for all posterity! Policitian #1: Yeah, that sounds really great and all, umm, but will it fix the problem with greenhouse gases? Policitian #2: Don't be silly! This is as good a reason to make the state richer than any.

Hopefully we don't all die in wildfires, food and clean water shortages before then.

Millions of people are displaced yearly by war. It'll just be by climate change too. It's not new for us. It's just more of the same awfulness.

Humanity will be fine. We just will have to learn to live without all the cool stuff we like, like polar bears and butterflies and Amsterdam.

You are in serious denial.

https://www.nytimes.com/2019/05/06/climate/biodiversity-exti...

What's happening right now is absolutely unprecedented and it will kill a lot of people. It's demoralizing how even within a crowd that's supposed to value science we have people waving away what's happening right now.

You're completely misreprenting what I'm saying.

Yes, it will kill a lot of people. And it's a disaster. But humanity will adapt and be fine. Kind of like how humanity survived world wars doesn't discount how awful those wars were.

Yeah, that's denial. We're on the path to extinction if we don't seriously change something.

Oh don't be a doomer! Greta Thunberg is more optimistic than you! xD Oh wait, no she isn't. The end is nigh!

On the other hand, humans driving ourselves extinct might be the best long term scenario for the rest of life on Earth.

Realistically, the universe doesn't care one way or the other about us.

Yes, and so what? There's nothing else in the known universe that's capable of caring. The only good outcome seems to be us surviving.

> We just will have to learn to live without all the cool stuff we like

Like arable land.

You lose arable land at the equator and gain it closer to the poles. Studies don’t generally see a large net decrease in arable land due to climate change.

Erosion is the bigger problem, 1/3rd of all arable land lost over the last 40 years. [1]

[1] - https://www.businessinsider.com/earth-has-lost-a-third-of-ar...

In the next 40 we will lose the rest of it. It's going to make a lot of folks very hungry, have you read "the road"? I would rather not live there, thank you very much.

In idle moments, I daydream of a wager where people who are concerned about climate change bet with those who are unconcerned. If climate change turns out to be mild, the unconcerned get the money. If it's severe, they die.

Why would such a bet be useful then?

Hahaha it won't be cheaper at all. At some point people will just realize that, hey, being alive is sweeter than being dead. :D

Fridge related trick:

In certain countries you could get carbon credits for closing down old factories that made old style CFC fridges, because of course those are not great for the environment.

So then some wily operators started building new "old factories" that they could get credits for in order to "convert" to new factories.

Story was told by a friend of mine in the industry at the time, I don't recall the finer details.

A scheme in Northern Ireland (colloquially known as "Cash for Ash") was set up where heating properties using renewable fuels (mainly biomass) was subsidised, only the subsidy was priced higher than the cost for fuel causing people to heat empty properties just to claim the subsidy. The whole thing cost almost half a billion pounds.

There have been huge allegations of fraud and it even brought down NI's power-sharing executive (~ the regional government) in 2017.

https://en.wikipedia.org/wiki/Renewable_Heat_Incentive_scand...

There's an initiative in Guatemala where land owners are paid an amount of money every year for each acre of their land that they reforest.

Naturally, land owners immediately started clear-cutting virgin rainforest, selling the lumber, and then collecting a payout from the government for planting pine trees that they'll raise for 10 years before they'll cut them down for lumber too.

Sounds like another example of the cobra effect: https://en.m.wikipedia.org/wiki/Cobra_effect

That's a really interesting effect! Thank you for making me aware of it! However it should be noted that the reason it backfired, was because people exploited a weakness in the system, so to speak. It could even be that they did something illegal and fraudulent, since the bounties were obviously for animals that weren't bred in captivity, and for wild animals that were properly killed so they wouldn't be able to procreate. Thus the question remains on whether the measures had effective ways of dealing with such fraud, or whether that would make the whole thing more expensive than other measures.

I had an 88 Chevy Pickup Truck that used the old style freon (R12). Man that stuff worked so good. In 100 degree heat that truck would stay nice and cold. It took over 20 years before the alternatives were competitive.

Propane makes a good substitute for R12 with very little modifications. I wouldn't use it inside a home or anything like that, but I have used it to make older vehicles blow cold.

It's extremely good refrigerant. The biggest problem people have is that it ends up too cold and icing up the system.

It sounds dangerous, but it's really not. Propane is only flammable with the correct mixture of air. Otherwise you couldn't light it with a blow torch. Even if you have a leaky system it isn't going to leak fast enough to cause a issue. Also propane is significantly heavier then air so anything that leaks out is going to go to ground. And the amount of propane you use is not very significant.

Cars that end up having issues with propane are typically home built propane fuel conversions with no ventilation under the tanks or connections. The propane can then pool in the low places and build up enough to cause a explosion.

R152A, also known as "canned air", is actually very usable in an R12 system without any modification: https://www.youtube.com/watch?v=3wkBnhcyO3Y

(That guy restores old refrigerators, so he probably knows a thing or two about refrigerant substitution...)

Would a propane tank pose any danger to occupants during/after an accident?

Proponents of propane as refrigerant claim that it's not more dangerous than the 10 gallons of gasoline in the gas tank. I'm not sure I agree. Since propane is heavier than air, it doesn't dissipate as quickly as, say, natural gas would.

And while its true that you need the right mixture of propane and air for it to ignite, with the right-mixture, you've got a fuel-air explosive formed right next to an ignition source (the car's engine and battery).

Like propane, gasoline fumes are also heavier than air. This becomes a problem in boats, where propane and/or gasoline fumes "collect" down in the hull with no natural ventilation path. Boats with propane stoves or gasoline motors need gas detectors and ventilation to ensure dangerous (suffocating or exploding) levels don't build up below decks...

Safe until it leaks.

This might be the most amazing and interesting comment I've ever seen. Thank you :-)

What you say makes good sense too since many RVs have propane refrigerators. I've long wondered how it works exactly. Probably time for a DuckDuckGo search.

Propane fridges actually burn the propane for heat, so it's not using it as a "refrigerant", just as a heat source.

Those commonly use ammonia and hydrogen as the actual refrigerant: https://en.wikipedia.org/wiki/Absorption_refrigerator

I used to work at a company that recovered and decommissioned freon. If some tech came by with a cylinder filled with R12 it would many times mysteriously disappear from storage. Probably because it sells for an insane price and is very rare in my region.

There is an active, mature market for IPv4 addresses (just google "IPv4 address broker"), so it stands to reason that there are people hoarding them for speculation.

It's not free money, of course -- it's entirely possible that the value goes down, as things that reduce the pressure on the IPv4 address space slowly come online (CGNAT and IPv6)

That said, I'm a bit confused by this story. ARIN ran out of addresses in 2015, and it was my impression that since then you can't just get IPv4 addresses for free from them, which is why the above-mentioned markets exist. So, how were they able to keep running this scam after 2015?

Though they ran out of "new" allocations, ARIN is still assigning addresses, apparently from those that are "recycled" / returned to the pool. See https://lists.arin.net/pipermail/arin-issued/ for recent assignments.

IIRC you can get a laughably small number from ARIN if you say the right things, and you could get a slightly less laughably number in the past. Try saying you're an ISP and all your customers are dualstack already but you need 128 v4 addresses for compatibility or CGNAT or your DNS caches or something.

I doubt they are assigning anybody less than a /24 - it's not globally reachable.

Good luck routing anything more specific than a /24 (256 addresses) globally.

I work for a UK based ISP. We have millions of unused addresses, largely because back in the 90s they were practically giving them away. We're still expanding and using up new IPs daily, but we often sell blocks when the department needs a boost...

Wow, I dealt with this guy / company Micfo LLC at my previous employer a few years back. He had our DC announce a range and all his documents checked out. Some other dude reached out to our ipadmin address saying we were announcing his range. The Micfo guys had forged the documents or something shady and we removed the announcement for his range. He was very upset and claimed the other party was sour over some deal. He ended up leaving when we pushed back on him announcing new ranges. He provided more excuses on why he didn't have things then actual documentation. He tried to come back a couple years later but we told him to kick rocks.

Micfo provides infrastructure to anonymizing VPNs (among other things). Their network is one of the more prolific sources of fraud I've ever dealt with.

It got so bad we would preemptively block all of their BGP prefixes.

I'm not surprised in the least that they would resort to owning IP spaces they didn't.

20 years seems a little too much for the crime that doesn't involve violence. 2 or 3 years and a solid fine should be fair punishment in my opinion.

US prison sentences are ridiculously long in general.

In principle the key word is supposed to be "up to", the judge is supposed to use their discretion.

In practice, it's used as a lever to force plea deals. If you waste the government's time and money with a trial, you probably still won't win, but now you will be doing up to 20 years. Sign here and spare us the trial and you'll get 5 years.

Of course then you have the people who are truly innocent but are forced to plea out anyway at threat of spending a significant chunk of their lives in jail...

There is also the view that extreme prison sentences are supposed to be a deterrent and thus are unfair by nature. If know you are at risk of spending 20 years in jail, you won't do the crime. Of course in many cases criminals do not really consider the risk of getting caught, and likely wouldn't know the exact penalties for a given crime anyway...

American tax payers stand to save a lot of money by adopting the Scandinavian model for their prison system, particularly because of the use of much shorter sentences, and heavier use of fines (a lash to the pocket is often a far better deterrent than a long prison sentence). This opens up for better rehabilitation, and much less recidivism. In turn that means shorter queues which means a clear cut in the expenses needed to maintain all those prisons. In the end, it's a win-win for the state, tax payers and the prison inmates themselves. Only prison wardens would disapprove. ;)

> There is also the view that extreme prison sentences are supposed to be a deterrent and thus are unfair by nature. If know you are at risk of spending 20 years in jail, you won't do the crime. Of course in many cases criminals do not really consider the risk of getting caught, and likely wouldn't know the exact penalties for a given crime anyway...

I'm pretty sure it has been proven multiple times over that harsher sentences don't reduce crime. They serve just as retribution.

The prison industry is huge. The prison guard union even lobbied against decriminalization, it is nuts. Most every jail releases inmates right after midnight so they can charge the state for a full extra day. It is a business.

At some point it involved violence. It's one of those things where he provided a service that did not follow the regulations that were in part placed there to prevent crime. His violations of these regulations allow other criminals to piggyback off of him by using his services. Spammers, VPNs, and other services which criminals can use - especially with forged IP address ranges - to commit crimes. He is a middle man, and by not following regulations, he assisted all of those crimes.

Consider craigslist, they are protected by safe harbor laws because they comply with regulations and laws, even though criminal activity passes over their servers, it's a level that is deemed acceptable by society for the service they provide (given they are well regulated). When laws like FOSTA/SESTA get passed and change those regulations, some services will shut down (because they are no longer complying).

Which is why he probably deserves a larger sentence (though others have pointed out the ridiculousness of the US sentencing system and I don't disagree).

>At some point it involved violence.

>Spammers, VPNs, and other services which criminals can use - especially with forged IP address ranges - to commit crimes.

How are these violence?

> VPNs and other services.

Drug cartels, pedophile rings, etc.

But you have to prove that those IP addresses were used for crime. Maybe the purpose was only to earn money from reselling them.

And we can't. Because this person failed to follow the regulations that allow for that to be proven.

It's like if I ran a car rental business, and I stole license plate numbers from random cars or made them up, and then kept no records. And then when convicted and charged you were like "but you have to prove that those license plates were used for crime". How? The whole point of the crime was to obfuscate and prevent that very action of tracking the license plates.

Which is why he isn't going to jail for any additional criminal acts. But he is getting a very long sentence for the crime he committed because his crime was particularly egregious in enabling other crimes and preventing them from being discovered or tracked.

While I'm more for rehabilitation than retribution, $10M - rough value of the stolen IPs - is a staggeringly large amount of money, around 4x the average lifetime earnings of a college graduate.

$10M can save a lot of lives, and $10M missing from shareholder's accounts and not going into employee benifit plans for healthcare etc. might very well end some. Framing that as nonviolent... is correct by the letter of the law, but it's not the way I'd frame it first and foremost.

I think the better framing is the amount of fraud, abuse, and second hand criminal activity this person enabled. His violations of the regulations allowed criminals to piggyback off of that and get away with crimes more easily.

I love that they desperately tried to file for a restraining order the day before Christmas.

Why do grifters like this always get so defensive? If he'd just played it cool he would absolutely have had time to wind down his operation and move the money somewhere safe. Now he's just going to go to jail.

They're greedy enough to be defrauding people they're greedy enough to want to try to keep their shady business rolling.

One thing that is annoying is that ARIN recently raised the amount of money it costs to maintain a /24. I was unexpectedly hit with a $500 bill when previous prices were $100. Was quite annoying considering is very little cost in providing these allocations (they really beef up their headcount). Been thinking about trying to get on the board but it is near impossible.

I've often wondered how much of the IPv4 address space is legacy allocations that are not at all being fully utilized. Perhaps the market for IPv4 addresses has worked this out, and anyone that has such an allocation has cashed in.

There are tons of legacy allocations from the 90's and earlier than are not being routed / utilized. Many are also assigned to defunct entities. To confirm this, you can poke around WHOIS a little bit. Because many of them actually predate ARIN's formation in 1997, they are considered "legacy" allocations and aren't charged a fee by ARIN unless the organization has opted into an agreement.

Here's one, it's under S-MOS Systems, Inc. (SMOSSY) which was bought by Epson the printer company. Somebody registered the domain when it expired and sold the company + "IPs" to a company I worked at in the Noc. When we went to ARIN to set everything up for rDNS, ARIN pushed back and said you do not own these, Epson own's this range. The company that sold the IPs disappeared with the money. The smos.com registration lapsed and some chinese company immediately registered the domain.

148.130.0.0/16

The IPs in question were directly assigned to the defendant by ARIN based on fraudulent requests. They weren't fraudulently transferred from existing allocations.

Thank you. I misread the article. I edited my post to take out the incorrect part.

For enough dollars you can sample 100k address at random and have a decent guess?

Not everyone responds to a ping but I suspect most do

For 0 dollars, you can get a BGP table dump and see how many addresses aren't even routable. (doesn't mean they're not in use, but makes it less likely)

ICMP is blocked by default now in many firewall setups, so unless the admin specifically allows ICMP the packets will likely be dropped.

Also, be careful as "host discovery" can be viewed as a type of "hacking" depending on who you are and who is watching/judging you.

Your first point is definitely correct.

Your second point though... really? Do you have any sources for anyone, anywhere being charged for using ping?

With regards to the second point, definitely.

Quite a few years ago the security team of the organisation I worked at didn't have our internal vulnerability scanning services automated. It relied on them capturing the IPv4 addresses (specifically the /32's, not the subnets) and manually entering them into the engine.

Our security team mistyped a handful of these addresses and instead of the scan running across our internal infrastructure, we scanned WalMarts external facing infrastructure in the US from Australia.

These scans were happening semi-regularly for a period of a few weeks before we received a cease and desist and the sec. team realised their error. I'm still rather surprised more didn't come of it.

Scanning for known vulnerabilities isn't the same as a simple ICMP ping though.

No, I haven't heard of anyone being criminally charged for ping, but I have known someone whose ISP cut them off and he had to go through an onerous process to get service restored. I've also heard of people that use EC2 instances and get their AWS account terminated.

AWS is also overzealous about DMCA notices. If you go to other providers like Scaleway, they'll forward any abuse complaints but you don't have to do anything about them.

Hadn't heard of Scaleway before, but their prices look very reasonable! Are you a customer of theirs? Any issues with reliability?

I don't use Scaleway or Online.net, as they're known for ignoring abuse reports. Other hosts like OVH tend to forward abuse reports and deal with repeat offenders, a good middle ground between AWS's draconian policies and Scaleway's.

Adding to sibling comments, some networks are extremely heavy-handed at self-regulating host discovery. Back when I was on AS88, I once got a warning alleging that I was performing suspicious port scans. I acquired a report of my “suspicious” activities from the admin, and turns out all I did was connecting to port 22 of some two dozen hosts I rented from a handful of VPS providers across North America and Europe. Of course the warning was dropped after my explanation, but I found it pretty crazy.

Thankfully there are search engines that do that for you, like shodan.

Not sure if it's related or not but I was receiving spammy e-mails for a while from "Admiral Hosting":

"Mike Watson here, from Admiral Hosting. I'm touching base regarding a business opportunity. Have you ever thought about turning your IP's into profit on a monthly basis? Admiral Hosting handles dozens of such B2B projects and its dedicated technical team oversees each project’s implementation."

What is interesting to me is that you can’t really “revoke” an IP. ARIN’s authority really only comes from ISPs that listen to their recommendations in creating prefix filters.

ARIN doesn’t give you any rights to an IP, because there is no such thing.

ARIN controls WHOIS which is relevant since this fraudster was selling the IPs. If I was buying some IP space I would certainly check WHOIS to see if the seller owns what they are selling.

Also, it seems like the Microsoft/Nortel case established that there is some such thing as ownership rights over IPs.

It's an example of human cooperation for a greater good.

I think my next Halloween costume will be that generic hoodied-hacker-with-numbers-background image

Does anyone know the address ranges that are affected?

Converted (OCR) from PDF:

    IP Block            Entity              Number of IP addresses 
    ------------------- ------------------- ----------------------
    104.166.96.0/19     OppoBox             8,192 
    104.247.96.0/19     OppoBox             8,192 
    104.250.224.0/19    OppoBox             8,192 
    172.98.0.0/18       Telentia            16,384 
    174.136.192.0/18    Telentia            16,384 
    45.41.0.0/18        OppoBox             16,384 
    45.41.192.0/18      OppoBox             16,384 
    45.59.128.0/18      OppoBox             16,384 
    104.167.192.0/18    OppoBox             16,384 
    104.224.0.0/18      OppoBox             16,384 
    104.249.128.0/18    OppoBox             16,384 
    155.254.192.0/18    OppoBox             16,384 
    172.110.128.0/18    OppoBox             16,384 
    172.111.0.0/18      OppoBox             16,384 
    169.197.128.0/18    Border Technology   16,384 
    172.81.0.0/18       Border Technology   16,384 
    107.181.64.0/20     Contina             4,096
    167.160.96.0/19     Contina             8,192
    209.161.96.0/20     Telentia            4,096
    104.128.16.0/20     Telentia            4,096
    104.143.192.0/19    Telentia            8,192
    104.222.192.0/19    Telentia            8,192
    104.247.0.0/19      Telentia            8,192
    107.190.160.0/20    OppoBox             4,096
    107.182.112.0/20    OppoBox             4,096
    104.207.64.0/19     OppoBox             8,192
    155.254.96.0/19     OppoBox             8,192
    167.88.96.0/20      Virtuzo             4,096
    104.128.128.0/20    Virtuzo             4,096
    104.156.192.0/19    Virtuzo             8,192
    104.222.128.0/19    Virtuzo             8,192
    104.143.16.0/20     Roya                4,096
    104.237.80.0/20     Univera Network     4,096
    45.62.32.0/19       Univera Network     8,192
    45.61.32.0/20       Border Technology   4,096
    173.44.0.0/19       Border Technology   8,192
    172.97.80.0/20      Fiber Galaxy        4,096
    206.223.224.0/19    Fiber Galaxy        8,192
    172.102.128.0/20    Queen Systems       4,096
    209.209.224.0/19    Queen Systems       8,192
    172.110.208.0/20    Fairway Network     4,096
    207.189.0.0/19      Fairway Network     8,192

Thank you gregmac21 for doing some uncompensated labor :)

http://www.circleid.com/pdf/golstan_indict_filed_20190515.pd... page 9

Yes they are listed in the indictment document released today. Link to doc is in the updated section of the post.

For anyone interested, this a pretty good write up on "Bogons": http://www.potaroo.net/ispcol/2004-04/2004-04-isp.htm

Am I the only person who gets an HTTPS error when trying to open the link to circleid.com?

The link is http, so you're using something (perhaps HTTPS Everywhere?) which is converting it to an https link.

According to the Qualys SSL tester (https://www.ssllabs.com/ssltest/analyze.html?d=www.circleid....), the IPv6 server for www.circleid.com has "Certificate not valid for domain name" (and the IPv4 server gets an F grade), so you're probably either using IPv6, or using IPv4 with a browser which no longer accepts the obsolete TLS 1.0 version.

My firefox 66.0.4 doesn't trust the certificate for the website you posted.

Edit: Oh wait the link doesnt work for me even!

UPDATE May 15, 2019: "Charleston Man and Business Indicted in Federal Court in Over $9M Fraud" – United States Department of Justice issues a statement annoucing Amir Golestan, 36, of Charleston, and Micfo, LLC, were charged in federal court in a twenty-count indictment. The indictment charges twenty counts of wire fraud, with each count punishable by up to 20 years imprisonment.

Anyone here know a good place to buy or lease ipv4?

Is this going to lower the prices?

https://www.arin.net/resources/registry/transfers/stls/regis...

This looks like a blip compared to demand so I wouldn't expect prices to drop.

This seems like a huge amount of addresses to me, the price should drop if supply goes up. I don't expect it to tank though.

Is there a recommended broker or website? I googled a few of those "transfer facilitators" and they looked sketchy to me with many of them asking you to contact them for a price.

lol they don't even have https

Link Updated May 15, 2019: "Charleston Man and Business Indicted in Federal Court in Over $9M Fraud" — The indictment charges that, through this scheme, defendant obtained the rights to approximately 757,760 IP addresses, with a market value between $9,850,880.00 and $14,397,440.00."

Is ARIN going to assign these to people who are waiting? I certainly haven't seen 2960 /24s being released. They have NOT announced anything like this. Maybe they will "transfer" them for $13 to $19 per IP with a third party facilitator?

I would imagine it would be prudent to wait a bit before reassigning these, in case of appeal.

If we could recover all IP addresses that are not in use now (especially from those who got a /8) we would breath some air, given that ipv6 is basically not happening.

How is IPv6 not happening? Google shows pretty good growth: https://www.google.com/intl/en/ipv6/statistics.html

I've been seeing more and more pressure to support IPv6 in the various SaaS companies I've worked at. I do think it's happening.

That said I tend to think LANs and VPCs will continue to use IPv4 internally for decades even if the load balancer does IPv6.

I'm at a home connection from a normal provider on brasil (third world country) and my router assigns a public ipv6 for each connection. I think all big providers have ipv6 enabled by default over here.

Do they also provide an IPv4 address? If not, have you run into any problems with sites that don't yet support IPv6?

It's interesting that the number fluctuates so much every weekend. I guess it's caused by people accessing the Internet from home instead of from the office. It's more than I expected.

At what share of deployment would you consider v6 as happening — 10%? 20%? 40%? 60%? 80%? 90? Or would you require even more than 100% of the people who have v4 access?

When it becomes viable to market IPv6-only home connections.

It's already viable to supply IPv6 only mobile with NAT64 (see T-Mobile US). I'm aware that many residential ISPs are putting everybody behind CGNAT; and there's some amount of push towards LTE for residential internet, so I suspect IPv6 with a transition mechanism is already viable for home connections.

Anyway, given the number of people who have effectively no choice in home connections, what are we going to do when the incumbent provides us with IPv6 only? LTE or Satellite is going to be even less likely to give me a real IPv4 address.

That's exciting then, because that's already happening! ;)

Sounds like 99-100% then

It's used widely in meshnets.

IPv4 lives!

Reply on news.ycombinator.com