There is a lot of FUD surrounding this market. Apparently Iran has been buying blocks of IPv4 from Romania, only to discover that the Romanians were continuing to advertise those same blocks after the sale!! See https://youtu.be/Jn5ztZSigHA
That's pretty egregious, why the heck did the romanian upstream peers not just drop them after they started obviously highjacking the /23? I mean you have something that is obviously not just some misconfiguration, if you know that one of your peers is intentionally hijacking some prefix why would you be complacent in being a part of their fraud?