Inquiries to Acquire IPs

We got a strange and out of the blue inquiry from someone
wishing to pay us for a chunk of our ARIN allocation,

Hello,

According to Whois data, you company owns the following
IP address space:

206.220.220.0/24

We would like to get this block of IP addresses for our business
needs. Is it possible to assign this block for our company with
PI (Provider Independent) or PA (Provider Assigned) status?

We ready to pay about $5,000 for the net block itself
and all related procedures.

Would you be interested in such an offer? The amount of compensation
is subject to negotiation.

We're not interested, mostly because we use our allocation,
but also because I think this is not allowed by our agreement
with ARIN. Seems a bit fishy.

I should add the sender identified himself and his company
clearly. It wasn't from some free mail account. (Although it
could of course be spoofed.)

Is this a new thing? IP speculation as we come upon free pool
depletion? A front for spammers?

Not a new thing. Usually they're looking for ways around ARIN's rules or
they just want to "borrow" your IP space. In the latter case they'll
just use the block for some limited period of time (such as for sending
spam) and return it to you when they're done.

~Seth

They would have to justify their need with ARIN prior to the transfer
actually taking effect, but, this is now allowed for /22 and shorter
under NRPM 8.3 (for better or worse).

However, at the current time, if they can justify an IPv4 /24 under
ARIN policy, they're better off to wait for the board to approve
proposal 2010-2 (which the AC forwarded to the board for final
adoption at our last meeting) and simply apply directly to ARIN.
Once that proposal is enacted by the board, it would also be
possible to effectuate the transfer they described, but, they would
still have to demonstrate their need for the space to ARIN in
order for the transfer to happen.

Since they can get the same block from ARIN as an end user
until IPv4 runout for $1250 initial and $100/year, I don't see
why they would want to pay $5000 for it under the same terms.

Owen

+2 so far here.. Same email, same guy, different netblocks. Spamming
for IP's to spam with?

--heather

Feel free to share the sender's "identity" in case they happen to
actually be a paying customer of any of us on the list...

Schiller, Heather A (HeatherSkanks) wrote:

+2 so far here.. Same email, same guy, different netblocks. Spamming
for IP's to spam with?

$5k payable in faked viagra, no doubt.

Mike

Yeah, we received the same kind of offer here. Here's the message in full:

Anyone else notice they seem to be looking for IP blocks where the
middle octets are the same? How could that specific quality be worth $5K?

Bingo!

From an off list response, it looks like this is someone

searching for "memorable" (note the range he inquired about
with us has the repeated 220 octets in the middle) IP
addresses for some project. The email we received was
apparently from the same Sergey Gotsulyak of Ideco sent
this to a RIPE list,

  http://www.ripe.net/ripe/maillists/archives/address-policy-wg/2010/msg00038.html

We got a strange and out of the blue inquiry from someone
wishing to pay us for a chunk of our ARIN allocation,

Hello,

According to Whois data, you company owns the following
IP address space:

206.220.220.0/24

We would like to get this block of IP addresses for our business
needs. Is it possible to assign this block for our company with
PI (Provider Independent) or PA (Provider Assigned) status?

We ready to pay about $5,000 for the net block itself
and all related procedures.

Would you be interested in such an offer? The amount of compensation
is subject to negotiation.

We're not interested, mostly because we use our allocation,
but also because I think this is not allowed by our agreement
with ARIN. Seems a bit fishy.

I should add the sender identified himself and his company
clearly. It wasn't from some free mail account. (Although it
could of course be spoofed.)

Is this a new thing? IP speculation as we come upon free pool
depletion? A front for spammers?

Yeah, we received the same kind of offer here. Here's the message in full:

******************************
Hello,

According to Whois data, you company owns the following
IP address space:

146.6.6.0/24

We would like to get this block of IP addresses for our business
needs. Is it possible to assign this block for our company with
PI (Provider Independent) or PA (Provider Assigned) status?

We ready to pay about $5,000 for the net block itself
and all related procedures.

Would you be interested in such an offer? The amount of compensation
is subject to negotiation.

--
Kind regards,
Sergey Gotsulyak

http://www.ripe.net/ripe/maillists/archives/address-policy-wg/2010/msg00038.html
http://www.ripe.net/ripe/maillists/archives/address-policy-wg/2010/msg00039.html

My gut tells me they aren't looking for a transfer. I've been through
this last year with someone originally approached me about doing a colo,
then started waffling when it came to how much space and power they
needed. It turns out they only wanted to borrow various /24's for a few
months and would return them when done.

~Seth

They are vanity IPs for use with an anycast DNS service

Maybe APNIC should give him 1.1.1.1 and see how he likes it!

I saw a few reports of those today and wrote a short note to forewarn
some other European R&E networks, plus our customers.

http://webmedia.company.ja.net/edlabblogs/developmenteye/2010/07/03/wanted-memorable-24-for-us5k/

Yup, I know the date on the blog is off by one. :slight_smile:

Cheers,
Rob

Makes one wonder what dead:beef::/32 and c0ff:ee00::/32 will go for? :slight_smile:

Even more off topic:

No match found for cafe:d00d:4:cafe:babe::/32

Did someone say they had fake viagera?

I sent an inquiry in to ARIN yesterday for a certain ASN that was available
and was told that management won't allow them to issue requested numbers. :frowning:

Aaron

That's easy, then... "Can I have any of ASN 0 to $DESIRED-1 or $DESIRED+1 to
65535"... since they can't issue a number that's requested, the one you want
is the only one left.

- Matt
(Back into my hole)

Crist Clark wrote:

An interesting if disturbing thing to see... I suppose there is a
possibility that some IP address speculator is trying to er, acquire
interesting /24s in anticipation of RIR address exhaustion.

I have doubts that an unsolicited e-mail sender intends that proper
policy be followed. especially since they didn't well, in that
unsolicited introduction, even bother with a pretense of a legitimate
assignment reason for PA that would be valid, such as buying IP
connectivity or transit services.

they would probably like things recorded as a simple assign with
anonymized contact info. Presumptively if their intent is nefarious,
they just need to fool one ISP...

> According to Whois data, you company owns the following

Has been assigned, not owns. ARIN RSA Section 9. No property rights.

PI (Provider Independent) or PA (Provider Assigned) status?

They would have to justify their need with ARIN prior to the transfer
actually taking effect, but, this is now allowed for /22 and shorter
under NRPM 8.3 (for better or worse).

They think PA means "Provider Assigned"? PA conventionally means
really provider aggregable, and according to ARIN policy ASSIGNED
PA space is for use in connection with network services obtained
through the provider assigning it, ARIN NRPM 2.4, 4.2.1.1,
4.2.3.1, 4.2.3.4.1, 4.2.3.7.1.

Blocks in the middle of an ISP allocation cannot be changed to PI
blocks by providers these days, not without a transfer approved by
ARIN anyways.

At some point ARIN added requirements to the RSA, that require ISPs
to refrain from permanently assigning rights to blocks of IP
addresses, when IP addresses are assigned to users.

The only way anything assigned directly by an ISP could be PI is back
before the requirements were added to the RSA, if
the ISP assigned the IP block, without making the user promise to
'return the addresses', and only if the user who got the assignment
never later agreed they would return IP addresses when services
ended....

ARIN RSA 15(a)(i): "(i) Except as provided in 15(a)(ii), Applicant
may not assign or delegate this Agreement or any of its rights or
obligations under it, including without limitation the exclusive right
to use the number resources allocated or assigned to it, without
ARIN’s express written permission,
(ii) The event of any transaction (whether a merger, acquisition, or
sale) in which Applicant’s controlling managerial and/or voting
interest changes during the term of this Agreement shall be considered
an assignment, so long as the Applicant provides ARIN with written
notification within thirty (30) days of such assignment."