IPv4 Seller Due Diligence: How to Avoid Fraud in 2025

Most buyers skip IPv4 seller due diligence. That’s the uncomfortable truth. With addresses holding steady at $30–$50 each, a single /24 means tying up $7,000–$12,000 — real money, and real incentive for fraud. Some sellers don’t own what they’re selling. Some blocks were hijacked years ago. Others arrive blacklisted beyond repair. All of it is avoidable, if you verify before you wire anything.

Common Types of IPv4 Seller Fraud

Knowing how the schemes actually work helps you know where to look. These come up again and again in the transfer market:

• Non-ownership sales: The seller lists a block they don’t legally control — often one belonging to a defunct or simply unaware company.
• Hijacked prefixes: Stolen blocks advertised via BGP, sometimes with forged RIR paperwork attached.
• Multiple-sale fraud: The same block sold to several buyers at once, usually through unverified channels.
• Blacklisted ranges: Blocks carrying heavy spam, botnet, or abuse history — reputation damage included in the price, unfortunately.
• False RIR status: Blocks described as “clean and ALLOCATED” that are actually under dispute, frozen, or pending recovery.

Verify Legal Ownership Through RIR Databases

Start here. It’s the most authoritative check you have. Every IPv4 block is registered with one of five RIRs — ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC — and each keeps a public WHOIS database.

What to check in WHOIS

• Org handle and registrant: Does the organization name match the legal entity you’re actually dealing with? Sellers operating under a different company name than the registered holder deserve a hard look.
• Registration status: The block should read ALLOCATED or ASSIGNED — not disputed, reclaimed, or stuck in a transfer-pending state.
• Regulatory status of the seller: On ARIN, the seller’s organization must hold an Open or Legacy Restricted Resource Agreement to transfer. Confirm this with the RIR itself.
• Registration date: Intermediary entities registered last month, with no corporate history? Extra scrutiny.

Don’t stop at WHOIS. Ask for corporate documents: certificate of incorporation, proof of signatory authority, and where relevant, confirmation that the block wasn’t acquired through fraud or government reclamation. Legacy blocks (pre-RIR space) are their own animal — check any Legacy Registry Agreements and keep in mind transfer requirements differ by registry.

Assess Seller Reputation and History

Ownership verification tells you the seller can sell. Reputation research tells you whether they should be trusted to actually execute.

Red flags to watch for

• Pressure to close quickly, or flat refusal to use escrow
• Communication only through personal email, no corporate domain
• No verifiable online presence, references, or transaction history
• Payment requested to personal accounts or crypto wallets
• Reluctance to provide corporate documentation or get on a video call

Green flags that indicate a legitimate seller

• Established corporate entity with a verifiable registration history
• Willingness to work through a recognized escrow service
• Transparent pricing consistent with current rates ($30–$50 per address, depending on block size)
• Documented prior transfers visible in RIR transfer logs

This is where a vetted marketplace earns its fee. IP4 Market, for instance, verifies every seller’s identity and ownership documentation before a listing goes live — which takes a good chunk of legwork off your plate while keeping pricing at market levels.

The Pre-Purchase Due Diligence Checklist

Before any money moves, work through this systematically:

Check Blacklists and Prefix History

Here’s the catch: a legally clean block can still be operationally toxic. Run the full range through the major DNSBLs (Spamhaus SBL/DBL, Barracuda Reputation Block List, UCEPROTECT) and pull historical routing data via RIPEstat or similar. Pay attention to:

• Spam and botnet history: Heavily listed ranges can take months of remediation before Microsoft or Google will treat them decently.
• Geolocation legacy: Blocks previously announced from overseas may carry outdated geolocation data that affects your services.
• Routing anomalies: Frequent, unexplained origination changes can mean the block has passed through hijackers’ hands.

Budget for a remediation window of 30–90 days after the transfer, and once the block is announced under your ASN, notify the major providers proactively. It saves time later.

Use Secure Payment and Escrow Methods

Even with a legitimate seller, payment structure matters. Never wire funds directly against a promise of transfer — not once, not for a “trusted” counterparty. The gold standard is a three-party escrow arrangement:

1. Buyer deposits funds into escrow.
2. Seller submits the transfer request to the RIR.
3. Once the RIR confirms the block is registered to the buyer, escrow releases payment to the seller.

Reputable marketplaces, IP4 Market among them, build escrow protection into every transaction, along with contract templates covering block size, price, transfer timeline, and liability for pre-transfer abuse history. Insist on a written purchase agreement regardless of deal size. Even a /24 deserves a contract.

FAQ