{"id":1146,"date":"2026-09-08T10:06:45","date_gmt":"2026-09-08T10:06:45","guid":{"rendered":"https:\/\/ip4.market\/blog\/1146-2\/"},"modified":"2026-09-08T10:06:47","modified_gmt":"2026-09-08T10:06:47","slug":"ipv4-seller-due-diligence-how-to-avoid-fraud-in-2025","status":"publish","type":"post","link":"https:\/\/ip4.market\/blog\/ipv4-seller-due-diligence-how-to-avoid-fraud-in-2025\/","title":{"rendered":"IPv4 Seller Due Diligence: How to Avoid Fraud in 2025"},"content":{"rendered":"<p>Most buyers skip IPv4 seller due diligence. That&#8217;s the uncomfortable truth. With addresses holding steady at $30\u2013$50 each, a single \/24 means tying up $7,000\u2013$12,000 \u2014 real money, and real incentive for fraud. Some sellers don&#8217;t own what they&#8217;re selling. Some blocks were hijacked years ago. Others arrive blacklisted beyond repair. All of it is avoidable, if you verify before you wire anything.<\/p>\n<div class=\"tools-toc\"><strong>In this article:<\/strong><\/p>\n<ol>\n<li><a href=\"#risks\">Common Types of IPv4 Seller Fraud<\/a><\/li>\n<li><a href=\"#ownership\">Verify Legal Ownership Through RIR Databases<\/a><\/li>\n<li><a href=\"#reputation\">Assess Seller Reputation and History<\/a><\/li>\n<li><a href=\"#checklist\">The Pre-Purchase Due Diligence Checklist<\/a><\/li>\n<li><a href=\"#blacklists\">Check Blacklists and Prefix History<\/a><\/li>\n<li><a href=\"#escrow\">Use Secure Payment and Escrow Methods<\/a><\/li>\n<li><a href=\"#faq\">FAQ<\/a><\/li>\n<\/ol>\n<\/div>\n<h2 id=\"risks\">Common Types of IPv4 Seller Fraud<\/h2>\n<p>Knowing how the schemes actually work helps you know where to look. These come up again and again in the transfer market:<\/p>\n<ul>\n<li><strong>Non-ownership sales:<\/strong> The seller lists a block they don&#8217;t legally control \u2014 often one belonging to a defunct or simply unaware company.<\/li>\n<li><strong>Hijacked prefixes:<\/strong> Stolen blocks advertised via BGP, sometimes with forged RIR paperwork attached.<\/li>\n<li><strong>Multiple-sale fraud:<\/strong> The same block sold to several buyers at once, usually through unverified channels.<\/li>\n<li><strong>Blacklisted ranges:<\/strong> Blocks carrying heavy spam, botnet, or abuse history \u2014 reputation damage included in the price, unfortunately.<\/li>\n<li><strong>False RIR status:<\/strong> Blocks described as &#8220;clean and ALLOCATED&#8221; that are actually under dispute, frozen, or pending recovery.<\/li>\n<\/ul>\n<div class=\"result-box warning\"><strong>Warning:<\/strong> Deals well below market rate \u2014 a \/24 at $4,000 when the going rate is $9,000+ \u2014 are the most common red flag there is. Fraudsters count on urgency and price temptation to make buyers stop asking questions.<\/div>\n<h2 id=\"ownership\">Verify Legal Ownership Through RIR Databases<\/h2>\n<p>Start here. It&#8217;s the most authoritative check you have. Every IPv4 block is registered with one of five RIRs \u2014 ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC \u2014 and each keeps a public WHOIS database.<\/p>\n<h3>What to check in WHOIS<\/h3>\n<ul>\n<li><strong>Org handle and registrant:<\/strong> Does the organization name match the legal entity you&#8217;re actually dealing with? Sellers operating under a different company name than the registered holder deserve a hard look.<\/li>\n<li><strong>Registration status:<\/strong> The block should read ALLOCATED or ASSIGNED \u2014 not disputed, reclaimed, or stuck in a transfer-pending state.<\/li>\n<li><strong>Regulatory status of the seller:<\/strong> On ARIN, the seller&#8217;s organization must hold an Open or Legacy Restricted Resource Agreement to transfer. Confirm this with the RIR itself.<\/li>\n<li><strong>Registration date:<\/strong> Intermediary entities registered last month, with no corporate history? Extra scrutiny.<\/li>\n<\/ul>\n<p>Don&#8217;t stop at WHOIS. Ask for corporate documents: certificate of incorporation, proof of signatory authority, and where relevant, confirmation that the block wasn&#8217;t acquired through fraud or government reclamation. Legacy blocks (pre-RIR space) are their own animal \u2014 check any Legacy Registry Agreements and keep in mind transfer requirements differ by registry.<\/p>\n<h2 id=\"reputation\">Assess Seller Reputation and History<\/h2>\n<p>Ownership verification tells you the seller <em>can<\/em> sell. Reputation research tells you whether they should be trusted to actually execute.<\/p>\n<h3>Red flags to watch for<\/h3>\n<ul>\n<li>Pressure to close quickly, or flat refusal to use escrow<\/li>\n<li>Communication only through personal email, no corporate domain<\/li>\n<li>No verifiable online presence, references, or transaction history<\/li>\n<li>Payment requested to personal accounts or crypto wallets<\/li>\n<li>Reluctance to provide corporate documentation or get on a video call<\/li>\n<\/ul>\n<h3>Green flags that indicate a legitimate seller<\/h3>\n<ul>\n<li>Established corporate entity with a verifiable registration history<\/li>\n<li>Willingness to work through a recognized escrow service<\/li>\n<li>Transparent pricing consistent with current rates ($30\u2013$50 per address, depending on block size)<\/li>\n<li>Documented prior transfers visible in RIR transfer logs<\/li>\n<\/ul>\n<p>This is where a vetted marketplace earns its fee. <strong>IP4 Market<\/strong>, for instance, verifies every seller&#8217;s identity and ownership documentation before a listing goes live \u2014 which takes a good chunk of legwork off your plate while keeping pricing at market levels.<\/p>\n<h2 id=\"checklist\">The Pre-Purchase Due Diligence Checklist<\/h2>\n<p>Before any money moves, work through this systematically:<\/p>\n<div class=\"comparison-table\">\n<table>\n<thead>\n<tr>\n<th>Check<\/th>\n<th>Source<\/th>\n<th>What a Pass Looks Like<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>WHOIS ownership match<\/td>\n<td>RIR WHOIS (ARIN, RIPE, APNIC, etc.)<\/td>\n<td>Registrant matches the seller&#8217;s legal entity<\/td>\n<\/tr>\n<tr>\n<td>Block status<\/td>\n<td>RIR database<\/td>\n<td>ALLOCATED\/ASSIGNED, no disputes or holds<\/td>\n<\/tr>\n<tr>\n<td>Transfer eligibility<\/td>\n<td>RIR policies (NRPM 8.x, RIPE-690, etc.)<\/td>\n<td>Seller meets the registry&#8217;s transfer requirements<\/td>\n<\/tr>\n<tr>\n<td>Abuse history<\/td>\n<td>Spamhaus, Barracuda, UCEPROTECT<\/td>\n<td>Clean or remediable listings<\/td>\n<\/tr>\n<tr>\n<td>BGP history<\/td>\n<td>RIPEstat, BGPlay, Hurricane Electric BGP toolkit<\/td>\n<td>Stable, consistent origination history<\/td>\n<\/tr>\n<tr>\n<td>Corporate verification<\/td>\n<td>Business registries, secretary of state filings<\/td>\n<td>Active entity, valid signatory<\/td>\n<\/tr>\n<tr>\n<td>Payment security<\/td>\n<td>Escrow service<\/td>\n<td>Funds released only after RIR confirms transfer<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"result-box\"><strong>Pro tip:<\/strong> Screenshot every verification step, with timestamps. If a dispute arises later \u2014 or the block gets reclaimed by its rightful owner \u2014 that paper trail is your best evidence. It&#8217;s tedious. Do it anyway.<\/div>\n<h2 id=\"blacklists\">Check Blacklists and Prefix History<\/h2>\n<p>Here&#8217;s the catch: a legally clean block can still be operationally toxic. Run the full range through the major DNSBLs (Spamhaus SBL\/DBL, Barracuda Reputation Block List, UCEPROTECT) and pull historical routing data via RIPEstat or similar. Pay attention to:<\/p>\n<ul>\n<li><strong>Spam and botnet history:<\/strong> Heavily listed ranges can take months of remediation before Microsoft or Google will treat them decently.<\/li>\n<li><strong>Geolocation legacy:<\/strong> Blocks previously announced from overseas may carry outdated geolocation data that affects your services.<\/li>\n<li><strong>Routing anomalies:<\/strong> Frequent, unexplained origination changes can mean the block has passed through hijackers&#8217; hands.<\/li>\n<\/ul>\n<p>Budget for a remediation window of 30\u201390 days after the transfer, and once the block is announced under your ASN, notify the major providers proactively. It saves time later.<\/p>\n<h2 id=\"escrow\">Use Secure Payment and Escrow Methods<\/h2>\n<p>Even with a legitimate seller, payment structure matters. Never wire funds directly against a promise of transfer \u2014 not once, not for a &#8220;trusted&#8221; counterparty. The gold standard is a three-party escrow arrangement:<\/p>\n<ol>\n<li>Buyer deposits funds into escrow.<\/li>\n<li>Seller submits the transfer request to the RIR.<\/li>\n<li>Once the RIR confirms the block is registered to the buyer, escrow releases payment to the seller.<\/li>\n<\/ol>\n<p>Reputable marketplaces, <strong>IP4 Market<\/strong> among them, build escrow protection into every transaction, along with contract templates covering block size, price, transfer timeline, and liability for pre-transfer abuse history. Insist on a written purchase agreement regardless of deal size. Even a \/24 deserves a contract.<\/p>\n<h2 id=\"faq\">FAQ<\/h2>\n<div class=\"faq-block\">\n<p><strong>How long does IPv4 seller due diligence take?<\/strong><\/p>\n<p>For a straightforward \/24 from a cooperative seller, plan on 3\u20137 business days. Complex legacy blocks or transfers across registries can stretch to several weeks.<\/p>\n<p><strong>Can I recover funds if I&#8217;m defrauded?<\/strong><\/p>\n<p>Rarely, and almost never in full. Crypto payments and international wires to shell entities are effectively gone. This is why escrow is non-negotiable.<\/p>\n<p><strong>Are RIR transfers themselves safe?<\/strong><\/p>\n<p>Yes. RIR-reviewed transfers are the safest mechanism available \u2014 the registry validates the seller&#8217;s rights and applies policy requirements. The danger sits in private deals that bypass all of it.<\/p>\n<p><strong>What&#8217;s the biggest red flag in a seller listing?<\/strong><\/p>\n<p>Below-market pricing paired with urgency (&#8220;price goes up Friday,&#8221; &#8220;three other buyers interested&#8221;). Legitimate IPv4 trades almost never require rushed decisions.<\/p>\n<\/div>\n<div class=\"faq-block\">\n<p><strong>Bottom line:<\/strong> Thorough due diligence \u2014 WHOIS verification, reputation research, blacklist checks, escrow-protected payment \u2014 brings fraud risk close to zero. Buyers who cut corners to save a week often lose the whole investment. A verified marketplace like <strong>IP4 Market<\/strong> gives you documented ownership, vetted counterparties, and secure transaction infrastructure from day one.<\/p>\n<\/div>\n<div class=\"ip4-cta\" style=\"margin:2em 0;padding:1.2em 1.5em;border:1px solid #d8dee9;border-left:4px solid #00b8d4;border-radius:6px;background:#f8fafc\">\n<p style=\"margin:0\"><strong>Need IPv4 space?<\/strong> Lease RIPE-verified \/24&ndash;\/22 subnets at a flat $0.50\/IP per month &mdash; LOA + RPKI\/ROA in minutes, instant company verification, automatic renewals. <a href=\"https:\/\/panel.ip4.market\/marketplace?utm_source=blog&amp;utm_medium=cta&amp;utm_campaign=post-footer\" rel=\"nofollow\">Browse available subnets &rarr;<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Most buyers skip IPv4 seller due diligence. That&#8217;s the uncomfortable truth. With addresses holding steady at $30\u2013$50 each, a single \/24 means tying up $7,000\u2013$12,000 \u2014 real money, and real&#8230;<\/p>\n","protected":false},"author":1,"featured_media":1148,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1146","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ipv4-market"],"_links":{"self":[{"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/posts\/1146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/comments?post=1146"}],"version-history":[{"count":1,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/posts\/1146\/revisions"}],"predecessor-version":[{"id":1147,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/posts\/1146\/revisions\/1147"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/media\/1148"}],"wp:attachment":[{"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/media?parent=1146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/categories?post=1146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ip4.market\/blog\/wp-json\/wp\/v2\/tags?post=1146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}