Sixty-five thousand addresses, one fake domain: the quiet risk in legacy IPv4 space

In 1991, an engineering consultancy in Akron, Ohio was issued 147.50.0.0/16 - 65,536 legacy IPv4 addresses, registered in the era before contracts, fees, or Regional Internet Registries existed. Twenty years later, someone noticed the block was dormant.

They registered a lookalike domain in the name of the contact person listed in that two-decade-old record. On 12 December 2011 they convinced the registry to update the contact email to an address they controlled. Four days later, on 16 December, the entire /16 was being announced by an AS the real holder had never heard of. Nobody caught it at the registry. Spamhaus caught it in 2012, after spam started flowing from the range.

Anti-abuse investigators have documented this pattern for over a decade, and it keeps working for one reason: thousands of the Internet's oldest blocks have no one behind them anymore.

What legacy IPv4 blocks are - and why they behave differently

Legacy IPv4 blocks are address ranges issued by InterNIC and its predecessors before the RIR system existed - they carry no contract, no fees, and largely sit outside RIR regulation.

ARIN inherited the bulk of those records when it was formed in December 1997, and decided at its formation to keep registering them without requiring the original holders to sign an agreement or pay fees. The inter-RIR ERX project, completed in February 2005, later moved records for holders in other regions to the RIPE NCC, APNIC, and LACNIC - so legacy space exists in every region today, with the ARIN region holding by far the largest share.

Three properties set these blocks apart. They were allocated when no rules existed, and their independent status has kept them largely outside regulation since. They carry no contract and no fees - which means they cannot lapse for non-payment and can sit untouched, and forgotten, for decades. And they are enormous in aggregate.

When the last available IPv4 blocks were handed to the RIRs in February 2011, the pre-RIR "Central Registry" segment still accounted for roughly 35% of the entire IPv4 address space - about 1.5 billion addresses, the equivalent of some 90 of the 256 total /8 blocks, mostly issued to organizations in North America. That is the space now known as legacy.

The registry-hygiene picture inside that space is the part worth sitting with. As of August 2026, roughly 17,000 legacy blocks are registered in ARIN Whois, and about half have no Point of Contact at all or one ARIN has never been able to verify. Only 11% have a contact record that is currently validated. Another 20% have a contact on file, but with incomplete information.

Compare that with organizations whose resources sit under an ARIN agreement: 76% have a validated contact, and none have incomplete contact information. As ARIN puts it, the difference is not the paperwork. It is that somebody actually reviews the contact details and updates them.

A missing contact is not proof of abandonment - plenty of these blocks are quietly doing useful work. The dangerous ones are those that are both unverified in the registry and absent from the routing table, because that combination is exactly what attackers scan for.

How IP hijacking works - and how to make it fail

The playbook has two paths.

The first captures the registry record itself: revive the lapsed domain behind the contact email, or re-register the name of the defunct holder, and intercept the very messages the registry's recovery workflows depend on. That is what happened to the Akron /16.

The second bypasses the registry entirely - a classic BGP hijacking: a forged Letter of Authorization convinces a transit provider to announce the block on paperwork that merely looks legitimate.

The first path has narrowed since that 2011 case, and it is worth knowing exactly how much. In mid-2025 ARIN suspended the email-based method for approving Point of Contact linking requests, and with its January 2026 software release moved POC linking to a fully authenticated, ticket-based workflow inside ARIN Online. No approval emails, no authorization URLs - approvals now happen inside authenticated accounts, and every request generates a visible, traceable ticket.

That closes the automated version of the 2011 attack. But read the exception clause carefully. If the Point of Contact has no linked users at all, the ticket routes to ARIN's Registration Services Department, who coordinate with the Admin or Tech contacts on the Org ID. If nobody is on the record - the exact condition half of legacy blocks are in - the whole thing falls back to human vetting. And the forged-LOA path is untouched by any of it.

So the registry got harder to fool. An unattended record did not.

How to prevent BGP hijacking of a legacy block

Three countermeasures. None of them is expensive, and the first one is free.

1. Validate your Point of Contact. Under ARIN's Number Resource Policy Manual section 3.6, every registered Admin, Tech, NOC, and Abuse contact receives an annual email asking them to confirm the details are still accurate. If the information is correct, it takes one click. If nobody responds within 60 days, the record is marked invalid - and that invalid state is visible in the public database, which is precisely the signal hijackers are scanning for.

Point the record at a monitored role account rather than an individual's inbox, and secure the mailbox behind it. And note the myth this kills: updating your registration data does not require an ARIN Registration Services Agreement. An agreement only comes into play for services that need one - RPKI, the IRR, or certain transfer types.

2. Bring the resources under agreement. ARIN offered the Legacy Registration Services Agreement from 11 October 2007 through 31 December 2023; it is closed to new signers, and the legacy fee cap expired with it. Today that means a standard RSA, at standard Registration Services Plan fees. It is the prerequisite for RPKI and IRR access in the ARIN region - which makes it the gateway to step three.

3. Publish a Route Origin Authorization. A signed ROA makes the forged-LOA path fail at every network that enforces route origin validation, no matter how convincing the paperwork.

Two numbers give the honest picture of how much protection that buys. As of 26 August 2026, 67.22% of IPv4 prefixes in the global routing table are covered by a ROA - but in the ARIN region the figure is 51.73%, the lowest of any RIR, against 75.14% for the RIPE NCC and 76.11% for APNIC. The region holding the most legacy space is the region signing the least of it.

And coverage is not enforcement. A longitudinal study across more than 28,000 ASes found that 36.2% do not implement route origin validation at all, and only 12.3% achieve full protection. The good news is where enforcement is concentrated: the large transit networks - Lumen, Arelion, GTT, NTT, TATA, PCCW, Orange, AT&T and others - filter upwards of 95% of RPKI-invalid prefixes. A hijacker needs someone to carry the route. A ROA makes the biggest carriers refuse.

The business dimension: hijacked to be sold

The most striking cases are not about spam at all.

In May 2024, Spamhaus published an investigation into a 30-year-old legacy domain that had been revived and used to provide connectivity to hijacked IP blocks. The affected ranges included /16s belonging to real, still-trading companies, and the AS numbers involved traced back to a provider active in IP leasing - which makes the motive fairly clear: the space was taken in order to be leased out. One of the affected holders, TransAlta, regained full control of its /16 by securing it through ARIN's RPKI service. That is the countermeasure above, working, in a documented case.

The economics explain the effort. A lapsed domain bought for a few thousand dollars can hand over de facto control of address space worth seven figures. And the legal exposure on the other side of that trade is now established: in the Micfo case, prosecutors proved a scheme that obtained rights to roughly 757,760 IP addresses with a market value between $9.85 million and $14.4 million, and in September 2023 a federal judge sentenced the company's CEO to five years in prison. The Department of Justice noted he had made over $3 million selling those rights on the secondary market before the scheme was caught. Address fraud is prosecuted as wire fraud, and it carries real sentences.

This matters beyond any single holder, because legacy space is moving again - into transfers, IPv4 leasing, and routing tables - after decades of dormancy. Every hijacked block degrades the registry data buyers and operators rely on for due diligence, poisons the IP reputation feeds used to filter traffic, and hands a fouled reputation to whoever eventually becomes the block's legitimate steward. When criminals sell IPv4 addresses they never held, and offer them on the open market alongside legitimate inventory, everyone's due diligence gets more expensive.

A dormant legacy record is shared infrastructure risk.

A managed IPv4 leasing marketplace for holders

Monetize IPv4 Without Selling the Asset

Monetize your IPv4

Start with the step that costs nothing

If you hold legacy space, log in and confirm the contact is real and monitored. It takes minutes, it costs nothing, it requires no agreement, and it closes the oldest attack path in this article.

Then find out what the block is actually worth to you. Those thousands of quiet records are an opportunity, not a verdict - most of them just need someone to answer.

See what your block could earn →

Frequently asked questions

What are legacy IPv4 addresses?

Legacy IPv4 addresses are blocks issued by InterNIC and its predecessor registries before the Regional Internet Registry system existed. They carry no registration agreement and no annual fees, they cannot be revoked for non-payment, and they sit largely outside RIR regulation. They account for roughly 35% of the total IPv4 address space, and most of them were issued to organizations in North America.

Can a legacy IP block be hijacked?

Yes, and legacy blocks are the preferred target. Attackers look for records that are both unverified in the registry and absent from the routing table. They either capture the registry record - by reviving the lapsed domain behind the contact email or re-registering a defunct holder's name - or bypass the registry with a forged Letter of Authorization sent to a transit provider. Around half of ARIN's roughly 17,000 legacy blocks have no verified contact.

How do I protect a legacy IPv4 block?

Three steps. Validate your Point of Contact through ARIN's annual validation - it is free, takes one click, and requires no agreement. Point that contact at a monitored role account rather than an individual's inbox. Then bring the resources under a Registration Services Agreement and publish a Route Origin Authorization, so that networks running route origin validation drop unauthorised announcements of your block regardless of the paperwork behind them.

Can you lease or sell legacy IPv4 space?

Yes. Legacy blocks can be transferred or leased like any other IPv4 resource, and legacy space has been moving back into the market after decades of dormancy. Clean registry data is a prerequisite in practice: buyers and lessees run due diligence against Whois, and a record with no verified contact slows or blocks the transaction. Validating your contact is the first step in monetizing the block, not a separate chore.