IPv4 Due Diligence: How to Verify Ownership and Avoid Fraud

Due diligence is the foundation of safe IPv4 transactions. Before buying or selling, you need to verify ownership, validate documentation, check reputation, and ensure proper RIR procedures. This guide covers the complete due diligence process for IPv4 transactions.

Why Due Diligence Matters

The IPv4 secondary market has matured, but fraud risks remain. Law enforcement cases have shown that bad actors attempt to sell addresses they don’t own, forge authorization documents, or misrepresent block history. Proper due diligence protects against these risks.

What’s at stake:

• Buyers risk paying for addresses they may never receive or that have title disputes
• Sellers risk fraud allegations if documentation is incomplete
• Both parties risk transaction delays, legal costs, and reputational damage

Due diligence isn’t optional—it’s the standard of care for legitimate IPv4 transactions.

The Due Diligence Checklist

1. Verify Ownership

Check the RIR record. Every IPv4 block has a record in the relevant RIR database:

• ARIN WHOIS for North American resources
• RIPE Database for European/Middle Eastern/Central Asian resources
• APNIC WHOIS for Asia-Pacific resources
• LACNIC WHOIS for Latin American/Caribbean resources
• AFRINIC WHOIS for African resources

The seller should be the holder of record, or have documented authority to transfer (e.g., an LIR acting with proper authorization from the holder).

Verify organizational identity. Confirm the selling entity matches the RIR record. Check business registration, domain ownership, and communication channels to ensure you’re dealing with the actual holder.

Document chain of custody. For blocks that have transferred before, understand the history. RIRs maintain transfer records; clean history supports legitimacy.

2. Validate the LOA

What to verify:

• The LOA is signed by an authorized representative of the holder of record
• The block(s) covered match exactly what you’re acquiring
• The authorization scope is appropriate (transfer vs. temporary use)
• Contact information matches the RIR record

Red flags:

• LOA signer doesn’t match RIR record
• Generic or templated LOAs without specific block details
• Inability to verify LOA with the holder directly
• Pressure to skip LOA verification

3. Check Block Reputation

Ownership verification doesn’t tell you about block history. Reputation matters for email, VPN/proxy, and hosting use cases.

Check blocklists:

• Spamhaus SBL/XBL
• SORBS
• Barracuda
• SpamCop

Check reputation services:

• Cisco Talos
• Sender Score

For detailed reputation guidance, see IPv4 Reputation: Why Clean Blocks Matter.

4. Verify Transfer Eligibility

Each RIR has specific transfer policies. Verify:

• The block is eligible for transfer under RIR policy
• No pending disputes or liens on the addresses
• The transfer type (intra-RIR vs. inter-RIR) is permitted
• Waiting periods or holding requirements are satisfied

Our complete guide to IPv4 transfer processes covers each RIR’s requirements.

Working with the RIR

RIR verification protects everyone. ARIN, RIPE, APNIC, LACNIC, and AFRINIC verify eligibility and process transfers. The RIR won’t complete a transfer without valid proof of authorization. This protects buyers from fake ownership and sellers from fraudulent claims.

Documentation the RIR requires:

• Proof of holder authorization (LOA)
• Transfer agreement between parties
• Recipient eligibility documentation (varies by RIR)
• Payment confirmation (for some RIRs)

The transfer completes when the RIR updates the registry. Until then, you don’t have title to the addresses.

For Sellers: Protecting Yourself

Sellers have due diligence obligations too:

Only sell what you own. Ensure you’re the holder of record or have valid authority to transfer. Document your chain of custody.

Provide valid documentation. Generate proper LOAs, signed by authorized representatives. Cooperate with buyer verification requests.

Follow RIR procedures. Complete the transfer properly so the registry reflects the new holder. Our how to sell IPv4 guide walks through the process.

Use escrow when appropriate. Escrow protects both parties by holding payment until transfer completes.

Using Brokers and Marketplaces

Reputable brokers and marketplaces handle due diligence professionally:

• Verify ownership before listing blocks
• Validate LOAs and seller authorization
• Check block reputation
• Coordinate RIR transfer procedures
• Provide escrow or payment protection

Using established intermediaries adds cost but reduces risk and speeds transactions. For direct deals, you handle due diligence yourself—make sure you have the expertise.

Key Takeaways

• Due diligence is the standard of care for legitimate IPv4 transactions
• Always verify ownership through RIR records before any transaction
• Validate LOAs directly with holders when possible
• Check block reputation for email, VPN/proxy, and hosting use cases
• Follow proper RIR transfer procedures—the transfer completes when the registry updates
• Sellers have due diligence obligations too: documentation, process, and transparency
• Reputable brokers add protection; direct deals require you to handle due diligence yourself