What should I check before buying an IPv4 block?

That the seller is the holder of record at the registry, that the block is not under a transfer restriction or dispute, who has announced it in BGP and what ROAs exist, whether it is on blocklists, and where geolocation databases place it. Each check has a pass condition in the table on this page.

Is a WHOIS record enough to prove ownership?

It proves registration, not authority to sell. Also confirm that the person signing works for the holder and may sign for it, using a current company registry extract, and that the organisation in WHOIS is the same legal entity as the one on the contract.

Does a block need to be unannounced to be clean?

No. A block announced by the holder’s own ASN with a matching ROA is a good sign. What matters is who announced it: origins the seller cannot explain, especially short bursts from unrelated ASNs, point to a hijack or an undisclosed lease.

Can a blocklisted block still be bought?

Yes, if the listing is understood and removable. Policy-based listings for address ranges with no mail server are routine; an active spam listing from a current lessee is a negotiation point and a delisting task that has to be finished before the block goes into production.

IPv4 Block Verification Checklist

Reviewed by Lukas Brandt, Head of IPv4 brokerage

Run every check below before the contract is signed. Most take minutes with public tools; together they establish that the seller can sell, the registry will approve, and the block will work once it is yours. For why each category matters to a buyer, see the due diligence guide on the blog.

The checklist

#	Check	Where to look	Pass	Red flag
1	Holder of record	RIR WHOIS / RDAP	Organisation matches the selling legal entity exactly	Different name, a reseller, or “will be transferred to us first”
2	Registration status	`status:` / `NetType`	`ALLOCATED PA`, `ASSIGNED PI`, `LEGACY`, or ARIN direct allocation	`ASSIGNED PA` or a reassignment — the seller is a customer, not the holder
3	Signatory authority	Company registry extract, less than 3 months old	Signer listed as director or holds a power of attorney from one	Signer cannot be found in the extract
4	Corporate standing	National company registry	Active company	Dissolved, struck off, or in liquidation
5	Transfer restrictions	RIR policy; last transfer date in the RIR transfer log	Outside the 24-month (RIPE), 12-month (ARIN, AFRINIC), or 5-year 103/8 (APNIC) window	Received recently, or on the RIPE Voluntary Transfer Lock list
6	Chain of title	RIR transfer statistics, `created:` / `last-modified:`, historic WHOIS	Each change of holder explained by a transfer or merger record	Holder changed with no registry record, or a recent reactivation of a long-dormant organisation
7	Disputes and encumbrances	Seller declaration; court records in the holder’s jurisdiction; RIR notes on the object	None declared, none found	Litigation, insolvency, a pledge over the block, or remarks referencing a dispute
8	Current routing	RIPEstat routing status, a looking glass	Unannounced, or announced by the holder’s ASN	Announced by an ASN the seller cannot name
9	Routing history	RIPEstat BGP history, route collectors	Stable origins the seller can explain	Short bursts of announcements from unrelated ASNs
10	RPKI	RIR RPKI dashboard, RIPEstat RPKI validation	No ROAs, or ROAs for the holder’s or a disclosed lessee’s ASN	ROAs authorising unknown ASNs, or `maxLength` wider than any real announcement
11	IRR objects	RADB, RIR IRR databases	Route objects only for known origins	Stale `route` objects for unrelated ASNs in third-party IRRs
12	Blocklists	Spamhaus, other DNSBLs	Not listed, or listed only on policy lists	Spamhaus SBL or DROP, or listings tied to current abuse
13	Geolocation	Major geolocation databases, existing geofeed	Country matches intended use, or a geofeed can correct it	Country the block cannot be moved out of in reasonable time for your use case
14	Current use	Seller declaration, reverse DNS, active hosts	Empty, or a lessee with a documented end date	Live customers with no exit plan before completion
15	Sanctions	EU, US OFAC, and UK lists for both parties	No match	Any match — the registry will refuse

Most RIRs’ records and all the routing sources are public. Checks 3, 4, 7, and 15 need the seller’s documents or a counterparty screening service.

How to run the registry checks

Query the authoritative registry and confirm the fields used in checks 1, 2, and 6:

whois -h whois.ripe.net 203.0.113.0/24 | grep -E '^(inetnum|netname|org|status|mnt-by|created|last-modified):'
whois -h whois.ripe.net ORG-EXAMPLE1-RIPE | grep -E '^(org-name|org-type|country|address):'

For ARIN space, the equivalent fields are NetRange, NetType, OrgName, RegDate, and Updated:

whois -h whois.arin.net "n + 203.0.113.0"

WHOIS and RDAP explains how to read the status values for each registry and how to resolve conflicting answers between them.

How to run the routing and RPKI checks

RIPEstat covers prefixes from every registry, not only RIPE space:

# Who announces the prefix now, and since when
curl -s "https://stat.ripe.net/data/routing-status/data.json?resource=203.0.113.0/24" \
  | jq '.data.origins, .data.first_seen'

# Validity of a specific origin against published ROAs
curl -s "https://stat.ripe.net/data/rpki-validation/data.json?resource=AS64500&prefix=203.0.113.0/24" \
  | jq '.data.status, .data.validating_roas'

Ask the seller to explain every origin ASN in the history. Legitimate answers include their own network, a former upstream, and a disclosed lessee. Silence or “we don’t know” is the answer to investigate.

How to run the reputation checks

DNSBL queries take the address in reverse octet order:

dig +short 1.113.0.203.zen.spamhaus.org

An empty answer means not listed. Spamhaus refuses queries arriving through large public resolvers, so run this from your own resolver or use the Spamhaus web lookup. Sample several addresses across the block, not only the first one: listings are usually per address or per /24.

Before announcing, also check the block against the bogon lists your upstreams filter on — see reserved and bogon ranges. A block that was unannounced for years may still appear in stale filters.

What to do with a failed check

A failed check does not end the deal automatically. Sort failures into three groups:

Blocking. Checks 1, 3, 4, 5, 7 when a dispute is active, and 15. The registry will refuse the transfer or the seller cannot give title. Stop until fixed.
Fix before completion. Checks 10, 11, 12, and 14. Make the seller responsible for revoking ROAs, deleting stale route objects, finishing delistings, and ending leases, and state it in the contract as a condition of escrow release.
Price or plan around. Check 13 and minor history in check 9. Geolocation can be corrected after the transfer with a geofeed; historic but explained announcements are normal for a used block.

Transfer risks describes the patterns behind the blocking failures. If you want these checks run for you as part of a purchase, see buying IPv4 with verification included.

Last updated on October 3, 2026

Transfer process Documents by registry