IPv4 Fraud: 5 Years in Federal Prison for Defrauding ARIN | Hacker News Reader

IPv4 Fraud: 5 Years in Federal Prison for Defrauding ARIN

arin.net

41 pointsatyvr7 comments

This is a bad source, it doesn't even tell us what the fraud was or what the case was about. I understand that it is from ARIN and ARIN is the victim, but it doesn't mean it is a good write-up.

This article from 2019 is, less bad, but still doesn't explain it very well:

https://www.zdnet.com/home-and-office/networking/arin-recove...

So, they purchased addresses from ARIN (via shell companies), then resold them. They made a profit. That's arbitrage. All the article keeps saying vis-a-vis fraud is they "failed to provide documents."

My point isn't even that this isn't fraud, it is just that seemingly nobody is able to write up the case in a coherent way. EXPLAIN THE FRAUD.

> Mr. Golestan obtained and utilized previously created shelf companies spread out across the nation and used aliases to conceal his identity, including providing ARIN with falsely notarized affidavits of officers who did not exist to induce ARIN to issue over 730,000 IPv4 addresses to 11 companies and to approve transfers and reassignments of these addresses

I suspect there are limits and rules about who can be issued ipv4 addresses.

Setting up shell companies with fake employees, addresses, and so on is generally considered fraud: https://www.justice.gov/usao-sc/pr/charleston-man-and-busine...

The source is ARIN itself, and they clearly state what he did:

>the elaborate scheme involved the use of legally registered but non-existent companies Golestan claimed were “Channel Partners” to defraud not only ARIN but also the entire Internet community. The prosecutors proved that “through this scheme, Golestan and Micfo obtained the rights to approximately 757,760 IP addresses, with a market value between $9,850,880.00 and $14,397,440.00.”

So basically, he stole tons of IPv4 address space he wasn't legally entitled to by using tons of shell companies with no purpose but to defraud ARIN.

When ARIN transacts for addresses, by policy, it's based on documented need. Typically, documents prepared by the applicant are accepted, but IIRC, ARIN reserves the right to ask for more. ARIN may also approve addresses based on projected use and later ask for documents showing deployment.

If the need was made up to procure addresses for sale, that's fraud. If ARIN asks for deployment documentation and it's not provided, there could be lots of reasons, but if the applicant never intended to deploy and doesn't want to make up more documents, that points towards fraud at the initial application.

(Not sure if anyone wrote a good article to reference)

The criminal wire fraud was committed when he generated false identities to file the applications to ARIN. If he had only made up the need for the addresses, and not generated fake identities, then perhaps he would have been exposed to only civil liability.

A more nuanced writeup [0] is on the front page [1] right now.

[0] https://krebsonsecurity.com/2023/10/tech-ceo-sentenced-to-5-...

[1] https://news.ycombinator.com/item?id=37917597

Reply on news.ycombinator.com