To buy global IPv4, an organization takes over the registration rights to an existing address block through a transfer approved and recorded by a Regional Internet Registry (RIR), such as ARIN, RIPE NCC or APNIC. With the registries' free IPv4 pools largely depleted, that block almost always comes with a history: previous holders, routing announcements, possible abuse and sometimes disputes over who can transfer it.
A transfer without due diligence can leave your team managing someone else's routing, reputation or legal problems. This checklist covers the security checks to run before buying global IPv4 and the tasks for the first day the block is live.
Decide Whether You Need to Buy
Start with an inventory of current IPv4 use, including idle subnets and oversized allocations that could be reorganized. Then separate services that need stable public addresses from workloads that IPv6 or network address translation (NAT) could cover.
If you still need space, compare buying with leasing over your expected holding period. The security difference is control: a purchase moves the registration to your organization, while a lease leaves it with the lessor, so you rely on their standing and cooperation for routing authorizations, reverse DNS and incident response.
ARIN offers three transfer routes. Section 8.2 covers mergers, acquisitions and reorganizations, Section 8.3 covers transfers to a specified recipient within the ARIN region and Section 8.4 covers transfers between registries. An ordinary purchase should not be dressed up as an acquisition transfer to avoid another policy's requirements.
For an 8.3 or 8.4 transfer out of ARIN, the source organization must be the current registered holder, must not be involved in any dispute over the resources and must provide a signed, notarized Officer Acknowledgement Letter. The minimum transfer size is a /24, and recipients must meet the needs-based requirements in NRPM Section 8.5.
Both parties submit their requests through ARIN Online, and a buyer who has not yet found a seller can request pre-approval. After approval, the recipient pays any remaining fees and signs a Registration Services Agreement within 90 days; ARIN completes the transfer within two business days of receiving both.
RIPE NCC and APNIC follow their own procedures, and ARIN lists both as approved for inter-RIR transfers. For a cross-region purchase, confirm that both registries support the transfer and who submits each request.
The first check is whether the seller is the registered holder or an authorized representative. Use RDAP, the registry lookup service for IP address registration data, to confirm the organization name and contacts, then verify the negotiator's authority through an independently established contact channel.
A mismatch between the seller's company and the registered entity needs a documented explanation. Treat the seller like any other third party: the due diligence that frameworks for supply chain security recommend applies before you commit funds.
Next, review the registration history. ARIN's WhoWas service shows previous holders and contact changes, and unexplained changes just before a sale deserve scrutiny. Check too for dissolved companies or bankruptcy proceedings; if the registrant no longer exists, ARIN may require an 8.2 transfer before the sale can proceed.
A Letter of Authorization (LOA) that lets a network announce a block does not establish authority to sell it. Verify the holder and transfer eligibility through the registry process, and pause the deal if the seller resists those checks.
Check standing and fees. A correct registration record does not prove the holder's account is in good standing. Ask for written confirmation of outstanding registry charges and any pending dispute or revocation notice, and assign responsibility for unpaid charges in the contract.
Two systems need attention before the block goes live. Internet Routing Registry (IRR) records describe routing policy and help networks build filters. The Resource Public Key Infrastructure (RPKI) lets a holder publish Route Origin Authorizations (ROAs), which name the autonomous system number (ASN) allowed to originate a prefix.
Review existing ROAs, IRR route objects and observed announcements together, and ask about authorizations for unexpected networks. A seller may legitimately use a hosting provider's ASN, so ask for an explanation before treating a difference as abuse.
Confirm what the registry handles automatically. In an ARIN transfer, the transferred prefixes are removed from the source's RPKI certificate along with their ROAs, and ARIN asks the source to update or remove IRR objects that no longer apply. Other registries may differ, and if a stale seller ROA remains, your announcement can be classified as RPKI-invalid and dropped by networks that validate routes.
When you create your own ROAs, authorize only the origin ASNs and prefix lengths you intend to use. The maxLength setting controls how specific an announcement may be, so avoid allowing smaller subnets you do not plan to announce.
Review routing history. Public BGP archives show how a prefix has been announced over time. RIPEstat's BGPlay visualizes routing changes and CAIDA's BGPStream supports deeper analysis. Look for unexplained origin ASNs, abrupt changes and short-lived announcements of smaller subnets, and ask the seller to explain significant events.
Addresses can keep a poor reputation after changing hands. Check the range through reputable blocklist operators' lookup tools, following their query limits, and read each result according to the list's purpose.
Spamhaus's Policy Blocklist (PBL), for example, identifies ranges that should not send mail directly to receiving servers; a PBL listing is not, by itself, evidence of spam. Keep abuse listings separate from bogon and fullbogon feeds such as Team Cymru's, which flag reserved or unallocated space rather than bad reputation.
Record the date and scope of each check. A listing is not always a reason to walk away, but assess the remediation work, require the seller's cooperation and leave time for delisting before critical services move onto the block.
Commercial geolocation providers such as MaxMind may keep placing a transferred block in the seller's location, which can affect localized content and payment checks. Plan to submit corrections and publish a geofeed describing the intended locations of your ranges, and test the services your users rely on rather than one database.
Reverse DNS maps an address to a hostname through a PTR record, and mail receivers often check it. Prepare the in-addr.arpa delegation to your nameservers and the PTR records you need, and confirm that sending hostnames resolve back to their addresses before moving production mail.
Have counsel review the contract. It should cover the seller's authority to transfer, outstanding registry charges, known abuse or blocklist issues and the seller's cooperation on routing records, reverse DNS and delisting. It should also state what happens if the registry rejects the transfer.
Tie escrow release to the registry recording the transfer and to agreed handover evidence, not to contract signature. Verify the escrow provider independently, confirm payment instructions through a trusted channel and give intermediaries the same scrutiny as sellers.
For cross-border deals, ask counsel or your compliance team which sanctions, anti-money-laundering and know-your-customer (KYC) rules apply, and complete those checks before funds are committed.
Budget from dated, transaction-specific quotes rather than a market average, and compare offers for similar block sizes, regions and transfer conditions. Confirm broker, platform, escrow, registry transfer and ongoing account fees, then add the operational work: reputation checks, possible delisting, location corrections and routing changes. A lower asking price is not a lower total cost if the block needs heavy cleanup.
Common channels include auctions, private brokerage and fixed-price marketplaces. Auctions make bids easy to compare, but deadlines can squeeze due diligence, so finish essential checks before bidding. A broker can locate blocks and coordinate a deal, though the scope of verification varies by firm.
Some fixed-price marketplaces build vetting into each listing. IPv4 Connect, for example, includes a free blacklist report covering more than 100 global blacklists with every subnet, removes old BGP announcements, route records and DNS entries before a block transfers, and manages transfers with pre-approval assistance in the ARIN, RIPE and APNIC regions. Treat any provider's reports as a starting point and still verify the seller and resource independently.
In the ARIN region, the Qualified Facilitator list is a useful reference when researching intermediaries, though inclusion does not replace your own checks. Whatever the channel, confirm who holds the resource, who handles the funds and who is responsible if the transfer stalls.
Keep IRR records, ROAs and actual announcements aligned, and review them before adding an upstream provider or announcing smaller subnets. Use Route Origin Validation on received routes under a tested policy, along with filtering and anti-spoofing practices; publishing ROAs helps validating networks assess your routes but does not make every network reject unauthorized ones.
Keep monitoring active after the handover, assign an owner for new routing changes and reputation listings, and store transfer records and handover evidence where both operations and legal teams can find them.
Buying global IPv4 deserves the same scrutiny as any other critical infrastructure acquisition. Confirm transfer authority and registry eligibility, investigate routing and reputation history and tie payment to clearly defined completion conditions.
Then coordinate the technical handover so that registration, routing records, filters and DNS all agree. A documented process cannot remove every risk, but it brings inherited problems to the surface before they reach production services.
What does it mean to buy global IPv4?
You take over the registration rights to an IPv4 block through a transfer approved and recorded by the responsible RIR, such as ARIN, RIPE NCC or APNIC.
What is the minimum block size for an ARIN transfer?
A /24, or 256 addresses, for both specified-recipient and inter-RIR transfers.
Does a Letter of Authorization prove the seller can sell a block?
No. An LOA may let a network announce a block, but authority to transfer it has to be confirmed through the registry.
What happens to the seller's ROAs in an ARIN transfer?
ARIN removes the transferred prefixes from the source's RPKI certificate along with their ROAs. You then publish your own ROAs for your origin ASN.
Can IPv4 move between ARIN and other registries?
Yes, between registries with compatible policies. ARIN lists both APNIC and RIPE NCC as approved for inter-RIR transfers.