A first look at the misuse and abuse of the IPv4 Transfer Market

Giotsas, Vasileios and Livadariu, Ioana and Gigis, Petros (2020) A first look at the misuse and abuse of the IPv4 Transfer Market. In: Passive and Active Measurement Conference (PAM) 2020 :. Springer, USA, pp. 88-103. ISBN 9783030440800

Text (VGiotsas_PAM2020_IPv4_Transfers_abuse)
VGiotsas_PAM2020_IPv4_Transfers_abuse.pdf - Accepted Version
Available under License Creative Commons Attribution-NonCommercial.
Download (451kB)

Abstract

The depletion of the unallocated address space in combination with the slow pace of IPv6 deployment have given rise to the IPv4 transfer market, namely the trading of allocated IPv4 prefixes between ASes. While RIRs have established detailed policies in an effort to regulate the IPv4 transfer market for malicious networks such as spammers and bulletproof ASes, IPv4 transfers pose an opportunity to bypass reputational penalties of abusive behaviour since they can obtain "clean" address space or offload blacklisted address space. Additionally, IP transfers create a window of uncertainty about legitimate ownership of prefixes, which adversaries to hijack parts of the transferred address space. In this paper, we provide the first detailed study of how transferred IPv4 prefixes are misused in the wild by synthesizing an array of longitudinal IP blacklists and lists of prefix hijacking incidents. Our findings yield evidence that the transferred network blocks are used by malicious networks to address botnets and fraudulent sites in much higher rates compared to non-transferred addresses, while the timing of the attacks indicates efforts to evade filtering mechanisms.