How to check an IP block before you buy or lease it

A block that looks fine on paper can arrive on a blocklist, with a history of hijacks, or registered to a company that no longer exists. Most of that can be checked in half an hour with public tools, before anything is signed. These are the seven checks we run on every block, and how to run them yourself. The examples use the documentation range 203.0.113.0/24; replace it with the block you are offered.

1. The registry record

Start with who the registry says holds the block, and what kind of block it is.

whois -h whois.ripe.net 203.0.113.0/24

Check four things in the answer:

• The holder. The organization in the record should be the one selling, or the one that leases it to you. A different name, a dissolved company or a name that changed in a merger is the most common reason a deal stalls (what moves the price).
• The status. ALLOCATED PA, ASSIGNED PI or LEGACY decides who may hold the block and whether its addresses may go to your customers (PA, PI or legacy).
• The abuse contact. It should be a mailbox someone reads.
• Remarks. Notes about a dispute, a sub-assignment or another lease are worth a question before you go on.

2. Blocklists, address by address

A listing usually concerns single addresses, not the whole block, so check all 256. Spamhaus's combined zone, ZEN, answers for its SBL, CSS, XBL and PBL lists in one DNS query per address:

for i in $(seq 0 255); do
  answer=$(dig +short $i.113.0.203.zen.spamhaus.org A)
  [ -n "$answer" ] && echo "203.0.113.$i $answer"
done

Run it through your own resolver. Spamhaus refuses queries that arrive through the large public resolvers and answers them with an error code in the 127.255.255.x range, which is not a listing. Its free public servers are for "low-volume, non-commercial users" and are being phased out, so the loop may stop answering; Spamhaus's IP and Domain Reputation Checker looks up one address at a time.

Some lists judge more than the address. A Spamhaus listing of a range shows up in the loop as a run of listed addresses. UCEPROTECT lists whole allocations at Level 2 and every address of a network with too many listings at Level 3, and its checker shows which level applies. The other lists that matter, and the tools that check them, are in IP blacklisting.

3. Who has announced it, and when

The routing history shows which networks have originated the block, and for how long.

curl -s "https://stat.ripe.net/data/routing-history/data.json?resource=203.0.113.0/24"

What you want to see is one origin at a time, matching the holders the seller tells you about. Short announcements from unrelated networks, especially while the block was officially unused, are the signature of a hijack. A block nobody has announced for years is not a problem in itself, but it is exactly what hijackers look for, so the record should be watertight.

4. RPKI as it stands

ROAs stay until the holder removes them. On a lease, that is your lessor, and a ROA for the previous user's ASN that nobody removed will make your announcement invalid (RPKI and ROAs). A transfer at the RIPE NCC removes the seller's ROAs, so create yours as soon as it completes.

curl -s "https://stat.ripe.net/data/rpki-validation/data.json?resource=AS64500&prefix=203.0.113.0/24"

Ask for every ROA covering the block to be removed or replaced with one for your ASN, or your provider's, before handover.

5. Where the world thinks it is

Geolocation databases decide which country a block appears to be in, and that decides which content your users see and which payment systems trust them.

curl -s "https://stat.ripe.net/data/maxmind-geo-lite/data.json?resource=203.0.113.0/24"

That is MaxMind's free data. Look the block up in the other main databases too, and check whether any of them labels it as hosting or VPN space, which can count for more than the country. A block placed in the wrong country can be corrected, but across all the databases it can take six weeks or more, so it is better known now than after the launch (IP geolocation).

6. Abuse reports

Community databases such as AbuseIPDB collect reports of attacks from individual addresses. AbuseIPDB's API checks a whole /24 in one request, over the last 30 days on a free account:

curl -G https://api.abuseipdb.com/api/v2/check-block \
  --data-urlencode "network=203.0.113.0/24" \
  -d maxAgeInDays=30 \
  -H "Key: $ABUSEIPDB_KEY" \
  -H "Accept: application/json"

A few old reports are normal for space that has been in use; a steady stream from many addresses is not.

7. Transfer history

If you are buying, ask when the seller received the block. IPv4 received through a transfer cannot be transferred again for 24 months in the RIPE NCC service region, and addresses from APNIC's 103/8 pool not for five years after they were first handed out (transfer rules compared). If you would rather your payment is held until the registry records the transfer, an escrow can hold it.

What to ask the seller or lessor

• When did you receive the block, and from whom?
• Who has used it in the last two years, and for what?
• Are there ROAs, route objects or domain objects for it now, and who will remove them?
• Is anything listed, and what was done about it?
• For a lease: what happens to the block if the lease is renewed, and what does the contract say about taking it back?

Where RTM Networks fits

We run these checks before we offer a block, and we check every IPv4 block we lease against blocklists every day for as long as you have it (lease IPv4, buy IPv4). If you are being offered a block elsewhere and want a second opinion, send us the prefix and we will tell you what we see.