What to do if you've been a victim of IP address fraud

An incident is happening. Start here.

Record the affected prefixes, ASN, timing and service symptoms. Have the network and security leads distinguish a compromised device, an unauthorized route announcement, altered registration and a fraudulent lease or transfer. An anomaly alone is not proof of fraud.

Preserve logs, routing observations, account changes and transaction records without delaying necessary containment. Isolate affected systems according to the incident and maintain service continuity. Rebooting everything, stopping every service or changing addresses is not a universal remedy.

Coordinate routing with the relevant operators and upstreams, registration with the responsible RIR, and suspected crime with the applicable reporting channel. You cannot directly withdraw another network’s announcement. Correct the cause before seeking a blocklist review.

When your address space is at risk

Ann Yong published this article on 18 November 2025 and updated it on 5 March 2026.

When mail stops arriving, customers lose their connection or a block is used by someone else, the cost quickly turns into lost revenue and lost trust. The response has to combine technical analysis, a check of rights and evidence; changing an address is not enough.

• • Take immediate action by isolating affected systems. Report incidents to authorities quickly. These steps limit damage from IP hijacking or abuse.
  • Use available tools and organizations. NRS offers reputation cleaning services. Prevention measures restore network integrity effectively.

Understanding IP address fraud and its impacts

IP spoofing forges the origin of packets. BGP hijacking means unauthorized route announcements that can divert traffic. Blocks used without permission can also carry spam and phishing. The problems are related, but not the same.

IPv4 scarcity encourages deceptive leases, sellers who do not hold the rights they offer, and resale of blocks with a troubled history. Check the counterparty’s identity, the registration and the chain of authority, not only the price.

For cloud providers, retailers and operators, the effects can include outages, data exposure and lost customers. Blocklisting can stop email from being delivered.

Trust erodes and revenue losses accumulate, above all for e-commerce companies and cloud service providers.

Leasing is especially exposed: fraudsters exploit weak verification, and in the Micfo case shell companies obtained address rights on falsified applications. An organization that leases tainted space unknowingly can still face the consequences.

Recognizing signs of IP address fraud

Unexpected routes, an unknown ASN, new blocklist entries and a rise in complaints are reasons to check what happened. Latency, dropped packets or an unexpected geographic location are signs; on their own they do not prove a hijack.

Abuse reports may spike, with recipients flagging phishing that appears to come from your domains. A message that seems to come from your address does not prove your system sent it; scans and open-port checks are often the first step of an attack.

Cross-check what BGPStream or RIPE NCC tools show with traceroutes, service logs and account activity. Compare prefixes, origin and timing with a known baseline: unauthorized prefixes, unusual latency, dropped packets and traffic through unexpected regions can point to a hijack.

Prior scans, the Micfo case and irregularities that surface only on resale teach the same lesson: review your inventory and its changes regularly, without waiting for a customer or buyer to find the anomaly.

Immediate actions: Securing your network

Bring the network, security and business leads together. Isolate compromised systems according to the diagnosis and keep the evidence you need. Updates, firewalls and traffic analysis with tools such as Wireshark belong in one coordinated response.

Getting a new dynamic IP on a home connection does not recover a hijacked enterprise block. You can change only the configurations and announcements under your own authority. Document anomalous external announcements and coordinate their correction with the responsible operator and its upstream.

Keep firmware updated and firewalls enabled, so the gaps spoofing exploits are closed. In a hijack, withdraw any wrong announcements from your own sessions and ask the operators concerned to correct theirs.

Conduct comprehensive network scans. Tools like Wireshark help significantly. Anomalous traffic patterns become identifiable.

Suspending an API, mail or other services means weighing exposure against continuity; do not shut the whole operation down by default. Use the contingency plan where it applies, trace the hijacking ASN through WHOIS, contact the upstream provider, and then check that users can work again.

Reporting IP address fraud: Who to contact

Fake requests, unauthorized changes to registration data and transfer fraud go to the RIR that manages the resources. ARIN’s procedure is not a general mailbox for spam, phishing or intrusions.

Routing problems are fixed with the operators; suspected crime follows the competent reporting channels. In the United States, the FBI’s Internet Crime Complaint Center (IC3) takes cybercrime reports: include timestamps, the affected addresses and evidence such as system logs. In England, Wales and Northern Ireland, Report Fraud has replaced Action Fraud; in Scotland, report to Police Scotland. The National Cyber Security Centre’s guidance does not replace a crime report.

Registration problems go to the Regional Internet Registry: ARIN covers North America and has procedures for tampered registrations, and RIPE NCC publishes abuse contacts.

In the United States, federal hacking and fraud cases are prosecuted by the Department of Justice’s Computer Crime and Intellectual Property Section.

Prepare a timeline with prefixes, ASN, logs, blocklist screenshots, traceroutes, account changes, contracts, payments and communications. Keep the originals and record who obtained and passed them on. Technical recovery, registry correction and criminal investigation are separate processes.

Cleaning your IP reputation post-fraud

Find out who is blocking you and why. Fix the abusive traffic, compromised accounts or configuration that caused the problem, and document what you did. Then ask for a review through each list’s own channel, such as Spamhaus’s.

Check your mail configuration, including SPF and DKIM, and watch bounces and complaints. Talos and other services give different views, not a universal score. For leased addresses, check the history and the provider’s obligations as well.

Moving to another block can leave an infection in place or move the problem. Recovery time depends on the cause and on each service involved.

Leveraging NRS for IP fraud recovery and prevention

What NRS offers its members today is set out on NRS Shield.

An up-to-date inventory, documents of rights and dated evidence let you explain what happened and what you are asking for. NRS’s guides and NRS Shield are a starting point for understanding the risks and the support available.

Fair leasing, traceable records, notices to other networks, audits and RPKI do different jobs. Origin validation depends on ROAs and on the policies operators apply; it does not block every attack automatically.

NRS’s guide to detecting and preventing hijacks sets out the procedures: notify peers properly, and audit so recovery goes faster.

NRS is a non-profit that speaks only for its members’ interests and encourages the community to stay vigilant. Equitable governance is its constant focus; when fraud strikes, NRS’s tools and member support help reduce re-victimization and trace the resources.

Long-term prevention strategies against IP fraud

After an incident, strengthen your defences. Review ROAs, route filters and peering agreements with the technical team, and keep watching announcements afterwards; RPKI adds cryptographic validation, and selective peering with trusted ISPs helps.

Keep your inventory, RIR contacts and the domains used in contact accounts up to date. Protect administrative access and train staff to recognize impersonation, phishing and forged authorizations.

Review providers and contracts, prepare alternatives and repeat audits. Diversifying resources can reduce some dependencies but adds complexity. A distributed ledger can improve traceability without turning false data or non-existent mandates into valid rights.

Three principles for facing fraud

Verify, monitor and respond quickly: these are the three foundations for facing address fraud.

A valuable resource attracts fraud, and recovering it can take technical, contractual and legal coordination. Documenting and seeking competent help is worth more than any promise of a quick fix.

Every system can be vulnerable, which is why reporting and prevention come first.

Learning from cases without expecting the same outcome

The US Department of Justice’s 2021 account of Micfo describes fictitious companies, the acquisition and sale of rights to addresses, and guilty pleas. It is a reason to check documents and counterparties, not to presume that every dispute is a crime or will end the same way.

In the Micfo case, shell companies obtained address rights on false pretences and sold them on; ARIN revoked the resources.

To weigh the risk, rely on publicly documented cases such as Micfo.

In a real incident what matters is when it began, who can correct it, which rights can be shown and how service is kept running. Support does not replace an investigation or the decisions of the competent bodies.

The role of technology in IP fraud mitigation

RPKI for route origins, DNSSEC for authenticating DNS data and transaction records solve different problems. None of them alone establishes that a transfer is lawful.

Automation can detect changes in routes, location or behaviour, but it needs human interpretation. Geolocation does not prove ownership, and a score does not prove fraud.

DNSSEC helps protect DNS data from tampering, and NRS’s ownership campaigns draw on these tools.

Frequently asked questions

1. What is IP address fraud?

It can include pretending to hold rights in order to sell or lease resources, changing registrations without permission, or deception tied to route hijacking. Tell spoofing, registration and BGP apart before deciding what to do.

2. How do I know if my IP has been compromised?

Compare announcements, traffic, bounces and blocklists with your normal state and with account records. Observation tools give clues; rule out configuration or provider faults too.

3. Who should I report IP fraud to?

The operator for routes, the RIR for registrations, and the competent authority if there are signs of crime. IC3 and the UK services each have their own scope; a single report does not settle every front.

In England, Wales and Northern Ireland the crime-reporting service is now Report Fraud; in Scotland, it is Police Scotland.

4. Can I recover a hijacked IP block?

It can be possible, but restoring routes, accounts, registration rights and reputation are separate tasks. The outcome depends on evidence, authority and procedure; there is no universal timeline, and restarting the router is not the answer.

The usual path starts with notifying your upstream provider, continues with the operators withdrawing the wrong announcements, and ends with the RIR correcting the registration where needed.

5. How does NRS help with IP fraud prevention?

Through risk knowledge, advocacy for holders’ rights and access to support. When you want NRS to vote or decide for your network, a Power of Attorney gives it that mandate.

Sources

NRS note. Use each reporting or blocklist service’s current instructions, keep your evidence securely, and distinguish service recovery from a registry or legal outcome.

RPKI origin validation depends on authorizations and network policy; DNSSEC is a different protection. A ledger cannot make a false identity or authority true.

The first two links are NRS’s own guides; the institutional and technical sources after them explain each channel and protection.

NRS: about RIPE · NRS: ARIN and transfers · ARIN: resource fraud · IC3: evidence and complaints · Report Fraud: UK service change · RIPE NCC: origin validation · Spamhaus: hijacking response · DOJ: Micfo, 2021 · RFC 4033: DNSSEC · Spamhaus: listing review

Bring operational experience into the rules.

An incident can expose a wider problem with resource rights and governance. NRS Shield is where operators turn individual risk into collective strength, and a Power of Attorney is how you give NRS the authority to act for your network.