IPv4 Block Due Diligence: Avoid Dirty Prefixes

By Savvas Bout, Founder of Prefixx. Last updated 23 October 2026.

Failing to conduct due diligence on IPv4 blocks can result in network operators inheriting a host of problems, including a spammy reputation, blocked prefixes and unresolvable transfer issues. As there is no central registry of clean versus ‘dirty’ secondary market IPv4 blocks, it is up to the buyer or lessee to check what they are buying. Understanding these common pitfalls before entering the secondary market helps network operators avoid inheriting problematic address blocks that require costly remediation.

A seemingly correct size and price block can hide a multitude of sins, including years of being listed on blacklists. Transfers being disputed by others and IP routing objects that are in conflict with the current holder of the IP address space. The cost and time of resolving these post-closing issues is far greater than conducting proper due diligence prior to the close of a deal. Proper validation before an IPv4 transfer closes can prevent these hidden liabilities from becoming the buyer's problem.

Read on for a full pre-acquisition checklist for IP, which includes: full ownership verification using RIR WHOIS records; full transfer eligibility notes for ARIN, RIPE NCC, APNIC, and LACNIC. Blacklists and full reputation information for major DNSBLs; RPKI and IRR routing information for full hygiene checking; and full geolocationinformation for accuracy. Each RIR maintains distinct WHOIS schemas and transfer policies across their respective service regions.

Each step is laid out with full information on the relevant tools and records.

IPv4 transfer block due diligence: a complete guide

Secondary market IPv4 blocks have histories. A block’s history determines whether a block will route well, stay off of blacklists, and transfer properly between a regional internet registry and a buyer. History matters; neglecting the proper transfer review can result in the buyer inheriting problems with a block from previous owners.

Why increasingly scarce address space demands scrutiny

The five RIRs exhausted their free IPv4 address space between 2011 and 2020.

The due diligence checklist: three pillars

Conducting a thorough review of legal ownership, routing and reputation to cover all the key bases of a deal. Getting one of these wrong could derail compliant transactions at transfer or worse, leave you owning a tainted block of property post close. In contrast, a clean block of property can attract the interest of enterprise buyers and command better prices. Proper valuation ensures that the purchase price reflects the fair market value of a clean, transferable block rather than overpaying for a compromised asset.

What this guide covers for your IP address and address space

Below we explore each key pillar of validity in sequence.

Routing hygiene: route objects, reverse DNS, and IRR data

Investigate routing as thoroughly as you investigate ownership before any IPv4 transfer closes.

Route objects, IRR consistency, and larger blocks

For every routable address allocation of IP addresses there should be corresponding route objects in one or more Internet Routing Registries like RADB, ARIN IRR or the RIPE NCC database. By querying these databases before you buy IP addresses in question you can check the origin ASN, the length of the IP prefix as well as the maintainer for announced route objects.

After the IP address transfer you have to update these objects to contain your ASN. Routing carriers, which apply to filter announced routes based on IRR data, will not announce your IP addresses to their customers till then.

RPKI ROA validation and market trends

First, verify whether a valid Route Origin Authorization (ROA) exists for the respective IP subnet of IP addresses. The RIR status field in the RPKI repository will indicate whether the ROA is valid, invalid, or not found for the prefix in question.

After the IP addresses have been transferred to the buyer, the seller’s ROA needs to get revoked from the respective RPKI repository. The buyer then needs to issue and publish a corresponding new ROA in his RPKI repository. This step is one of the fastest ways to lose reachability in the current market if it is not performed correctly.

Reverse DNS and fair market lookup practices

PTR records are used by other networks to look up IP addresses against hostnames for purposes of mail delivery, for tracking down abuse, and for reputation scoring. For IP space of /24 and larger, reverse DNS delegation allows you to manage the in-addr.arpa zone for that space by creating a reverse DNS delegation to the nameservers for your space. Proper reverse DNS configuration ensures that queries for those addresses return meaningful hostnames rather than generic or missing PTR entries.

Verify that the current IPv4 addresses space is not delegated to somewhere too dumb for your taste, then use that space as part of your transfer paperwork to have it redelegated to your nameservers. Proper delegation ensures that reverse DNS queries for those addresses resolve correctly under your authority.

We prepare the LOA, RPKI ROA and IRR route objects for you as part of our white-glove service for all our leases. Similarly, we handle the required paperwork for you for all the blocks you purchase through our platform. We also check the abuse contact history for the network allocation in question.

Abuse contact records and abuse history review

An accurate abuse contact in WHOIS is typically one of the first things ISPs and cloud providers check up on when looking to add new blocks of IP addresses to send traffic from. If the abuse contact listed in a WHOIS record for a given IP address no longer checks email at the listed address, the associated IP addresses are often marked as unmanaged by upstreams and therefore refused peering or transit.

Auditing the abuse-c record within reputation systems

Fetch the WHOIS or RDAP for the registry of the address segment. Verify that the abuse POC email resolves, that the role object is up-to-date, and that the listed organization matches the seller identity. A mismatched or stale WHOIS/ RDAP record for an IPv4 block is one of the most obvious red flags for due diligence.

Reading abuse history signals step by step

Check for listings on AbuseIPDB and the major DNSBLs for each of the address ranges in question. Note that listings which are spam (i.e. DNSBL-visible) from previous tenants are typically an easily fixable matter. Checking against major blacklists helps ensure the space is not flagged for prior abuse that could impair deliverability or peering acceptance.

• Multiple hits on different IP addresses from DNSBLs suggest widespread misuse, not isolated incidents.
• Routing history gaps combined with recent abuse reports typically indicate that a IP segment was idle and briefly put to abusive use.
• Squatters are likely to target high demand blocks during transfer delays. Check for reports around the time of the transfer.

How Prefixx handles common pitfalls

As part of our Tixx quality-control process, every network segment is scanned against 12 DNSBLs before it is sold to a buyer. Unresolved listings are flagged, as well as any routing hygiene issues, and buyers receive a transfer-readiness report. Continuous monitoring of these reputation signals ensures that any emerging issues are caught before they affect deliverability or peering relationships.

Frequently asked questions about smaller blocks

What due diligence and market demand checks apply to active entries in any IPv4 block?

proper vetting on an IPv4 network pool covers four core areas: ownership verification, transfer eligibility under the relevant RIR, routing hygiene, and reputation health. Ownership checks confirm the selling organization holds the registration in good standing and has no outstanding disputes or liens.

Routing hygiene covers whether the address chunk has a clean BGP history, valid RPKI state, and consistent IRR records. Reputation checks scan the IP chunk against DNSBL lists to surface any spam, abuse, or malware history before money changes hands. Buyers should treat each IP block as a digital asset whose operational value depends entirely on its technical and reputational standing at the moment of acquisition.

How do I check if an IPv4 block is blacklisted before buying?

Query the network chunk against the major DNSBL providers, including Spamhaus ZEN, Barracuda, SpamCop, SORBS, and CBL. Tixx, Prefixx's pre-sale quality control process, runs exactly this kind of multi-list scan on every IP batch before it reaches a buyer. Continuous monitoring of these lists after purchase helps detect any new listings that may arise from residual traffic patterns or third-party reports.

What is the minimum same block size for an ARIN 8.3 transfer?

ARIN's 8.3 policy governs transfers between ARIN-registered organizations and requires a minimum network batch size of a /24 (256 addresses). The recipient must demonstrate a justified need for the IPv4 addresses under ARIN's needs-assessment criteria, and the transfer must be approved by ARIN before it is recorded in WHOIS. Both parties must also ensure that the transfer agreement satisfies any legal documentation requirements specified by ARIN for the transaction to be recognized.

Why does the region of an IPv4 addresses block affect its price?

Each RIR operates an independent transfer market with its own supply, demand, and policy constraints. ARIN space, for example, trades at different rates than RIPE NCC space of identical size, because demand from North American buyers, transfer policy requirements, and available inventory differ from those in the RIPE region. Buyers often evaluate inventory across multiple regions to identify the most favorable pricing and policy environment for their specific use case.

An address group's registry also determines where it can be used without an inter-RIR transfer, which adds cost and complexity depending on market conditions. Because no official price index exists, rates in each region are set by private negotiation, and the spread between one registry and other regions can be significant in the same month. The registry of origin also influences the documentation and approval timeline required to complete a valid transfer.

What is an IRR route object and why does it matter in a transfer?

An IRR (Internet Routing Registry) route object is a record that maps a prefix to an originating ASN, published in a routing registry such as RIPE's IRRDB or ARIN's IRR. Upstream providers use these records to build route filters, so a missing or stale route object can cause a newly transferred IP group to be filtered and unreachable.

During a transfer, the old route object must be removed and a new one created under the buyer's ASN before the network group is announced. Failing to update IRR records is one of the most common causes of routing failures after an IPv4 acquisition. Buyers should coordinate with their upstream providers to confirm that route object updates are complete before announcing the newly acquired prefix following the sale.

What happens if a block has active dnsbl listings at the time of purchase?

Active listings follow the IP addresses, not the previous owner, so a buyer inherits any blacklist reputation present at the time of transfer. Delisting after an IPv4 transfer requires submitting removal requests to each list operator, and some lists impose waiting periods or require evidence of remediation before confirming recipient eligibility for removal. Buyers should request current blacklist reports from the seller before finalizing the sale to assess the scope of any inherited reputation issues.

There is no guarantee of delisting on any specific timeline, and some lists are notoriously slow to respond. The safest approach is to resolve all active listings before the transfer closes, which is why a pre-sale reputation scan is a non-negotiable step in proper careful vetting. Buyers should evaluate each listing's removal history and response patterns before committing to a purchase.

How escrow protects buyers and sellers and helps attract institutional buyers

Escrow holds the buyer's funds with a neutral third party until the RIR transfer of the IPv4 addresses is confirmed and the address set is registered in the buyer's name. The seller cannot access the funds until the transfer completes after legal review, and the buyer cannot lose their money to a seller who fails to deliver. Once the registry confirms the transfer is complete, the escrow agent releases payment to the seller, finalizing the transaction.

This structure eliminates the risk of paying for a IP set that never transfers, or of transferring a network set without receiving payment. Prefixx secures every transaction through escrow as a baseline condition of every deal, for both buyers and sellers. The escrow provider coordinates with the transfer team at each RIR to verify that all policy requirements have been satisfied before releasing payment.

When buying an IPv4 range, there are three things to verify: (1) confirmed ownership and the clean transferability status, (2) a good reputation not to get blacklisted with your mail or get your traffic blocked, and (3) accurate routing information.

Typically, people buying IP space just look at blacklist status and abuse history. Hijack notices or even have stale IRR objects that can step by step break all routing for that space the moment it's announced.

Tixx by Prefixx runs all of these checks prior to space being sent to buyers.

If you have a specific allocation in mind or want a vetted shortlist, reach out to the Prefixx team before you commit.