IPv4 Block Due Diligence Checklist: Check Before Buying
Quick answer: to check an IPv4 block before buying, a blacklist scan is only one line on the list. Confirm who has the authority to sell, what the registry says about the resource and its transfer eligibility, how the range was registered and routed over time, and how it looks today on RPKI, reputation, abuse and geolocation data. Then repeat the key checks just before closing. Findings change the price, so read them next to the dated ranges on IPv4 pricing and in our IPv4 block pricing guide.
Why a WHOIS record alone is not enough
A registry record shows who is listed as the holder today. It does not show whether the person selling can act for that holder, whether the block is eligible to move, or what happened to the addresses in the years before. Reputation, routing and geolocation data live outside the registry, keyed to addresses rather than owners. They follow the block to you.
Verify the seller and the registry status
- Seller authority - ask for proof that the seller is the holder or an authorized representative: company documents, a signed mandate, and a contact path in the registry that matches the paperwork.
- RIR status - confirm the resource type, the registry it sits in and whether it can be transferred. Rules differ between RIPE NCC, ARIN and APNIC and depend on the status of the resource, so do not carry one registry's rules over to another.
- Registration history - read the registry history of the prefix: earlier holders, past transfers and changes of organization. A chain that cannot be explained by documents is a reason to stop.
The registry-side steps after agreement are in our RIPE NCC transfer guide.
Routing, RPKI and reputation
| Check | Where to look | Red flag |
|---|---|---|
| Routing history | Public BGP history for the prefix | Announced by an unrelated AS, or long gaps and sudden origin changes |
| RPKI / ROA | An RPKI validator and the registry portal | Existing ROAs for an AS you do not recognize, or invalid state |
| Blacklists | Major DNS blacklists and DROP-style lists | Active entries with current reasons, or any hijack history |
| Abuse history | Spam, malware and phishing reports for the range | Repeated dated reports with no sign of remediation |
| Geolocation | Several geolocation providers, current and past | Providers disagree, or the block still points at a previous country |
Read results by weight, not by hit count. A policy-list entry that calls a range dynamic is not the same as an active abuse record, and aggregators often repeat one underlying finding. Check how much of the range is affected.
Geolocation, reverse DNS and route objects
Providers update geolocation at different speeds, so a correction at one does not mean the others agree. Check where the block is placed today and where it was placed before. Then look at reverse DNS delegation and the route objects in the routing registry: they should be consistent with the holder, or easy to change at closing. Stale objects naming a previous owner cause friction after transfer. If a database still shows the previous country, see how to fix IPv4 geolocation after a transfer.
Agreement, recheck and monitoring
- Agreement and escrow - the contract should state what the seller warrants about authority and reputation, and what happens if the transfer is refused. Escrow conditions should follow the same logic.
- Recheck before closing - repeat routing, RPKI, blacklist and abuse checks right before funds are released. Blocks can be listed during a deal.
- Monitor after transfer - watch reputation, geolocation and routing for the first weeks of your own use. Reputation can change once you start using the addresses.
For channel choice, see broker vs marketplace vs direct sale, and for the whole transaction the IPv4 buy and sell guide.
What no check can prove
No blacklist check proves a block is absolutely clean. The absence of current entries does not rule out past incidents. Geolocation data changes at different speeds at different providers. Reputation can change after you start using the block. Treat each result as a dated snapshot, and keep the reports.
Printable checklist
Print this list or copy it into your deal notes. No registration is needed.
- Seller identity and authority documented
- Exact CIDR of every prefix in the deal
- RIR, resource type and transfer eligibility confirmed with the registry
- Registration history read and explained
- BGP and routing history reviewed
- RPKI / ROA state checked
- Blacklist scan of the whole range, dated
- Spam, malware, phishing and abuse history reviewed
- Current and past geolocation checked
- Reverse DNS and route objects consistent
- Agreement and escrow terms cover authority and reputation
- Key checks repeated right before closing
- Monitoring planned for after the transfer
Need a professional check?
You can scan a network against major DNS blacklists on our IPv4 page: EUR 3 for a /24 or smaller, with a PDF report. For the full list above, run by people who handle transfers every week, email ipv4@dcxv.com to request IPv4 block due diligence, or start at https://dcxv.com/ipv4. If you are still looking for a block, see buying IPv4 with DCXV.
