Cloud company CEO accused of orchestrating million

A South Carolina businessman created a secondary market for IP addresses, the indictment alleges.

U.S. attorneys have charged a South Carolina man with operating a scheme that fraudulently obtained internet addresses worth roughly $14 million that later were used by spammers.

Amir Golestan was charged this week with 20 counts of wire fraud for his alleged role in a plot to create fictitious companies, then use those firms to obtain more than 750,000 IP addresses. Golestan’s data center company, Micfo LLC, obtained those addresses from the American Registry for Internet Numbers, a nonprofit that oversees the release of IP addresses only to companies that meet ARIN criteria.

By impersonating at least 10 companies, the indictment alleges, Golestan created his own secondary market for the IPv4 addresses, which the government alleges are worth $13 to $19 apiece. Then, he sold many of those IP addresses via a third party, according to the indictment.

Many of those addresses later appeared on a blocklist of known spammers maintained by the Spamhaus nonprofit.

KrebsOnSecurity was the first to tie the Micfo scheme to spam operations.

This prosecution comes after Micfo was ordered in arbitration to pay ARIN $350,000 and return any unused IP addresses. For Stephen Ryan, ARIN’s general counsel, that case and the prosecution going on now represent a realization in the government that IP addresses can be the reward for a crime, rather than only being used to carry out other criminal activities.

“In the past, when IPs were used in a crime they would be forfeited, but this is different,” he said. “Now the numbers are the fruit of the crime. That’s important because it sends a message to people out there who see all the money they can make if they hijack IP numbers.”

IPv4 addresses are so valuable because the more than 400 billion combinations handed out by ARIN and other regional internet registries are gone. The next generation, IPv6, will be implemented soon. In the meantime scammers are seizing that scarcity, hijacking dormant IPv4 addresses or buying them from shell companies — set up by other fraudsters — and buying them in bulk. This was the market shortage from which Golestan and Micfo were trying to profit, Ryan said,

Many of the websites identified in the Golestan indictment were still online at press time, including Contina, Virtuzo, Oppobox and Telentia.

All used similar fonts and advertised managed technology solutions. When CyberScoop dialed the phone numbers on each of the sites, all but one led to a voice mailbox. A representative for Contina who answered the phone told CyberScoop the company “has had issues with the line” for John Lieberman, who prosecutors say is a fabricated individual.

Amir Golestan did not return a voicemail seeking comment.

[documentcloud url=”http://www.documentcloud.org/documents/6012411-Golestan.html” responsive=true]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure