Tech CEO Sentenced to 5 Years in IP Address Scheme – Krebs on Security

Amir Golestanthe 40-year-old CEO of a Charleston, SC based technology company Micfo LLC, was sentenced to five years in prison for wire fraud. Golestan’s sentence comes nearly two years after he pleaded guilty to using an elaborate network of fake companies to obtain more than 735,000 Internet Protocol (IP) addresses from American Registry for Internet Numbers (ARIN), the nonprofit that manages IP addresses assigned to entities in the US, Canada, and parts of the Caribbean.

Amir Golestan, the former CEO of Micfo.

In 2018, ARIN sued Golestan and Micfo, alleging that they obtained hundreds of thousands of IP addresses under false pretenses. ARIN and Micfo settled that dispute through arbitration, with Micfo returning most of the addresses it had not yet sold.

ARIN’s civil case drew the attention of federal prosecutors in South Carolina, who in May 2019 filed criminal wire fraud charges against Golestan, alleging that he orchestrated a network of shell companies and fake identities to prevent ARIN from knowing that the addresses all go to the same buyer.

Prosecutors indicated that each of the shell companies involved the creation of notarized affidavits in the names of people who did not exist. As a result, the government was able to charge Golestan with 20 counts of wire fraud — one for each payment made to fake companies that bought IP addresses from ARIN.

Golestan initially intended to fight the charges. But on just the second day of his trial in November 2021, Golestan changed his mind and pleaded guilty to 20 counts of wire fraud in connection with the phantom companies he used to secure IP addresses. Prosecutors estimate the addresses are worth between $10 million and $14 million.

ARIN said the 5-year sentence handed down by the South Carolina judge “sends an important deterrent message to other parties who are considering fraudulent schemes to acquire or transfer Internet resources.” .”

“Those who seek to defraud ARIN (or other Internet Regional Registries) are subject to expensive and serious civil litigation, criminal charges, and, ultimately, a long prison term,” it reads. a statement from ARIN on Golestan’s sentencing.

By 2013, several of Micfo’s customers had landed on the radar of Spamhaus, a group that many network operators rely on to prevent the influx of junk email. Shortly after Spamhaus began blocking Micfo’s IP address ranges, Micfo shifted gears and began selling IP addresses primarily to companies that sell “virtual private networking” or “virtual private networking” services. VPN that helps customers hide their real IP addresses online.

Golestan did not respond to a request for comment. But in a 2020 interview with KrebsOnSecurity, Golestan admitted that Micfo was at one point responsible for brokering nearly 40 percent of the IP addresses used by the world’s largest VPN providers. Throughout the conversation, Golestan maintains his innocence, although he explains that the creation of fake companies was necessary to prevent entities like Spamhaus from interfering with his business going forward.

There are less than four billion so-called “Internet Protocol version 4” or IPv4 addresses available, but most of them are already allocated. The global shortage of available IP addresses has made it a commodity where each IPv4 address can be obtained for between $15-$25 on the open market.

This has led to times of growth for those involved in acquiring and selling IP address blocks, but it has also encouraged specialists to escape and spam from dormant IP address blocks. without permission from the rightful owners.

The US Department of Justice said Golestan will serve 60 months in prison, followed by a 2-year term of court-ordered supervision. The Micfo CEO was also ordered to pay nearly $77,000 in restitution to ARIN for his work assisting federal prosecutors.

Leave a comment