Leasing out idle IPv4 safely: how tenant vetting works

Idle IPv4 can earn steady income, but every address you lease out stays registered to you, and its reputation travels with it. Careful tenant vetting is what separates a reliable income stream from blacklisted ranges and abuse complaints. This article explains how vetting works in practice, from the first identity checks to monitoring during the lease.

Why vetting matters to the owner

When you lease out a block, you remain the registered holder in the RIPE Database. If a tenant sends spam, hosts malware or launches attacks from your addresses, part of the consequences fall on you:

• The range can be listed on blacklists such as Spamhaus, which reduces its value to future tenants or buyers.
• Abuse reports and complaints may reach you, depending on how the assignment is registered.
• Cleaning up afterwards, through delisting requests and chasing withdrawn routes, takes time and sometimes money.
• A poor history can follow the block into future sales or leases, because buyers and tenants check it.

Vetting deals with these risks before a lease starts, rather than relying on the contract to repair the damage afterwards.

Who is the tenant, and what will they do with the addresses?

Identity and sanctions

Start with the organisation, not the request.

• Company verification: registration in the relevant company register, registered address and directors.
• Beneficial ownership: who ultimately owns and controls the business.
• Sanctions screening: the company, its owners and its directors against the sanctions lists that apply to you, such as EU, UK, US and UN lists.
• Contactability: working technical and abuse contacts, ideally a team rather than one individual.

A legitimate operator will expect these checks. Reluctance to provide basic company information is a warning sign in its own right.

Intended use

Ask what the addresses will be used for and how. Hosting, enterprise networks, VPN services, CDN nodes and outbound mail all carry different risk profiles.

Higher-risk uses, such as bulk email or proxy services, don’t automatically rule a tenant out, but they call for stronger evidence and tighter controls. Ask how the tenant handles complaints, what its own acceptable use policy says, and whether it can point to existing ranges with a clean history.

Be wary of requests that don’t add up: a newly formed company asking for a large block with no clear plan, or a tenant that wants to announce your space from several unrelated networks without explaining why.

Checking the network behind the tenant

The ASN that will announce your block tells you a great deal about how it will be treated.

• Routing history: which prefixes it has announced, and whether it has ever originated space it didn’t hold.
• Holders and changes: who has held the ASN and whether it changed hands recently.
• Upstreams and peers: who provides transit, and whether those networks have a sound reputation.
• Existing ranges: current and past blacklist listings on prefixes the ASN announces.

Public sources such as the RIPE Database and RIPEstat cover much of this. A structured ASN background check brings the findings together and adds sanctions screening and threat-intelligence data.

Building controls into the lease

Vetting reduces risk; it doesn’t remove it. The agreement and the registry setup should give you control if something goes wrong:

1. A specific acceptable use policy with defined abuse response times.
2. Narrow authorisation: a ROA for the tenant’s ASN only, and an LOA limited to that ASN and prefix.
3. A right to suspend, typically by changing the ROA and route object, after a set escalation process – and immediately in serious cases.
4. A return condition requiring the block to be free of listings, with the tenant responsible for delisting anything that arose during the lease.
5. Prepayment or a deposit, which also deters operators who don’t intend to stay.

Because you keep control of the registry objects, you hold the strongest lever. Removing the tenant’s route object and replacing its ROA with one that doesn’t authorise its ASN means networks that filter on IRR data or drop RPKI-invalid routes will stop accepting the announcement.

Monitoring during the lease

Approval is not the end of vetting. Keep watching the block for as long as it is leased:

• Blacklist status of every address in the range.
• Announcements: is the prefix originated only by the authorised ASN? An unexpected origin may indicate a hijack.
• Abuse report volume, and how quickly the tenant resolves each report.
• Changes in the tenant’s ownership, upstreams or stated use.

Early signs, such as a first listing or slower responses to complaints, are far easier to deal with than a range that has sat on a blacklist for weeks. Agree in advance how you will raise concerns, so a warning reads as routine contract management rather than a dispute.

How TACS can help

Our lease out your IPv4 service covers vetting, contracts, registry objects and monitoring, so you receive the income without handling the day-to-day risk yourself. You can estimate potential earnings with our income calculator, and the network checks described above are also available separately as an ASN background check.