What Does IPv4 Transfer Due Diligence Actually Require in 2026?

The Direct Answer to IPv4 Transfer Due Diligence

IPv4 transfer due diligence is the evidence-gathering process used to determine whether a seller can legally and technically transfer a defined block of IPv4 addresses, whether the block is free of undisclosed claims, and whether the buyer can operate it without losing routing, reputation, or customer relationships. It is not merely a WHOIS lookup, a screenshot of a registry dashboard, or a confirmation that a broker says the addresses are available. A defensible review connects registry records, title documents, routing data, commercial contracts, litigation searches, sanctions screening, and technical inventory into one auditable record. The central question is not simply whether the addresses exist, but whether the seller has the right to transfer them and whether the buyer will actually receive usable control after closing. For a transaction reviewed on 25 September 2026, that distinction matters because registry administration, legal ownership, and technical reachability can point to different entities or fail to align.

Also worth reading: What does the ip registry implementation roadmap 2026 actually require for enterprise counsel and product teams? · How Do IPv4 Transfer Policies Affect the Sale, Purchase, and Redeployment of Address Space? · What Should IP and Registry Teams Verify Before an IPv4 Transfer in 2027?

A complete file should answer four questions. First, which legal entity owns or controls the address space, and what chain of assignments supports that claim? Second, does the resource holder have authority to approve the transfer, and are there liens, insolvency claims, contractual restrictions, or pending disputes? Third, is the advertised inventory real, correctly documented, and connected to the expected origin network? Fourth, what must happen at closing so that RPKI, routing, DNS, monitoring, abuse response, and customer notices continue to function? A registry SaaS workspace can organize documents, approvals, version history, and deadline tracking for counsel and product teams, but software cannot substitute for independent registry confirmation, legal review, or technical validation.

Legal Title and Registry Chain of Ownership

Start with the legal chain of title, not the technical prefix. Identify the registered resource holder, the organization that originally received the allocation, every intermediate assignment, and the entity that currently claims commercial control. Registry records may show a regional internet registry organization, a regional internet registry, a national or local internet registry, or a transfer recipient, while the economic owner may be a holding company, subsidiary, lender, or infrastructure operator. Obtain incorporation records, board or member resolutions, powers of attorney, assignment agreements, invoices, and bank evidence where relevant. The legal characterization of an address block varies by jurisdiction, so counsel should confirm whether the transaction is an asset sale, share sale, license, security interest, or some other arrangement rather than assuming that a transfer form settles ownership.

A mismatch between the seller name on an invoice and the name in registry records is a diligence item, not an automatic failure. It may reflect a valid affiliate transfer, a renamed company, an intermediated broker transaction, or a claim that has never been properly documented. Search corporate registries, insolvency records, trademark databases, court dockets, and, in the United States, UCC filings involving the seller and its subsidiaries. A UCC search is useful but not conclusive because the filing rules and the treatment of internet address assets differ by jurisdiction. Reconcile the exact inventory mathematically: a /24 contains 256 addresses, a /16 contains 65,536 addresses, and even a 1% discrepancy means 3 addresses in a /24 but 656 addresses in a /16. Require written explanations for every discrepancy before relying on the block’s value.

RPKI, Routing, and Technical Verification

Technical due diligence asks whether the addresses are reachable in the way the seller represents. Review the Resource Public Key Infrastructure, or RPKI, state for every prefix, including whether a valid Route Origin Authorization exists, whether the ROA is stale, too narrow, or too broad, and whether the claimed origin ASN matches current routing. A valid ROA is evidence of authorization for a route announcement, not proof that the holder owns every address in the prefix or that the route is secure in practice. Compare registry data, RIR WHOIS, IRR records, reverse DNS, geof feeds, BGP collectors, and the seller’s routing configuration. Independent routing observations from several viewpoints are more useful than a single live lookup, especially when the seller is changing providers or has recently announced a new origin.

Set measurable review thresholds rather than accepting statements such as the network is stable or fully used. A practical target is documented confirmation for 100% of the transferred prefixes, at least 30 days of routing history, and observation from three or more independent BGP collectors when the block is material. Check announcement consistency, origin changes, packet loss, latency, reachability to major network operators, and whether the block is used for any function other than the stated service. Verify reverse DNS, forward-confirmed reverse DNS where applicable, mail-server status, and any delegated reverse zones. A block that has been idle for months may still have value, but an unexplained gap in routing can indicate abandoned infrastructure, an undisclosed lease, or an address transfer that was never completed. Record the date, source, and result of each test so the buyer can reproduce the review later.

Usage, Contracts, Abuse, and Legal Exposure

Map what the addresses actually do before valuing them as a simple inventory. Identify hosted applications, DNS zones, virtual machines, customer allocations, SSL certificates, email systems, VPN or hosting customers, internal routing, and any addresses promised to third parties under contract. Ask whether customers have contractual notice periods, portability rights, or service-level commitments that could be affected by a change of control. A block marketed as a transferable asset may include leases, reseller agreements, sponsored address space, or delegated suballocations that cannot be assigned without consent. Obtain a schedule showing which addresses are used, which are reserved, which are routed, and which are available for the buyer after closing. The schedule should be signed by an authorized representative rather than produced only as a spreadsheet with an unexplained total.

Search for disputes and adverse history using the legal entity names, former names, subsidiaries, domains, email domains, and technical contacts associated with the block. Review court records, arbitration filings, insolvency proceedings, regulatory actions, sanctions lists, law-enforcement notices, and credible security reporting. Recorded Future’s reporting on aurologic GmbH illustrates why infrastructure history matters: a network can appear stable while still carrying operational, reputational, or abuse concerns that affect a buyer’s customers and vendors. Investigate any open matter, not only final judgments, and distinguish a resolved historical issue from an ongoing restriction. Counsel may recommend a purchase-price adjustment, escrow, indemnity, seller representation, or closing condition when a claim exceeds a defined materiality threshold, such as 5% of the purchase price or an amount that could disrupt a material service. Screening should be refreshed immediately before signing and again before closing because ownership, contacts, and sanctions status can change.

A Practical Due Diligence Sequence

A disciplined review can begin within 48 hours after receiving the seller’s data room link. During the first two business days, verify the seller’s identity, request the complete prefix inventory, identify the registered holder, and establish the intended transaction perimeter. From days three through ten, obtain registry extracts, RPKI data, routing histories, reverse-DNS records, major assignment agreements, and a technical description of the current origin. Counsel can run corporate, court, insolvency, sanctions, and UCC searches in parallel, while engineers validate live reachability and compare the seller’s inventory with observed traffic. The buyer should preserve original files, query results, and screenshots because later service changes may otherwise make the evidence difficult to reconstruct.

From approximately day ten through day twenty, convert findings into a contract and closing plan. The purchase agreement should define the exact prefixes and address counts, the transfer mechanism, permitted use of seller assistance, treatment of leases, responsibilities for abuse complaints, and the effect of a failed registry transfer. Conditions should include satisfactory title evidence, no material adverse change, completed third-party consents, a funded escrow or other payment protection, and delivery of a clean technical handoff package. A small, uncomplicated transfer may close in two to six weeks, while a complex multi-jurisdiction transaction can take two to six months or longer. The schedule should state who owns each delay, rather than treating registry processing time as the only reason a closing slips. For counsel and product teams, a shared workflow should record every request, response, exception, approval, and unresolved risk with an owner and deadline.

Comparing Ownership, Brokerage, Leasing, and IPv6

Each structure solves a different problem. A direct transfer is usually the clearest route when the seller has clean title, the buyer needs long-term control, and both sides can manage registry and routing changes. Brokerage can improve access and administrative convenience, but the broker’s reputation does not eliminate the need to verify title, sanctions status, routing, and contract terms. A lease may be rational for a short project or uncertain expansion plan, but it can become expensive if the provider changes pricing or if the buyer later discovers that its applications require addresses it cannot port. IPv6 should not be treated as an automatic substitute for every IPv4 requirement, especially where legacy systems, partner networks, or customer contracts still depend on IPv4 behavior. A dual-stack plan is often more realistic than an abrupt replacement.

Cost, Pricing, and Deal Structure

IPv4 pricing varies by prefix size, location, routing history, usage, lease restrictions, seller motivation, and the number of competing buyers. Market explainers from PC Tech Magazine and CircleID have described ordinary address blocks as an increasingly scarce asset, with prices that can range from the low hundreds of thousands to more than one million dollars for some /24 transactions; larger blocks can reach several million dollars or more. Those figures are historical market context, not a quote for 25 September 2026. A /24 has 256 addresses, but price per address is not a useful valuation method because routability, history, and customer utility matter more than raw count. Obtain at least three comparable offers, ask whether the quoted block is clean, used, routed, leased, or financeable, and confirm whether the price includes escrow, brokerage, taxes, registry fees, and technical migration.

The total acquisition budget should include more than the headline purchase price. Common items are legal review, technical validation, escrow or payment services, brokerage, registry and transfer charges, tax advice, insurance, DNS changes, routing engineering, and customer communications. Parties often negotiate an earnest deposit in the range of 5% to 10% of the purchase price, but the amount and release conditions are contractual rather than standard across every market. A meaningful escrow or holdback can protect the buyer if title defects emerge, but it does not guarantee collectability if the seller lacks assets. Compare an asset purchase with a share purchase only after reviewing tax, liability, inherited contracts, and change-of-control consequences. Price should reflect the residual cost of operating the block for at least 24 months, not merely the value of the addresses on the closing date.

When to Act and What to Do After Closing

Do not buy IPv4 space only because headlines describe scarcity. A purchase is easier to justify when traffic forecasts show sustained address demand, an existing allocation is too small or fragmented, a network operator has a credible capacity problem, or a customer contract requires portable address resources. A lease or brokered commitment may be better while engineers test future requirements, especially if the organization can operate with IPv6 and does not need durable ownership. Time-sensitive RIR allocation or transfer deadlines, provider renewal dates, and planned data-center moves can justify a decision, but fear of rising prices is a weak substitute for a documented requirement. Set a budget ceiling, define the minimum routability and title conditions, and identify who can approve a last-minute increase. In some cases, waiting reduces cost; in others, a narrowly specified block may be unavailable when the business is ready.

At closing, obtain written confirmation of registry status, payment release, updated routing authorization, and the seller’s final inventory. Within 30 days, verify RPKI, BGP origin, DNS, reverse DNS, customer allocations, and abuse-reporting contacts from an independent network perspective. Within 60 to 90 days, reconcile actual usage against the purchase model, remove stale documentation, transfer or terminate leases, and document any unresolved claim. Preserve the diligence file, registry correspondence, technical tests, and seller warranties for the limitation period applicable to the transaction. A well-run iprs.cloud-style workspace can make that evidence visible to legal and product stakeholders, but the strongest protection remains a clear contract, independent verification, and a post-closing plan that treats IPv4 as an operational asset rather than a passive line item.