Justine, I'd be more curious about user jackson. If you have time series data for when blocks were claimed by a particular user, it would be useful to share a link to them. I'd like to correlate when address claims were made from some of the more unusual blocks with BGP advertisement data to see if there were brief periods of BGP advertisements of less specific covering routes. As a side note, if you've signed up on various platforms as a non-profit entity, you get some amount of free advertising dollars to spend, up to about $10,000/month in free advertising, so you could get pretty far without having to spend your own money in an effort like this. But that's only going to get you reach from IP space that has general-purpose eyeballs on it. The netblocks that don't generally contain eyeballs networks are the more interesting ones, because those you can't simply spend free advertising dollars to get coverage on. Those would be the ones where I'd start to suspect someone might be briefly originating a less specific route, doing a flurry of GET requests, then dropping the less specific route, to gain coverage hits from more unusual blocks of addresses. Thanks! Matt On Fri, Aug 15, 2025 at 11:14 PM Justine Tunney via NANOG < nanog@lists.nanog.org> wrote:
I operate an online service at https://ipv4.games/ that invites people to send http requests to my web server from a lot of different IP addresses. In order to claim an IP, you need to successfully make a tcp three-way handshake with a VM on Google's network.
Somehow a player in Europe named femboy.cat has successfully managed to claim 20 million IPs, which is 9% of all IPv4 hosts according to Censys.
Does anyone have any idea how they're doing it?
Would anyone here be willing to be their North American rival? _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/MMCCEQKA...