IP Address Fraud Case Shows Ease Of Hiding Identity On The Web

The lawsuit against Amir Golestan and his web-services provider firm Micfo is shedding light on the ecosystem that governs the world of online spammers and hackers, a Wall Street Journal article said on Monday (Feb. 17).

In this first-of-its-kind fraud prosecution of a small technology company, Golestan is facing 20 counts of wire fraud in a suit brought in the U.S. District Court in South Carolina. Golestan and his corporation have pleaded not guilty.

The alleged victim is the nonprofit American Registry for Internet Numbers, based in Centreville, Virginia. The company is in charge of assigning internet protocol (IP) addresses to all online devices in North America and the Caribbean, which in turn allows devices to communicate with one another online. The case revolves around IP addresses.

This is the first federal case that brings fraud allegations to internet resources. It could end up defining “new boundaries for criminal behavior” with the confines of the largely undefined internet infrastructure.

People are largely assigned an IP address automatically when it comes to getting online with a cellphone or internet service provider. IP addresses, however, are the online equivalent of home phone numbers and are “key identifiers” for authorities going after online criminals.

In the May Micfo suit, the Justice Department alleges that Golestan established shell companies to fool the registry into giving him 800,000 IP addresses. He then leased or sold the IP addresses to clients, he said and the complaint indicated.

His clients were reportedly Virtual Private Networks — VPNs — which enable users to maintain anonymity online. VPNs could be used for online privacy protection or to shield the identity of fraudsters and cybercriminals. They can be used to transmit illicit content or for online thieves to hide their tracks.

As Micfo amassed VPN clients using the illegitimately-obtained IP addresses, a lot of traffic — some being criminal — filed through its network without a trace, according to government subpoenas directed at Micfo and reviewed by The Wall Street Journal.

Golestan and Micfo are not charged with being part of or even aware of illegal activity transmitted via VPNs across Micfo’s servers. The DOJ charged him and the company with “defrauding the internet registry to obtain the IP addresses over a period of several years.”

Prosecutors said Golestan’s alleged scheme was valued at $14 million, which was based on the government’s estimated value of between $13 and $19 for each address in the secondary market, according to the court complaint.

Born in Iran, Golestan, 36, started Micfo in 1999 in the bedroom of his childhood home in Dubai before emigrating to the U.S.

Even though the concept of smart cities is still largely under development, cybercriminals are waiting in the wings to begin laying virtual siege to infrastructure that the high-tech, highly responsive urban areas envisioned for the not-too-distant future.