Address Hijacking

What is This About?

There have been several incidents where hijackers have tried to impersonate resource holders, either to gain control of their resources in the RIPE Database or to resell them to third parties that are unaware the seller is not the legitimate holder.

The hijackers are familiar with the RIPE NCC's procedures and RIPE Policies. We have seen both isolated hijacks and more structural hijacks where the same group or individual has tried to acquire multiple ranges from various organisations at the same time.

The RIPE NCC is committed to maintaining our high standards of due diligence and protecting holders' resources. We are looking closely at any reports of hijacking and are reverting unauthorised changes where appropriate. We have also updated our processes and will be reporting any illegal activities to the relevant authorities where possible. Where member involvement can be proven, this will result in closure of the LIR account and deregistration of their resources.

Getting the Balance Right

The RIPE NCC has always been careful to maintain a balance between establishing a reasonable degree of certainty that we are dealing with the rightful holder on the one hand, while not being overly bureaucratic or inflexible on the other. There are many legitimate cases, particularly with legacy resources, where it can be difficult to establish clear proof of holdership - especially in cases where the organisation that originally held the resources is no longer in operation.

For the time being, resource holders may find that the RIPE NCC is more strict in our verification requirements as we seek to establish this reasonable degree of certainty and ensure due diligence on our part. This may result in delays in some cases.

In Case of a Dispute

In cases where the RIPE NCC reverts changes on the basis of a suspected hijacking and this is disputed, the affected party may ask to escalate the issue to RIPE NCC Management for a final decision.

If still no agreement can be reached, the affected party may object to the RIPE NCC's decision via the Arbiters Panel (non-members must go through a sponsoring LIR). During arbitration, all ongoing processes are frozen.

Protect Your Internet Number Resources

The best way to protect against hijacking is to make sure that your RIPE Database objects and contact information are up to date. If you need help, or suspect that your resources may have been hijacked, contact reg-review@ripe.net.