Registry Integrity and Oversight#

Reese Radcliffe, ARIN (Senior Manager, Registry Integrity and Oversight)

• Why: The operational security underside of the registry: how number-resource fraud actually manifests, with numbers. Directly relevant to anyone whose address space could be hijacked or whose counterparties might not be who they claim.
• What: A threat-landscape and casework report. Notable findings: of out-of-region organizations creating ARIN Org IDs "to expand into the region," roughly 30% are found announcing ARIN resources out-of-region within 60 days; ~240 Org Creates per month, of which ~35 are escalated to RIO, with 42% of those being out-of-region expansion attempts; NRPM 4.10 (IPv4-to-facilitate-IPv6) space is abused via out-of-region announcement, reassignment to customers, leasing, or announcing with no associated IPv6; 223 policy non-compliance reports were received in 2025, of which 28 were actionable.
• How: RIO runs escalated review of suspicious Org Creates, Section 12 audits with video identity verification, fraud investigation, and law-enforcement collaboration, plus inter-RIR knowledge sharing.
• Where applicable: ARIN-specific process, but the threat taxonomy (entity fraud, unauthorized reassignment, out-of-region leakage, IRR misinformation) is the same one any resource holder or IX should assume exists. The 30%-within-60-days figure is a good calibration for how quickly out-of-region misuse follows a new Org ID.