Summary

  • ARIN’s 3 November cumulative transfer original has 64 nonoverlapping IPv4 rows from Micfo, LLC. to a recipient labelled “U.S. Marshals Service in accordance with the Final Order of Forfeiture.” All carry 8 May 2024 22:10:30 UTC, type MERGER_ACQUISITION, and transferred ranges totalling 261,120 addresses.
  • Fifty-six 2026 RESOURCE_TRANSFER rows with source label DOJ-USMS cover 101,120 distinct addresses within that 2024 cohort. They name 34 recipients: 38 rows remain under ARIN, 16 go to RIPE NCC, and two go to APNIC.

The first surprise is a database label. In ARIN’s cumulative transfer original, 64 rows at exactly 22:10:30 UTC on 8 May 2024 list Micfo, LLC. as source. The recipient field is unusually explicit: “U.S. Marshals Service in accordance with the Final Order of Forfeiture.” The type field is MERGER_ACQUISITION. A court-order description has gone into a category whose name sounds like a corporate deal. The category is not a verdict about what deal occurred. It is the public database’s way of filing the move.

Count the actual transferred intervals. Those 64 transfer_set ranges do not overlap and contain 261,120 IPv4 addresses. Two rows split one original /21 into adjacent /22 transfers; summing original_set would count that parent twice. ARIN’s transfer-log format says dated JSON files are snapshots of a cumulative log, and its schema offers just two type values, MERGER_ACQUISITION and RESOURCE_TRANSFER. Its transfer statistics note also warns that one transfer request may involve multiple resource blocks. The file establishes 64 resource rows; it does not enumerate separate cases.

There is first-party context for the recipient wording. In ARIN’s 2023 account of the Micfo case, its counsel wrote that a court had ordered forfeiture of part of the IP-address rights and ARIN was working with the government on implementation. ARIN’s transfer guidance allows a finalized court order among the documents that can support a transfer and describes mergers, acquisitions, reorganizations or similar transactions under its 8.2 route. The public log does not provide the court-order identifier that would map its 64 rows to a specific operative schedule. That missing join matters more than the category’s ungainly name.

The second surprise is the journey out. Match the 2024 transferred intervals against later exact ranges in the same ARIN original. From 23 January through 14 October 2026, 56 nonoverlapping RESOURCE_TRANSFER rows use DOJ-USMS as the source label and fall wholly inside the earlier cohort. Together they cover 101,120 addresses and 34 distinct recipient names. ARIN remains the recipient registry for 38 rows and 51,456 addresses. RIPE NCC receives 16 rows and 37,376 addresses. APNIC receives two rows and 12,288 addresses. The public name shortens from the full Marshals-and-forfeiture phrase to DOJ-USMS; the address intervals provide the exact continuity across that naming change.

Two examples make the aggregate tangible without pretending every recipient had the same reason. The 8,192-address 104.222.192.0/19 went from Micfo into the 2024 cohort, then from DOJ-USMS to GLBB Japan KK in an 8 June 2026 entry naming APNIC as the recipient RIR. APNIC’s current exact RDAP covers the same interval. The 4,096-address 107.182.112.0/20 followed the 2024 path and moved to Netrouting B.V. on 7 April 2026 with RIPE NCC as recipient RIR; RIPE NCC’s exact RDAP covers it now. These current objects corroborate the end ranges. The transfer log supplies the dated chain.

One older article followed three /20 blocks as they split into six /21s. This is the larger ledger problem: a 2024 forfeiture-labelled cohort, the type ARIN assigned to it, and the 2026 dispersal across three registry systems. The file gives no prices, auction method or routing history. The other addresses in the 2024 cohort require their own full-year and current-record audit; this 2026 calculation is not a government-inventory statement. The public record already gives the important result: a legal-origin label can disappear into a generic type field while its number resources keep travelling.

Registry originals