There Is No Internet - Cross Domain Recon of all 4 Billion IPv4s

The talk starts from the idea that IPv4 ownership data is not one trustworthy source. Registration records come from regional registries, reverse DNS names describe what an address claims to be, and the services that answer on an address show what it actually does. The speaker describes how the team scanned the full IPv4 space from temporary cloud virtual machines, then enriched each result with bulk WHOIS data, geolocation, corporate registries, and sanctions lists. Every field was stored with a source date so that results from different scans could be compared over time.

The middle of the talk walks through the anomalies the scans surfaced. Thousands of Iranian addresses were registered to fabricated US street addresses, some copying a real mobile carrier's corporate address. Other Iranian blocks hosted services for Russian platforms, and a cryptocurrency node appeared for about eleven days and then disappeared. Reverse DNS records claimed to be United States government domains, and telecom address space declared in one country geolocated to Los Angeles. The speaker stresses that many of these records are self-reported and unaudited.

The closing point is that a single snapshot misses change. Names, maintainers, and certificates rotated between scans, which showed up only when dated snapshots were compared. For practitioners, the takeaway is to line up several independent sources, decide which fields to trust, and keep provenance notes for every query. The speaker also notes that running this kind of full-space scan is expensive.