Micfo CEO Amir Golestan pleads guilty to wire fraud charges after fraudulently acquiring thousands of IP addresses from nonprofit ARIN, a first-of-its-kind case
Wall Street Journal : Tweets: @jeffstone500 , @dnvolz , and @dnvolz Tweets: Jeff Stone / @jeffstone500 : don't sleep on this @dnvolz @ByronTau story, about an executive who's pleading guilty to creating fictional personas and then shell companies to acquire IP addresses. there was previously some suggestion the IPs in question were used for spam operations. https://www.wsj.com/... Dustin Volz / @dnvolz : Golestan, in a WSJ interview last year, acknowledged creating 10 fictitious personas to pose as executives of 10 shell entities to obtain the IP addresses he used to build his biz and said it was a “victimless” use of pseudonyms. Prosecutors alleged the IPs were worth $14 million https://twitter.com/... Dustin Volz / @dnvolz : New: Amir Golestan, the subject of a 2020 WSJ investigation, has pleaded guilty in federal court to fraud charges related to his internet infrastructure company Micfo that catered to VPNs popular among criminals and hackers. https://www.wsj.com/...
Context & Ripple Effects
Micfo built its hosting business on thousands of IP addresses obtained from ARIN by fabricating demand: in a WSJ interview last year, Golestan admitted creating ten fictitious personas posing as executives of ten shell entities to win allocations the registry would never have granted to one company. The plea converts what looked like an aggressive but tolerated growth tactic into a first-of-its-kind criminal case over internet-number resources.
The case lands inside a widening prosecutorial pattern around identity fabrication at scale — from the HeadSpin CEO's wire-fraud plea over inflated revenue figures to bot networks monetizing fake accounts — with federal authorities now treating synthetic identities used to extract digital assets as wire fraud rather than gray-area abuse.
First-order effects
- Golestan's guilty plea formally establishes that misrepresenting organizational need to ARIN to obtain IP blocks is prosecutable wire fraud, ending Micfo's ability to treat its address portfolio as ordinary business inventory.
- ARIN's allocation vetting is directly implicated: ten shell companies passed its needs-based review, exposing how easily the nonprofit's process can be gamed by a single actor.
Second-order effects
- Internet number registries face pressure to add identity and needs verification to IP allocation, raising compliance costs for legitimate hosting firms that rely on fast address requests.
- The IP-abuse supply chain gets a second spotlight alongside the US-led dismantling of the 911 S5 proxy botnet, pushing buyers of bulk addresses and proxy capacity toward scrutinized, attributable sources.
Third-order effects
- If the pattern holds, scarce digital resources — IP addresses, accounts, streaming infrastructure — get treated like financial instruments requiring provenance checks, with fabricated-identity acquisition charged under wire-fraud statutes as the default enforcement template, as seen in the bot-account AI streaming royalty case.
- Regional internet registries drift toward de facto KYC-style gatekeeping of address space, reshaping a historically trust-based allocation system into an audited one.
The trend: Enforcement is converging on identity fabrication at scale as wire fraud, turning formerly ungoverned digital-resource acquisition — IP blocks, bot accounts, proxy networks — into criminally chargeable conduct.