If you run a business online, care about internet infrastructure, or simply want to understand how the internet's hidden plumbing actually works, here's a story that should catch your attention. Millions of internet addresses that belong to Africa have been quietly siphoned off—some through outright fraud, others through legal but ethically questionable means. Now a legal battle threatening the nonprofit that allocates Africa's IP space has the global internet community on edge.
What happened: The scale of the problem
Africa's rightful share of the internet's foundational address space has been systematically drained. One businessman, Lu Heng of Hong Kong, acquired 6.2 million African IP addresses between 2013 and 2016—roughly 5% of the continent's entire allocation, more than Kenya possesses. Those addresses are now estimated at around $150 million.
The man who allegedly facilitated this from the inside was Ernest Byaruhanga, AFRINIC's former No. 2 employee. Investigators discovered he misappropriated approximately 4 million IP addresses, valued at over $50 million, before being fired in December 2019. The scheme was uncovered by Ron Guilmette, an independent internet analyst in California, working with journalist Jan Vermeulen at South Africa's MyBroadband. Byaruhanga is believed to be in Uganda but could not be reached for comment.
AFRINIC, the continent's regional internet registry founded in 2003, has been trying to reclaim these addresses. Its new chief executive, Eddy Kayihura, filed a criminal complaint with Mauritian police and began restructuring management. But Lu pushed back hard. His lawyers persuaded a Mauritian judge to freeze AFRINIC's bank accounts in late July. He also filed an $80 million libel lawsuit against the registry and its CEO.
The short version
| Current Rules | Lu Heng's Position | |
|---|---|---|
| Allocation principle | Addresses assigned to serve region of origin | Addresses can be used anywhere |
| Who decides | Five regional registries | No geographic oversight needed |
| Enforcement | Registries can revoke addresses | Registries have no authority |
| Accountability | Geographic assignment enables tracing | Market determines legitimacy |
Why this matters: What's really at stake
The internet runs on IP addresses—numeric identifiers that let devices find each other. There's a finite pool of these addresses, known as IPv4. Developed nations exhausted their allocations years ago; they're now bought and sold for $20 to $30 each. Africa's relatively abundant share has made it a target.
Bill Woodcock, executive director of Packet Clearing House, put it bluntly: the idea that someone would directly attack a fundamental element of internet governance and try to shut it down seemed unthinkable, especially in the AFRINIC region.
Lu's stance is where this gets troubling. He argues regional registries have no authority to decide where IP addresses are used. "AFRINIC has to serve the internet, it doesn't have to serve Africa," he told the Associated Press. Critics see this as a fundamental distortion of how internet governance is supposed to work—allocations are meant to support development in their assigned regions, not serve as tradable commodities for whoever has capital.
The stakes extend beyond Africa. If this legal challenge succeeds, it could set a precedent that unravels the entire regional registry system, potentially fragmenting the internet's coordination structure.
What this means for you
Most readers won't directly interact with IP address allocation. But the fallout touches online security in several ways. Spam operations and scam networks depend on IP addresses to operate. When addresses are concentrated in the hands of those with no connection to a region, accountability becomes murky. It becomes harder to trace malicious traffic, easier for bad actors to hide.
If you run a small online store, suspicious orders from IP addresses that supposedly belong to African businesses but route through other jurisdictions illustrate exactly the kind of misallocation that makes fraud detection harder. Spam filters may not have accurate geographic data to work with.
More broadly, weakened regional registries mean a less accountable internet infrastructure. The systems that help security tools identify malicious sources depend on accurate, regional assignment data. When that data is corrupted, everyone pays.
Bottom line
AFRINIC is fighting for its survival while trying to reclaim resources meant for a continent that received only 3% of the world's initial IP address pool. The outcome of Lu Heng's legal challenge could reshape internet governance globally. Watch whether Mauritian courts side with regional allocation principles or with the argument that addresses can be used anywhere. Either way, expect the battle over digital territory to intensify as IPv4 scarcity drives prices higher.
Key takeaways
- Africa has historically been shortchanged on IP address allocation, making recovered addresses critically valuable for the continent's digital development
- The legal challenge against AFRINIC could establish dangerous precedents for internet governance worldwide
- Misallocated IP addresses complicate spam detection and fraud prevention for businesses and security tools
- IPv4 scarcity means IP address theft has real monetary value, incentivizing both fraud and aggressive legal counterattacks
Frequently asked questions
What is AFRINIC and why does it matter?
AFRINIC is the African regional internet registry, the nonprofit responsible for allocating IP addresses to organizations across the continent. It's one of five global registries that coordinate the internet's address space.
How did someone steal IP addresses from inside AFRINIC?
According to investigators, the organization's former deputy CEO allegedly issued millions of addresses to entities he controlled or favored, bypassing normal procedures. The scheme was uncovered by independent researchers in 2019.
Can IP addresses really be worth millions of dollars?
Yes. The global supply of first-generation IPv4 addresses is exhausted. Organizations now buy and sell them for $20 to $30 each, meaning blocks of millions can be worth hundreds of millions.
What does this have to do with spam and cybercrime?
Accurate IP address records help security systems trace malicious traffic. When addresses are allocated improperly or routed through unexpected jurisdictions, it becomes easier for spammers and scammers to obscure their origins.
What happens if AFRINIC loses the legal battle?
If courts rule that regional registries cannot enforce geographic allocation rules, it could destabilize the entire system of internet address governance, with unclear consequences for global network security.