BEGIN:VCALENDAR VERSION:2.0 PRODID:Data::ICal 0.24 BEGIN:VEVENT DESCRIPTION: 'Title: There Is No Internet: Cross-Domain Recon of all 4.3 Billion\n IPv4s\n Tags: Recon Village | Creator Talk/Panel\n When: S aturday\, Aug 8\, 17:30 - 17:59 PDT\n Where: LVCCW Level 1 Hall 3 801 (C reator Stage 2) - [1]Map\n\n Description:\n\n We scanned every IPv4 ad dress on the planet. Twice. We collected\n public records in one of at l east three places: the RIR registration\,\n the operator's reverse DNS\, or whatever service answers on port. Most\n threat intelligence pipelin es read one of those. Darkmouse lines up\n all of them and flags the dis agreements. The result is attack-surface\n visibility that no single sou rce gives you\, and a methodology you can\n run yourself.\n\n This tal k walks the recon pipeline behind three findings from a single\n cross-d omain pass over 4.3 billion IPv4 addresses in five days\, plus a\n 92 mi llion IP targeted scan in 34 hours (Russia\, Iran\, and North\n Korea). We used ZMap on single-use Jetstream2 VMs\, zdns for PTR and\n forward v erification\, bulk RPSL and ARIN XML and APNIC data loaded\n into DuckDB alongside MaxMind GeoLite2\, OpenSanctions\, and the US\n Trade Consoli dated Screening List. Enrichment is baked into the scan\n row at ingest. Every field carries a source-date stamp so longitudinal\n comparison ac tually works.\n\n Lead finding for a recon audience: 6\,656 Iranian IPs in RIPE where the\n registrant placed fabricated US street addresses int o the\n authoritative registry. 4\,608 of them cite AT&T Mobility's ARIN \n IP-management address verbatim. 2\,048 cite a Philadelphia apartment\ n building. All geolocate to Iran. All trace to one operator through a\n shared RIPE maintainer object linking a Shiraz Local Internet Registry\ n and an Omani shell.\n\n Between September 2025 and January 2026 the fabricated addresses began\n rotating out\, replaced by netnames like "D atacamp-Limited" that\n impersonate real UK hosting companies. A single- point-in-time feed\n cannot see that rotation. Two dated snapshots can. We are currently\n running follow up scans and expect to have new data b efore the\n conference.\n\n Additional Findings: five active PTR recor ds in Russia and the\n Netherlands claiming US government domains\, incl uding .fbi.gov\n subdomains\, four of five still live six months after f irst observation\n (April 2026). And 1\,534 APNIC-registered IPs for Ent ity Listed Chinese\n telecoms\, declared country=US\, geolocating to One Wilshire in Los\n Angeles\, running production email and DNS on FCC-rev oked Section 214\n infrastructure.\n\n Every finding ships with the RD AP query\, the DNS check\, and the\n cross-reference that verifies it. E very finding ships with the RDAP\n query\, the DNS check\, and the cross -reference that verifies it.\n Attendees leave knowing which four source s to line up\, which fields to\n trust\, and what to look for when two d ated snapshots disagree.\n\n SpeakerBio: John McCary\, Former DARPA\, S tate Department\, now\n Professor and Builder\n\n John McCary founded Port 194 LLC\, where he builds internet-scale\n measurement and correlat ion tooling from public data. Former soldier\,\n diplomat\, Wall Street Journal journalist\, licensed private\n investigator\, and certified eth ical hacker. At 29 he helped design and\n launch a peer-to-peer data sha ring platform that became a DARPA\n program of record and is still in us e today. He designed and teaches\n the Open Source Intelligence course a t the University of Arizona as\n adjunct faculty. Off the clock he is us ually underwater\, in a Muay\n Thai gym\, or playing live music\, though rarely at the same time.\n\n '\n\n 1. #LVCCW_Level1_Hall3\n\n\n DTEND:20260809T005900Z DTSTART:20260809T003000Z LOCATION:Recon Village - LVCCW Level 1 Hall 3 801 (Creator Stage 2) SUMMARY:There Is No Internet: Cross-Domain Recon of all 4.3 Billion IPv4s END:VEVENT END:VCALENDAR