[zamadatix]

Some more to add to the pile:

- Static IP blocks from their ISP (some still lease IPs for surprisingly cheap).

- Releasing/renewing their NAT boxe's DHCP release on carriers that don't pin assignments (usually these are in pools of /22 or 1024 addresses - though most would be in use at any given time and impossible to randomly get you should be able to get a couple dozen).

- Customers of ISPs that use CG-NAT (cheap wired) or NAT64 (some wireless providers), similar to the above just 1 translation layer deeper.

- IP space you control (that's how I have 23.0.0.0/8 for the moment)

- BGP hijacking IP space you want to control (though hopefully in the world of RPKI this is getting harder and harder to do)