The Marketplace Economy

Part 1: The Business of Renting Addresses

In 2020, a Lithuanian company called Heficed rebranded. The new name: IPXO. The new business model: the world's first automated IP address marketplace. Their pitch was elegant — IPv4 addresses are scarce (the pool exhausted in 2019), organizations hold unused blocks, why not let them earn revenue by leasing unused space?

By 2024, IPXO had facilitated the transfer of 1.7 million IP addresses. Their parent company, Digital Energy Technologies Ltd (UK Company #14095987), grew rapidly. IPXO's success attracted competitors: Interlir, IPTrading, IPv4Global, Prefixx. A billion-dollar secondary market emerged.

What happens to attribution — the ability to trace malicious activity back to its source — when IP addresses can be rented by the hour from anonymous marketplaces?

It dies. Not slowly, not partially. Structurally and completely. The IP address marketplace model creates a fundamental break in the chain of attribution that has underpinned Internet security since the 1990s.

Here's why: Traditional hosting means a server has an IP address assigned by its ISP. That ISP knows who rented the server. Law enforcement can subpoena the ISP. The IP points to the operator.

With IP leasing: the IP address and the server are decoupled. The IP comes from a marketplace (IPXO). The server comes from a hosting provider. The routing comes from a third party. The WHOIS shows whoever the marketplace assigned as abuse contact. None of these parties necessarily know the identity of the actual operator.

Part 2: The Evidence in Our Database

Our honeypot has captured the marketplace model in action. Four IPs in our database are registered to "IPXO Incident Response Team" — meaning their WHOIS abuse contact points to IPXO's generic desk rather than any actual operator:

Notice the pattern:

• RDAP says: IPXO (the marketplace)
• Abuse contact says: Netherlands or United States
• BGP routing says: South Africa
• ASN operator says: United Kingdom

Four different answers to "who is responsible for this IP?" — none of which identifies the actual attacker.

If you're a CERT investigating SSH brute-force attacks from 102.129.200.117, who do you contact?

The WHOIS says email IPXO's Dutch abuse desk. IPXO can tell you they leased the IP — but to whom? To HBING LIMITED, a BVI-shell company registered in the UK. HBING's abuse contact points to a generic form. HBING routes through South Africa. HBING's registered office is a virtual address. HBING was incorporated in 2023. There is no natural person to find at the end of this chain.

Part 3: The IPXO → HBING → WHG Chain

The four IPXO IPs in our database reveal something specific: they all route through either HBING LIMITED (AS208949) or WHG Hosting Services Ltd (AS14670). And our entity-link analysis proves these are the same operator:

The second key is the smoking gun: SSH key 37:03:39:e7... is used by BOTH a WHG IP (179.61.232.245 on AS14670) AND an HBING IP (45.148.145.60 on AS208949). Same private key deployed across two supposedly independent companies. This is not "shared customer" — this is same operator, different shell company.

Why would the same operator need two different ASNs and two different company names?

Resilience and reputation laundering. When one ASN gets flagged by abuse lists, traffic shifts to the other. When one company gets deplatformed from an upstream, the other continues. And when IPXO assigns abuse contacts, it points to the company that leased the IPs — which may be HBING or WHG depending on which shell currently holds the marketplace contract. The actual infrastructure remains unchanged.

Part 4: The Full WHG Dataset

Beyond the IPXO-registered IPs, our database contains 24 IPs routing through WHG/HBING ASNs. The geographic patterns are extraordinary:

The naming patterns reveal the structure:

• "Private Customer" — WHG doesn't even pretend to identify the user. RDAP shows the literal string "Private Customer"
• "lir-vg-itweb-1-MNT" — HBING's RIPE maintainer object. "VG" = Virgin Islands. "itweb" = the company behind it
• "HostforWeb Support" — one of WHG's retail brands
• WHG Hosting Services Ltd — the parent, but claiming Singapore, India, US abuse contacts despite routing through UK

A "Singapore" server that routes through the UK. A "US" server that routes through the UAE. A "Netherlands" server that routes through the British Virgin Islands. What country's law applies?

That's the point. Nobody's. The geographic fiction isn't a bug in the marketplace model — it's the product. When your IP routes through UAE but claims US, which jurisdiction handles the abuse report? US CERTs say "not our BGP space." UAE CERTs say "not registered here." RIPE says "contact the maintainer." The maintainer is a BVI shell. The BVI has no cybercrime enforcement apparatus. The chain terminates in a jurisdiction with legal registration but no operational presence.

Part 5: The Structural Problem

IPXO isn't a criminal organization. WHG may not even know their infrastructure is being used for attacks. The problem is structural, not criminal. The marketplace model creates conditions where:

1. IP addresses are commoditized — anyone with a credit card can obtain them
2. KYC is minimal — marketplaces verify payment, not intent
3. Abuse routing is circular — IPXO says "contact the lessee," the lessee is a shell, the shell says "contact our upstream," the upstream says "not our IPs, contact IPXO"
4. Geography is fictitious — routing, registration, and abuse contacts can each claim different countries
5. Deplatforming is meaningless — lose one IP block, lease another. The server doesn't move. The operation doesn't stop.

This is what academic researchers are beginning to document. A 2025 CAIDA study ("Examining Abuse of the IPv4 Leasing Market") found that leased IP space appears in blocklists at 3-5x the rate of directly-allocated space. A Halcyon 2023 report documented Cloudzy (later confirmed linked to Iranian state actors) using marketplace-sourced IPs for C2 infrastructure. Our data adds the granular evidence: specific IPs, specific SSH keys, specific cross-ASN operational links.

Part 6: What the Marketplace Model Enables

The WHG/HBING cluster in our database — 24 IPs with average threat score of 80+ — demonstrates what marketplace infrastructure enables operationally:

The same SSH library (libssh2_1.11.0) across WHG IPs in UAE, South Africa, UK, and BVI. The same SSH keys deployed across supposedly independent ASNs. This isn't multiple customers coincidentally choosing the same tools — it's one botnet operator using the marketplace model to distribute across jurisdictions.

Can you prove it's one operator?

Shared SSH private keys are the strongest possible signal. A private key never leaves the machine that generated it unless the same person deploys it to multiple machines. When 179.61.232.245 (WHG, routing AE) shares SSH key 37:03:39:e7:... with 45.148.145.60 (HBING, routing VG), that key was generated once and deployed to both. The same person has root access to both machines. The companies are different. The ASNs are different. The routing countries are different. But the operator is one.

Part 7: The Future of Attribution

If IP addresses can be rented hourly, routed through arbitrary countries, and registered to anonymous shells — what replaces IP-based attribution?

Our honeypot research suggests behavioral fingerprinting fills some of the gap:

• HASSH fingerprints — SSH client algorithm sets are stable across IP changes
• SSH key reuse — private keys travel with the operator, not the IP
• Command patterns — attack sequences (credential choices, post-exploitation commands) identify operators better than addresses
• Temporal correlation — activity timing across IPs reveals coordination

But this requires the defender to run honeypots, capture sessions, extract behavioral markers, and maintain correlation databases. Most organizations cannot do this. They rely on IP reputation feeds — which are now being systematically undermined by the marketplace model.

Conclusions

Series Navigation

The Geography of Nowhere (TI-2026-028)

• 028A — The Geography of Nowhere (Overview)
• 028B — The LARUS Dossier
• 028C — The Marketplace Economy (You are here)
• 028D — The African Question: AFRINIC, Resource Capture, and Digital Colonialism (Next)
• 028E — The Norwich Connection: WHG, HBING, and the British Gray Zone