🌐 TI-2026-021I · The Architecture of Impunity · Part 9 of 10

The Economics of Abuse: Who Profits and How Much

Every institution in the architecture of impunity has one thing in common: it gets paid. The registry gets paid. The company-formation agent gets paid. The address broker gets paid. The upstream carrier gets paid. The hoster gets paid. The criminal customer gets paid. Even the reputational middlemen who promise visibility into abuse often monetize the problem indirectly, because the persistence of abuse sustains demand for intelligence, filtering, monitoring, and risk-scoring. This does not mean every actor in the stack is morally identical. It means the stack is not held together by mystery. It is held together by invoices.

That distinction matters because internet-abuse discourse is still dominated by language of failure, incapacity, overload, and unfortunate complexity. Those words create a picture of a system that would work if only it had better tooling, better coordination, or better goodwill. But when the same system repeatedly tolerates known abusive infrastructure, the more useful question is economic rather than sentimental: who benefits from delay, and what does delay earn them? Once the issue is framed that way, the architecture looks less like a malfunctioning governance system and more like a value chain in which each participant externalizes the social cost to the layer below.

The infrastructure referenced across this series already makes that logic visible. IPs such as 191.101.33.115 and 179.61.232.244 on ASN14670, 102.129.200.117 on AS208949, and 45.135.194.111 on AS51396 are not meaningful only as technical indicators. They are revenue anchors. They exist inside billing relationships. Somebody acquired the company. Somebody paid the membership fees. Somebody leased or originated the IP space. Somebody sold transit. Somebody sold the server, VPS, reverse proxy, or routing adjacency. Somebody invoiced the customer who used the infrastructure to target victims. If the IP remains live after repeated reporting, that continuity is usually not free. It is paid continuity.

This article therefore does not ask whether cybercrime infrastructure is profitable in the abstract. That is obvious. The harder and more revealing question is how profits distribute across the institutions that keep the infrastructure alive before the extortion note is sent, before the phish lands in an inbox, before the credential-stuffing run hits its first exposed service, and before the abuse report disappears into the void. The answer is uncomfortable because it shows that the most durable abuse is not financed only by criminals. It is financed by ordinary-looking commercial relationships whose prices are low enough to invite abuse and whose compliance expectations are weak enough to preserve it.

The figures available here are sufficient to sketch the scale. IPXO alone reports 14 million+ IPv4 addresses under management, 63,000+ completed leases, and $55 million+ paid to address owners. RIPE NCC collects roughly €38 million a year from around 21,500 LIRs when the €1,800 annual fee and ancillary charges are aggregated. Shell-company formation remains absurdly cheap: a Seychelles IBC can be packaged for tens to hundreds of dollars, a UK company can be formed online for about £100, and nominee or address services add recurring margin without adding meaningful accountability. Downstream, abuse-tolerant hosting routinely charges 2x to 10x the price of legitimate equivalents. Above all of that sits the criminal customer layer, where a single ransomware payment can dwarf the annual compliance budget of the institutions that could have prevented the infrastructure from existing in the first place.

One should resist the temptation to treat these numbers as precise totals. The bulletproof economy is intentionally opaque, and many of its participants hide inside legitimate markets. The right conclusion is not that the entire industry can be reduced to one clean spreadsheet. The right conclusion is that even conservative estimates produce a market in the hundreds of millions to low billions of dollars annually. That is large enough to shape incentives, large enough to distort enforcement, and large enough that inaction should no longer be explained as mere administrative weakness.

1. The Revenue Layers: formation → registration → transit → hosting → customers → victims

The abuse economy is easiest to understand as a layered business system. At the bottom sits the victim, who pays involuntarily through extortion, fraud loss, incident response, reputational damage, downtime, or stolen labor. Above the victim sits the criminal customer who directly monetizes the attack. Above that sits the hosting layer that sells persistence, deniability, and speed of replacement. Above hosting sits transit, which sells reachability. Above transit sits IP brokerage and registry identity, which sell scarce resources and formal legitimacy. Before any of those layers activate, a formation agent often sells the legal shell that makes the entire route administratively possible.

Each layer can defend itself by narrowing the description of what it sells. A formation agent says it sells incorporation. RIPE says it sells Internet number resources, not conduct. IPXO says it operates a marketplace. The carrier says it sells bandwidth. The hoster says it sells infrastructure. The criminal says nothing at all if it can help it. But narrowing the description of the service does not eliminate its functional role inside a chain. If a market repeatedly assembles all the inputs required for abuse, then the question is not whether any one seller wrote the malware. The question is whether the total system has evolved to make abuse cheap to assemble and expensive to unwind.

That asymmetry is the central economic fact. The front-end cost of building resilient abuse infrastructure is modest. The back-end yield from successful cybercrime is massive. The market therefore does not need every customer to win. It only needs some customers to win often enough to keep buying. This makes enforcement structurally difficult because the defensive side is asked to impose friction on a chain where even intermittent success produces outsized returns. It also explains why neutral-looking suppliers can truthfully say they serve both good and bad customers while still becoming indispensable to the bad ones.

The dirty secret of internet abuse is not that it is technically sophisticated. It is that it is economically well-designed.

2. Layer 1: Formation Agent Revenue — cheap shells, recurring renewals, almost no downside

The first seller in the chain is often the most mundane. A formation agent does not need to know anything about BGP, malware, or phishing kits. It only needs to know how to package legal existence cheaply and quickly. In many offshore or semi-offshore jurisdictions that service is mature, commoditized, and optimized for low-friction purchase. The customer does not buy a company because a company is intrinsically valuable. The customer buys a company because many other institutions—banks, registries, counterparties, data centers, and even some investigators—still treat company existence as a weak proxy for legitimacy.

That is why the advertised price matters. A Seychelles IBC can be marketed in ranges from roughly $50 to $500 depending on how stripped-down or fully managed the package is. Annual renewals can add $200 or more. A BVI structure may start above $1,000 and climb once nominee directors, secretarial services, or additional layers of administration are added. The UK model is cheaper still at the formation stage—around £100 for Companies House incorporation online—but the real margin often lies in add-ons: registered address services, mail handling, nominee arrangements, identity intermediation, and renewal administration. The company is the entry product; opacity is the upsell.

Economically this is almost perfect business. Formation agents are paid whether the entity becomes a florist, a consulting shell, or a routing wrapper for abuse-tolerant hosting. Their contractual posture is usually defensive: they process documents, rely on client representations, and disclaim responsibility for downstream conduct. Even where KYC exists, the structure of the market encourages minimum viable compliance rather than forensic scrutiny. Every additional question risks losing the sale to another jurisdiction or another intermediary. The result is a service industry that monetizes deniability while outsourcing the actual consequences to everyone else.

For the architecture of impunity, the crucial fact is not which jurisdiction is best in some abstract legal ranking. The crucial fact is that shell-company formation is cheap relative to the value of the network identity it unlocks. If a customer can spend less than the price of a budget laptop to obtain a corporate wrapper that later helps secure an ASN, transit, or a bank account, then the formation layer is not peripheral. It is one of the great subsidy mechanisms of the abuse economy. It reduces the price of administrative camouflage to a point where replacement becomes normal.

This is why one should stop treating shell-company infrastructure as the exotic edge of cybercrime. It is closer to a supply-chain input. When an operator chooses Seychelles, Nevis, BVI, or a cheap UK wrapper, the choice is not merely about tax or formal registration. It is about buying legal friction in advance. Every hour investigators later spend unpicking nominees, service-provider layers, or cross-border document requests is an hour already purchased by the shell at a negligible upfront cost.

3. Layer 2: RIPE NCC Revenue — around €38M a year, and every abusive LIR is still a paying member

Once the operator has a usable legal entity, the next transformation is institutional rather than technical. A company in the RIPE service region can apply to become an LIR. The fee structure is public enough to make the economics clear: approximately €1,000 sign-up, €1,800 annual membership, and €50 per ASN. Multiply the annual fee by roughly 21,500 LIRs and the recurring-income picture becomes obvious: around €38 million a year before one even starts discussing the broader organizational ecosystem, ancillary services, or the political capital that comes with being the gatekeeper of number resources.

This does not prove criminal intent inside RIPE NCC. It proves something subtler and more important: a structural conflict of interest. Every abusive or borderline-abusive LIR is still a customer. Every terminated member is lost recurring revenue. Every serious escalation path increases governance cost. Every demand for deeper beneficial-owner verification slows throughput and raises friction against applicants whose money currently counts the same as everyone else's. The organization can honestly say it serves the community while still inhabiting an incentive environment where rigorous exclusion is economically unattractive unless public scandal makes it unavoidable.

The membership model matters even more when combined with shell-company turnover. If one abusive entity is closed, the market can often form another wrapper, reapply through another path, or route through another sponsor. That means the organization faces all the administrative pain of enforcement while the operator treats legal identity as replaceable inventory. The result is predictable: sanctions look severe on paper but can become weak in practice against actors whose whole model is based on entity churn.

There is also a rhetorical shield built into the registry role. Because RIPE is not supposed to be an intelligence service, it can plausibly argue that policing content or future conduct is beyond its mandate. That defense is not entirely false. But it becomes less persuasive when the same ecosystem repeatedly converts low-substance corporate wrappers into routable resource identity with very limited scrutiny of who sits behind them. A gatekeeper does not have to author the abuse to become an enabling institution. It only has to keep opening the gate under standards that are easy for bad actors to satisfy.

One can see the distributional logic clearly. The benefits of a permissive or minimally forensic registration process are concentrated inside the institutions that collect the fees and inside the operators who receive the resources. The costs are diffused across victims and defenders. Diffuse costs are politically weak; concentrated revenue is politically strong. That is one reason the architecture persists.

RIPE annual reporting also matters for what it emphasizes. The organization spends heavily on community, meetings, process, and the infrastructure of self-governance because that is what registry institutions are built to do. Enforcement against abuse-enabling shells is not culturally central to that mission. The result is not corruption in the melodramatic sense. It is a mission design in which enforcement is peripheral while membership is core. In such a design, drift toward permissiveness is not surprising. It is the path of least institutional resistance.

4. Layer 3: IP Address Brokerage — IPv4 exhaustion turned scarcity into a leasing economy

IPv4 exhaustion created one of the most important economic preconditions for modern abuse infrastructure: scarcity with transferable value. Once free allocations ceased to be the norm, addresses stopped being boring technical plumbing and became tradeable assets. On the secondary market, indicative values around $40-60 per address have become a widely discussed reference point, varying with market conditions, block size, and cleanliness. For honest network operators this is a capital-management issue. For the abuse economy it is an opportunity: scarce addresses can be leased, flipped, suballocated, and reputationally laundered through normal-looking marketplaces.

IPXO is important here not because it is uniquely villainous, but because it demonstrates the industrial scale of the leasing model. The company reports 14 million+ IPv4 addresses under management, 63,000+ completed leases, and more than $55 million paid to address owners. Those numbers are not proof that most of the marketplace is abusive. They prove something almost more destabilizing: the infrastructure required to move enormous quantities of address space between parties already exists in a polished, legitimate-seeming commercial form. That makes the address layer vastly easier to industrialize for anyone who wants routable space without long-term reputational attachment.

The address owner's incentive is obvious. Unused IPv4 space becomes yield-bearing inventory. Instead of sitting idle on a balance sheet, the block produces passive income. The broker's incentive is equally obvious: commissions and transaction flow. Neither party needs to love abuse for abuse to appear in the chain. They only need to prefer volume and liquidity over aggressive friction. If suspicious customers are blocked too aggressively, market throughput suffers. If too much diligence is imposed on short-duration leases, the convenience of the marketplace declines. Again the pattern repeats: the institution closest to the revenue has reasons to avoid becoming the strictest enforcer.

Scarcity also creates a reputation premium. “Clean” IPs matter because many defenses are probabilistic and reputation-sensitive. A fresh or low-history block is worth more to a questionable operator than an obviously burned one, because deliverability, reachability, and initial trust are better. That means address-leasing markets can inadvertently become reputational reset mechanisms. The IP itself may be technically ordinary; what matters is that the history looks shallow enough for the next campaign to start with less friction.

This is where the IP layer connects directly to earlier parts of the series. In the reputation-laundering logic described elsewhere, movement across entities, ASNs, or leasing relationships can help dilute prior toxicity. The protocol does not remember moral history. The marketplace does not uniformly enforce it. Defenders therefore spend time reconstructing lineage that the market is structurally designed to abstract away.

Address brokerage is not a moral accusation against every lease. It is an analytical statement about what scarcity markets do. When a scarce technical resource becomes rentable, a new class of intermediary emerges whose profit depends on keeping the resource in motion. Motion favors liquidity. Liquidity favors low friction. Low friction is exactly what abuse infrastructure wants.

5. Layer 4: Transit Revenue — reachability sold by the megabit, tolerance sold by the month

An IP block and an ASN are still not enough. The infrastructure becomes real only when someone agrees to carry its routes. Transit is where administrative legitimacy becomes operational reachability. In legitimate markets, wholesale bandwidth pricing can vary widely by region, contract length, blend quality, and commit size, but indicative ranges of roughly $0.50 to $5 per Mbps are sufficient for orientation. That is the clean version of the market. The dirty version is not always visible on a public price list. It is hidden inside questions that are not asked, complaints that are not escalated, and customers who are retained longer than their behavior warrants.

For a small or medium bulletproof operator, transit spend in the range of $2,000 to $10,000 per month can be enough to sustain meaningful abusive capacity, especially when combined with leased address space, resale models, or higher-margin downstream customers. This is not a massive barrier. It is a normal operating expense. That fact matters because defenders often imagine global abuse infrastructure as if it required state-level resources. Some of it does. Much of it does not. Much of it merely requires a supplier willing to convert money into reachability without making accountability central to the relationship.

The premium in abuse-tolerant transit is therefore not necessarily about raw bandwidth quality. It is about operational patience. A downstream will pay more to an upstream that will not panic at the first cluster of abuse complaints, that will tolerate messy reputation, or that will structure the relationship through enough intermediaries to diffuse blame. Pfcloud-class or M247-adjacent discussions in prior work illustrate why this layer matters. The carrier does not need to advertise itself as “bulletproof”. It only needs to be known as a place where abusive downstreams do not die quickly.

That reputation itself becomes economically valuable. A hoster that knows which upstreams are lax can build a business model around them. A customer that knows which hosters are connected to patient transit can pay a premium for continuity. Each actor is selecting not only for price but for a complaint-response profile. In that sense, the transit market quietly prices enforcement: stricter networks cost abusers in disruption, while tolerant networks save them money in migration and downtime.

One should also remember that transit creates leverage asymmetry. A victim does not negotiate with the carrier. The downstream customer does. The victim encounters the network only as harm. The carrier encounters it as revenue. That asymmetry helps explain why transit correction is so rare. The party suffering the abuse is not the party the carrier invoices.

6. Layer 5: Bulletproof-Hosting Operator Revenue — the markup is for tolerance, not for RAM

By the time the stack reaches the bulletproof-hosting operator, the economics become blatant. The underlying hardware is rarely exceptional. The CPU cores, RAM, SSD allocation, and virtualization layer may be indistinguishable from a perfectly ordinary VPS product. What changes is the service promise. A mainstream low-end VPS might cost $5-20 per month. A comparable abuse-tolerant instance can cost $50-200 per month or more. That spread is the price of complaint resistance, weak KYC, permissive content tolerance, fast re-IP support, or the ability to survive long enough for the customer to monetize before being pushed elsewhere.

In other words, bulletproof hosting does not primarily sell compute. It sells institutional slack. That slack includes delayed suspensions, weak or closed-loop abuse handling, hidden or operator-controlled customer layers, tolerance for credential-stuffing or scanning traffic, and often the quiet ability to move a customer laterally when attention rises. If mainstream hosting sells convenience and performance, bulletproof hosting sells time. Time is exactly what criminal customers need.

This is why gross revenue can accumulate quickly even for operators that are not huge by cloud-hyperscaler standards. A provider with hundreds of higher-margin customers, or with a few dozen customers running many instances, can move into seven-figure annual revenue without needing mainstream scale. The hardware bill is real, but the differentiator is not hardware. It is governance. The operator profits from being the provider that says “not yet” when others say “suspend now”.

The structure is visible in networks repeatedly tied to phishing infrastructure, malware staging, ransomware command-and-control, spam operations, or industrial credential attacks. Customers are not paying for beautiful dashboards. They are paying for continuity under pressure. That is why the term abuse-tolerant premium is more analytically useful than “expensive hosting”. The markup is not for technical luxury. It is for institutional behavior.

Once this is understood, the economics of the rest of the stack make more sense. The operator can afford the shell company, registry fees, transit, and address costs because downstream customers are paying not only for infrastructure but for protection from interruption. A market that sells interruption-resistance inevitably attracts those who expect to be interrupted for cause.

7. Layer 6: Criminal Customer Revenue — the hosted content is where the stack gets repaid

The upper layers of the architecture would not persist if criminal customers could not repay them easily. They can. Ransomware alone demonstrates the ratio. Public reporting in 2024 placed average ransomware payments around $1.5 million in many tracked cases. Not every campaign yields that much. But one payment of that scale can cover years of shell renewals, registry fees, transit, address leasing, and hosting spend. The economics are ridiculous from a defensive perspective: the institutions expected to prevent abuse often operate on budgets and incentives that are tiny compared with what one successful criminal event can generate.

Business email compromise adds another illustration. The FBI's IC3 figures put BEC losses around $2.7 billion in a single reporting year. Global phishing and credential-theft losses run far higher once incident response, fraud reversal, password resets, and downstream account compromise are included. Spam and loader infrastructure can monetize through affiliate markets. Residential proxy networks monetize through resale. Credential harvesting monetizes through access brokerage and secondary fraud. The point is not that every IP in the stack produces spectacular revenue. The point is that the aggregate yield at the criminal layer is so large that the upstream administrative costs look trivial.

That payout structure changes how one should interpret every earlier layer. A formation agent may earn a few hundred dollars. RIPE may earn a few thousand over time from a given entity. An address owner may earn rent. A carrier may earn a monthly transit fee. A bulletproof hoster may earn a high-margin VPS bill. The criminal customer, however, can extract sums that make all of those upstream costs look like routine supply purchases. The stack survives because the value captured at the top is enormous compared with the cost of enabling it lower down.

This is also why “just block them and they will go away” is economically naive. The customer can often afford to lose nodes, rotate addresses, burn shells, and move providers because the expected upside remains favorable. Markets with this kind of asymmetry do not self-correct through mild friction. They self-correct only when the cost of operating rises closer to the value of the campaigns being run. The current architecture does the opposite: it keeps entry cheap and replacement fast.

8. The Total Stack — an illustrative revenue ladder from shell to victim

Consider what a conservative, non-maximal abuse stack might look like in practice. The operator spends a few hundred dollars on an offshore shell or regional wrapper, a few thousand euros on registry legitimacy, rents or leases needed address space, commits a few thousand dollars a month to transit and core operations, then resells abuse-tolerant services at a premium to criminal customers. Those customers may be phishers, spam operators, proxy sellers, credential stuffers, or ransomware affiliates. They do not all need to make millions. They only need to make enough to keep buying infrastructure. Some of them will make far more.

At the ecosystem level, the numbers become far more substantial. When one combines address leasing, formation services, tolerant hosting premiums, transit sales, downstream proxy or scam infrastructure, and the criminal monetization layer, a plausible annual industry estimate in the range of $300 million to $2 billion is not extravagant. That range is intentionally broad because different parts of the market blend legitimate and illegitimate use, and because the criminal-yield layer is difficult to enumerate. But the order of magnitude matters. This is not hobby hacking. It is a market big enough to create durable institutional interests.

One should also notice how elegantly the profits are distributed. No single seller needs to carry the full moral weight of the system. The formation agent says the crime happened later. The registry says it only administered resources. The broker says it only matched supply and demand. The carrier says it only sold bandwidth. The hoster says it only sold servers. The criminal customer says nothing if possible. The victim is the only actor that pays without consent and without a contract. In that sense, the total stack is not just an economy. It is an engine for moral outsourcing.

9. Why Nobody Will Fix This: inaction is cheaper than cleanup for every actor in the chain

Once the money is mapped, the persistence of the architecture stops being mysterious. RIPE loses revenue and incurs governance burden when it terminates or deeply investigates members. Formation agents lose customers if they impose serious beneficial-owner scrutiny. Address brokers lose turnover if they refuse too many buyers or impose cumbersome controls. Transit providers lose recurring revenue if they de-peer or eject controversial downstreams. Bulletproof operators literally destroy their own business model if they become strict. The criminal customer loses only when the system finally imposes more cost on operation than crime can recover. Under current conditions, that threshold is rarely reached.

This is the core of the conflict: for nearly every institutional actor, the cost of fixing the problem exceeds the cost of tolerating it. Investigating abuse thoroughly takes labor. Verifying beneficial ownership takes labor. Challenging members takes legal time. Terminating customers costs revenue. De-peering a dirty downstream risks disputes and lost throughput. Even when an institution cares morally, the economic structure nudges it toward delay, minimalism, or symbolic process instead of decisive action.

This incentive map also explains why so much of the response architecture is symbolic. Forms, abuse contacts, KYC checkboxes, registry policies, and acceptable-use statements create the visible appearance of accountability at relatively low cost. Real enforcement requires accepting lost revenue, heavier review, and faster escalation against borderline or opaque customers. The architecture overwhelmingly prefers the former to the latter. This is why defenders keep encountering silence, deflection, and churn instead of remediation.

The deeper problem is political economy, not bad luck. Internet governance still narrates itself as though public safety will emerge naturally from distributed private contracts plus a light layer of policy norms. But a chain composed of fee-collecting institutions and revenue-sensitive intermediaries will not automatically choose social welfare over paying customers. It will choose it only when the cost of not choosing it becomes intolerable. The current abuse market demonstrates that tolerance is still cheap.

That is why calls for “better cooperation” often underperform. Cooperation against what? Against a revenue source. Between whom? Between institutions whose incentives do not align. Under what pressure? Usually far less pressure than the victims experience. Without changing the economic penalties attached to permissiveness, moral appeals remain weaker than monthly billing.

10. Final accounting

The architecture of impunity persists because it is rational for the people inside it. Not morally rational. Economically rational. The formation agent gets easy margin. The registry gets recurring fees. The address owner gets rent. The broker gets commission. The carrier gets transit revenue. The hoster gets premium pricing. The criminal customer gets access to victims. At every stage the harm is pushed downward and outward. The people who can stop the chain usually do not feel its worst consequences, and the people who feel its worst consequences usually cannot stop the chain.

Follow the money long enough and one reaches a bleak but clarifying conclusion: internet abuse is not sustained only by hidden actors in dark corners. It is sustained by ordinary institutions selling ordinary services under incentive structures that reward weak friction. Some layers are openly criminal. Many are not. But legality and innocence are not the same thing. A legal service that persistently lowers the cost of abuse and raises the cost of accountability is part of the same economic machine.

The decisive question is no longer whether each actor can explain its own role narrowly. The decisive question is whether the whole chain would still function without them. It would not.

That is why this installment belongs near the end of the series. Earlier parts showed the mechanism: the registries, the abuse-report graveyard, the upstream enablers, the jurisdictional gaps, the reputational laundering. This part shows why the mechanism survives. It survives because everyone in the chain is paid before the victim is heard. The architecture is not merely tolerated. It is monetized.