Chapter 1: Portrait of a Marketplace

IPXO UAB (company code 307097001) is registered in Kaunas, Lithuania. It presents itself as a legitimate IP address marketplace — the "Airbnb of IP addresses" — where organizations with unused IPv4 blocks can lease them to those who need them.

The company operates through a constellation of entities:

Co-founder Vincentas Grinius lists his address as 6th Floor, 9 Appold Street, London EC2A 2AP — a WeWork-style serviced office near Liverpool Street station. This is the contact address in RIPE and ARIN RDAP records for Internet Utilities.

The scale is significant: 14 million+ IPv4 addresses under management, $55 million revenue, presence in all five RIR regions. IPXO is not a back-alley operation. It's an industry.

Chapter 3: African IP Space on European Bulletproof Hosting

Two AFRINIC blocks (102.129.200.0/24 and 102.165.51.0/24) — space allocated for African internet users — are routed through HBING's AS208949, a UK-registered ASN whose infrastructure sits in Frankfurt, Germany.

The geographic discrepancy is extreme:

Five countries for one IP address. This is the "phantom" pattern that triggered our investigation. When every source gives a different country, it means the IP has been routed through enough layers of indirection to confuse all automated classification systems.

The RDAP contact for these IPs lists "IPXO Incident Response Team" with support@ipxo.com. IPXO takes responsibility for abuse handling — meaning they are the operational controller, not merely a marketplace platform that connects buyers and sellers.

Chapter 4: The Academic Warning — "Sublet Your Subnet"

In 2024, researchers at CAIDA (University of California, San Diego) published a paper at the ACM Internet Measurement Conference: "Sublet Your Subnet: Inferring IP Leasing in the Wild."

The paper documents — with academic rigor — exactly what we're observing: IP leasing marketplaces (IPXO/HEFICED specifically named) enabling bulletproof hosting operations by:

1. Providing constantly rotating IP space (making blocklisting ineffective)
2. Obscuring the relationship between IP user and IP owner
3. Creating jurisdictional complexity that defeats abuse-handling processes
4. Enabling "reputation laundering" — clean IPs for dirty operations

The researchers measured the scale: millions of IPs changing hands through these marketplaces, with significant portions ending up in malicious campaigns. They noted that existing RIPE/ARIN transfer policies were designed for permanent sales, not for the dynamic leasing model that IPXO pioneered.

In essence: the regulatory framework hasn't caught up with the business model. IPXO operates in the gap between what's technically permitted and what's ethically defensible.

Chapter 6: The Economics — $55 Million in Revenue From What, Exactly?

IPXO's stated business: matching organizations with unused IPv4 space to those who need it, taking a commission. Legitimate use cases exist — temporary projects, testing, CDN expansion.

But the economics tell a different story. IPv4 addresses cost $35-45 each to buy outright. IPXO's lease rates are approximately $0.50-2.00/IP/month. For a $55M annual revenue at those rates, IPXO manages somewhere between 2.3 million and 9.2 million actively leased IPs per month.

Who needs millions of IPs on a temporary basis?

The legitimate use cases (CDN, VPN) account for thousands, not millions. The illicit use cases require exactly what IPXO provides: scale and rotation.

This doesn't mean all of IPXO's revenue is illicit. It means that the business model — particularly at the $55M revenue scale — mathematically requires either extremely large legitimate customers (who would typically buy rather than lease) or a significant volume of short-term leases to entities that burn through IP reputation.

Chapter 7: What's Running on IPXO's Bulletproof Leases

Our passive DNS enrichment reveals what actually runs on the IPXO-controlled IPs routing through HBING:

The nodomain.vip pattern is particularly telling — it's a throwaway TLD used for infrastructure that doesn't need a memorable name. Legitimate services need brands. Botnets and proxy networks need addresses.

IPTV piracy (mag-tv.net, vodnew) is a multi-billion dollar industry that requires bulletproof hosting — content owners issue thousands of takedowns daily. Normal hosting providers comply. Bulletproof providers don't.

Chapter 8: The Marketplace Defense — "We're Just a Platform"

IPXO's likely defense: "We're a marketplace. We connect IP holders with IP users. We can't control what people do with leased addresses."

This is the "we're just a platform" defense — familiar from Uber ("we're not a taxi company"), Airbnb ("we're not a hotel"), and every tech platform that wants the revenue without the responsibility.

But the defense fails here for specific, documented reasons:

1. IPXO controls the routing. netutils-mnt is their object. They decide which ASN announces their blocks. This is not a passive marketplace — it's active infrastructure management.
2. IPXO handles abuse. Their "Incident Response Team" is the RDAP contact. If you report abuse on 102.129.200.x, it goes to IPXO. They are legally the responsible party.
3. IPXO chose the transit. They didn't end up on bulletproof ASNs by accident. They configured route objects to point specifically at AS198584 and AS208949 — networks with documented abuse problems.
4. Academic publication. After CAIDA's 2024 paper, the "we didn't know" defense is destroyed. They were publicly told their platform enables abuse.

A platform that controls routing, handles abuse reports, chooses its transit providers, and has been academically documented as an abuse enabler is not "just a platform." It's an infrastructure provider with full knowledge and control.

Chapter 9: The Marketplace as Infrastructure

IPXO represents something new in the bulletproof hosting ecosystem: the legitimate-facing enabler.

Traditional bulletproof hosting (McColo, 3FN, CyberBunker) was brazenly criminal. They advertised "anything goes" and were eventually shut down by law enforcement.

IPXO's innovation is structural legitimacy:

• Registered in the EU (Lithuanian company)
• Participates in internet governance (RIPE Working Groups)
• Publishes corporate materials with glossy websites
• Claims compliance programs and abuse-handling teams
• Routes through bulletproof ASNs whose risk scores exceed 95/100

The old model: criminal hosting → law enforcement → shutdown.
The new model: legitimate marketplace → policy participation → structural protection → bulletproof transit → academic documentation → nothing happens.

IPXO doesn't host the malware. It provides the addresses that the malware runs on, routed through networks that ignore abuse, while participating in the governance that should sanction those networks. Every layer is one step removed from the crime, yet the crime requires every layer to function.