The Phantom ASN Ecosystem — Part 14 of 16

🇱🇹 The Lithuanian Connection

How a Small Baltic Nation Became the IP Address Laundering Capital of Europe

TI-2026-026N | Published June 2026 | ~95 min read

Chapter 1: From Kaunas to Everywhere

Lithuania is a country of 2.8 million people on the Baltic coast, sandwiched between Latvia, Belarus, Poland, and the Russian exclave of Kaliningrad. It's known for basketball, amber, medieval architecture, and — in a development that would have been unthinkable during the Soviet occupation — for becoming one of Europe's most aggressive fintech and technology jurisdictions.

Vilnius hosts Revolut's European banking license. Lithuania issued more fintech licenses in 2023 than the rest of the EU combined. The country's pitch is simple: low taxes, fast regulation, English-speaking workforce, EU membership. For legitimate fintech companies, Lithuania is what Ireland was to tech multinationals in the 2000s — a regulatory gateway to the European market.

But the same attributes that attract legitimate fintech — light regulation, fast incorporation, EU single market access — also attract something else. And in Kaunas, Lithuania's second city (population 315,000), a company called IPXO UAB has built what it describes as "the world's first full-stack IP address management marketplace."

IPXO doesn't sell servers. It doesn't host websites. It doesn't carry data traffic. It does something more fundamental: it leases the addresses that make the internet work. And in doing so, it has become a critical node in the infrastructure that enables everything from legitimate cloud computing to bulletproof hosting, from CDN operations to botnet command and control.

Chapter 2: The Corporate Matryoshka

To understand IPXO, you must first understand what it is not. It is not a single company. It is a corporate matryoshka — nested entities across multiple jurisdictions, each layer serving a specific purpose in the overall architecture of legal insulation.

Layer 1: IPXO UAB — The Lithuanian Front

IPXO UAB is the operational entity. UAB (Uždaroji Akcinė Bendrovė) is Lithuania's equivalent of a limited liability company. It's registered in Kaunas, employs the staff, runs the marketplace platform, and handles day-to-day operations. This is the entity that signs contracts with IP address owners and lessees. This is the entity that handles abuse complaints. This is the entity whose ISO 27001 certification gets prominently displayed on the website.

Lithuania was chosen not by accident but by design. Lithuanian corporate law requires minimal capitalization (€2,500 for a UAB), allows single-person boards, imposes no residency requirements on directors, and — critically — does not require public disclosure of beneficial ownership beyond what the EU's Anti-Money Laundering Directives mandate. For a company managing 14 million IP addresses, the regulatory burden is lighter than what a food truck operator faces in most EU capitals.

Layer 2: IPXO LLC — The American Address

IPXO LLC is registered in Austin, Texas. The RDAP records for IPXO-managed IP space list a Dallas address: 3132 State Street, Dallas, TX 75204-3500. Texas LLCs are among the easiest corporate structures in the world to establish — no operating agreement required, no annual report filing, no requirement to disclose members or managers publicly. An IPXO LLC exists primarily for one purpose: to hold ARIN-delegated IP address resources. ARIN (American Registry for Internet Numbers) requires US or Canadian entities for resource membership. The Texas LLC is the ARIN membership vehicle.

Layer 3: Internet Utilities Europe and Asia Ltd — The London Mystery

Then there's Internet Utilities Europe and Asia Ltd, registered at Companies House in London (Company No. 12540160). This entity was incorporated on March 18, 2020 — during the COVID-19 lockdowns. Its registered address is a virtual office in London. Its directors and persons with significant control connect back to the Heficed/IPXO corporate constellation.

Why London? Because RIPE NCC (Réseaux IP Européens Network Coordination Centre) — the Regional Internet Registry for Europe, the Middle East, and parts of Central Asia — is headquartered in Amsterdam but operates under Dutch law with English as its working language. A UK entity, despite Brexit, maintains credibility in the European internet governance community. London is where the internet's old money lives — LINX (London Internet Exchange), the legacy ISPs, the standards bodies. Having a London entity signals establishment credibility that a Kaunas address cannot.

Layer 4: The Heficed Predecessor

Before IPXO, there was Heficed. Before Heficed, there was Digital Energy Technologies Ltd. The corporate lineage is:

Each rebrand coincided with a shift in business model — and a distancing from the abuse reports associated with the previous brand name. Digital Energy Technologies accumulated hosting abuse reports. Heficed accumulated IP leasing abuse reports. IPXO launched as the "clean" marketplace brand, leaving the accumulated negative reputation of Heficed behind while maintaining the same infrastructure, the same people, and the same IP address blocks.

Chapter 3: The Man From Heficed

Vincentas Grinius is the CEO and co-founder of IPXO. His LinkedIn describes him as a serial entrepreneur in the internet infrastructure space. He previously led Heficed and Digital Energy Technologies. He sits on RIPE NCC committees. He speaks at industry events. He has been quoted in press releases announcing IPXO's funding rounds and milestones.

Let's examine what is publicly known about the man behind 14 million IP addresses.

The Public Profile

Grinius presents himself as a technologist turned entrepreneur. His career arc follows a pattern common in Eastern European tech: technical education, early work in hosting/infrastructure, followed by a pivot to IP address management as the IPv4 exhaustion crisis made existing address blocks valuable assets. His LinkedIn shows connections across the Baltic tech ecosystem — Kaunas-based companies, Lithuanian tech accelerators, and the broader European hosting community.

He has been active in RIPE NCC governance. RIPE NCC is a member-based organization; any entity holding IP address resources in the RIPE region can participate in its governance. This means that the person whose companies lease IP addresses to customers — including customers who attack honeypots — also participates in setting the policies that govern how those IP addresses are allocated and managed.

The Governance Problem

This is not corruption. It is structural conflict of interest. The same dynamic exists across internet governance: the people who build the infrastructure also set its rules. The Internet Engineering Task Force (IETF) is dominated by engineers from the companies whose products implement the standards. RIPE NCC's governance is dominated by the LIRs (Local Internet Registries) who hold the resources. ARIN's governance is dominated by US ISPs and hosting companies.

But there's a difference between a large ISP like Deutsche Telekom sitting on RIPE governance (inevitable, given their resource holdings) and an IP address marketplace operator whose business model depends on fluidity of resource transfers sitting on governance. Deutsche Telekom wants stable, long-term allocations. An IP marketplace wants flexibility, easy transfers, and minimal oversight of how leased addresses are used. Their governance incentives point in opposite directions.

Chapter 4: Heficed → IPXO — The Rebrand That Changed Nothing

In 2021, Heficed became IPXO. The press releases spoke of "a new chapter," "marketplace innovation," and "IP address lifecycle management." The reality was simpler: the Heficed brand had accumulated too much baggage.

The Heficed Era

Heficed operated as both a hosting provider and an IP address leasing platform. This combination was problematic. As a hosting provider, Heficed operated servers, managed infrastructure, and dealt with abuse complaints about content hosted on those servers. As an IP address lessor, Heficed leased address blocks to other hosting providers, who then hosted their own content — and generated their own abuse.

The dual role created a convenient ambiguity. When abuse was reported on a Heficed IP, the response could be: "We don't host that content — we leased the address to another provider. Contact them." When the other provider was contacted, their response could be: "The address isn't ours — it's leased from Heficed. Contact them." The abuse report circulated between two entities, neither claiming responsibility, until the reporter gave up.

This pattern — known in the industry as "abuse report ping-pong" — is not unique to Heficed. It's endemic in the IP leasing market. But Heficed's scale made it more visible than most. By 2020, Heficed appeared regularly on abuse tracking databases. The brand was, in industry terms, "burned."

The Clean Slate Maneuver

The IPXO rebrand solved this problem entirely. A new company name. A new website. New marketing materials. New press coverage. The Google search results for "IPXO abuse" in 2021 returned zero relevant results. The Google search results for "Heficed abuse" returned thousands. Same company. Same people. Same IP blocks. Different searchability.

What Changed — and What Didn't

Chapter 5: The IP Leasing Machine

To understand why IPXO matters for threat intelligence, you need to understand the mechanics of IP address leasing — and why it's the perfect vehicle for enabling abuse while maintaining plausible deniability.

How IP Leasing Works

An IP address lease, in simplified terms, works like this:

The Due Diligence Problem

IPXO claims to perform due diligence on lessees. Its website mentions "IP abuse prevention" and "reputation monitoring." But the fundamental tension is this: thoroughness slows velocity, and velocity is revenue.

If IPXO processes 63,000 leases, each requiring genuine due diligence — background checks on the lessee, verification of use case, monitoring of announced routes, analysis of traffic patterns — the operational cost would be enormous. A single compliance analyst can handle perhaps 10-20 thorough reviews per day. At 63,000 leases, that's 3,150-6,300 analyst-days, or 12-25 full-time compliance staff working every business day of the year, assuming each lease needs only one review.

But leases aren't static. They need ongoing monitoring. A lessee who passes initial due diligence can start using the addresses for abuse the day after the check. Continuous monitoring of 14 million addresses for abuse indicators would require a security operations center rivaling those of major ISPs — an investment that would wipe out the margins of a marketplace business model.

The HBING Connection

Here's where IPXO's due diligence claims meet our honeypot data. Consider AS208949 — HBING LIMITED, registered in the UK:

Let's break down what the data shows:

The Geography Discrepancy

Notice something critical: all 5 IPs geolocate to the Netherlands. But the registrant data tells a different story:

• RDAP country for 102.129.200.x: US (registered via IPXO's Dallas address)
• RDAP country for 45.88.0.252: Poland
• RDAP country for 45.148.146.52: Poland
• RDAP country for 45.148.145.60: Belgium
• ASN registration country: United Kingdom
• Actual geolocation: Netherlands

Five countries involved — US, Poland, Belgium, UK, Netherlands — and the corporate entities span Lithuania, Texas, British Virgin Islands, and London. This is not a network. This is a jurisdictional labyrinth.

The IT WEB LTD / BVI Connection

Three of the five HBING IPs list their RDAP organization as lir-vg-itweb-1-MNT, with the abuse email abuse.webltd@gmail.com and a phone number +14708099233 (a US number, area code 470 = Atlanta, Georgia). The entity "IT WEB LTD" is registered in the British Virgin Islands.

The BVI is the world's most popular offshore incorporation jurisdiction, with more registered companies than residents. BVI corporate registrations do not require disclosure of beneficial ownership, directors, or financial statements. A BVI company operating IP address resources through a UK-registered ASN, managed via IPXO's Lithuanian platform, with addresses geolocating to the Netherlands — this is jurisdictional complexity that serves no legitimate technical purpose.

Chapter 6: The RIPE Committee Problem

RIPE NCC is not a regulator. This fact — stated repeatedly by RIPE NCC itself — is the foundation of both its strength and its vulnerability. RIPE NCC is a registry: it records who holds what IP addresses, maintains the technical databases that make internet routing work, and facilitates community governance of numbering resources. It does not police how those resources are used.

This distinction matters enormously for the IP leasing market. If RIPE NCC were a regulator, it could revoke allocations from entities that facilitated abuse. It could impose due diligence requirements on resource transfers. It could audit marketplace operators like IPXO. But as a registry, it does none of these things — because its community has not reached consensus that it should.

The Governance Structure

RIPE NCC governance operates through several mechanisms:

The critical layer is the Working Groups. This is where IP address allocation policy, transfer policy, and abuse handling guidelines are developed. Working groups are open — anyone can participate. They operate on "rough consensus" — no formal voting, but rather the chairs' assessment of the room's opinion.

This openness is both RIPE's greatest democratic achievement and its greatest vulnerability to capture. When an IP leasing marketplace operator participates consistently in working groups that discuss transfer policy, their voice carries weight not because of a formal vote but because of persistent presence. Most RIPE members — small ISPs, university networks, research institutes — don't have the resources or interest to participate in policy discussions about IP address markets. The marketplace operators do. Their livelihoods depend on the outcomes.

The Specific Policy Gap

RIPE's Transfer Policy (RIPE-786) governs permanent transfers of IP address resources. It requires documentation, verification of the receiving entity's need, and a cooling-off period. These requirements exist because permanent transfers were identified as a vector for address space fraud.

But IP leasing — temporary delegation of address usage rights — operates largely outside this policy framework. A temporary delegation doesn't trigger transfer policy requirements because technically, no transfer occurs. The addresses remain allocated to the original holder. What changes is the routing authorization — the RIPE database objects that tell the global routing system "this ASN is authorized to announce this prefix."

This policy gap means that IPXO can facilitate thousands of temporary delegations per month with zero RIPE NCC oversight of the individual transactions. The only point of governance contact is the RIPE member agreement itself, which requires members to maintain accurate database records. Whether a member is leasing its addresses to bulletproof operators or legitimate cloud providers is, from RIPE NCC's perspective, outside its mandate.

Chapter 7: The ISO 27001 Shield

IPXO holds ISO 27001 certification. This is prominently displayed on its website, referenced in press releases, and cited in response to questions about security and due diligence. ISO 27001 has become the cybersecurity equivalent of a doctor's diploma on the wall — it signals competence to non-experts and provides comfort to business partners who lack the ability to independently assess security practices.

But ISO 27001 does not certify what most people think it certifies.

What ISO 27001 Actually Certifies

ISO 27001 certifies that an organization has an Information Security Management System (ISMS). Specifically, it certifies that:

• The organization has identified its information security risks
• The organization has documented policies and procedures to manage those risks
• The organization has implemented controls from Annex A (a menu of 114 possible controls)
• The organization conducts internal audits and management reviews
• The organization pursues continuous improvement

What ISO 27001 does not certify:

• That the organization's products or services are secure
• That the organization's customers are legitimate
• That the organization's IP addresses are not being used for abuse
• That the organization's due diligence on lessees is effective
• That the organization's abuse response is timely or adequate
• That the organization is not facilitating cybercrime through its marketplace

The critical distinction: ISO 27001 certifies process, not outcomes. You can have a perfectly certified ISMS that documents, reviews, and continuously improves a due diligence process that is fundamentally inadequate. As long as the process exists, is documented, is reviewed, and is improved (even marginally), the certification holds.

The Certification Scope Question

Every ISO 27001 certification has a defined scope — the specific processes, systems, and services covered by the certification. The scope statement determines what the auditor examines. What falls outside the scope is not assessed.

For an IP address marketplace, the relevant question is: does the certification scope include lessee due diligence? If the scope is "management of the IPXO marketplace platform" — the servers, the databases, the internal processes — then the certification means IPXO keeps its own systems secure. It says nothing about whether the IP addresses flowing through the marketplace are used securely by the lessees.

This is like certifying that a gun shop has excellent inventory management while saying nothing about whether it performs background checks on buyers.

Chapter 8: The PIO-HBING Pipeline — When Leased IPs Attack

The theory is one thing. The evidence is another. Let's look at what our honeypot actually recorded from IP addresses connected to the IPXO ecosystem.

The HBING Network in Detail

AS208949 (HBING LIMITED) is a UK-registered company (Companies House 13836998) with its registered address at 124 City Road, London, EC1V 2NX — a generic company formation agency address used by thousands of shell and nominee companies. Its RIPE record was created on April 2, 2023, making it barely three years old. Its abuse contact is hbinglimited@mail.com — a free email address from mail.com, which is itself a significant indicator.

HBING LIMITED announces 10 IPv4 prefixes via BGP — a modest network, but the prefixes reveal something interesting:

A UK company, three years old, announcing IP space from Africa, Europe, and North America — regions governed by three different RIRs (AFRINIC, RIPE, ARIN). This is not how a legitimate ISP operates. Legitimate ISPs typically have IP allocations from their home region's RIR. Acquiring address space from three different RIRs suggests systematic purchase or lease of address blocks on the secondary market — exactly the kind of activity that IP leasing marketplaces like IPXO facilitate.

The Hitrow Discovery

Our active reconnaissance scans of HBING infrastructure revealed something unexpected. The IP 102.129.200.117 — our highest-threat HBING node (threat score 93) — runs a web server on ports 80 and 8080 serving software called Hitrow 1.1.43, with the page title "Welcome to Hitrow."

Hitrow is not a household name. It appears to be a control panel or management interface for IP-based services. Its presence on an IP that attacked our honeypot 42 times suggests that this is not a compromised residential router or a misconfigured cloud instance — this is purpose-built infrastructure for IP-based operations.

The Passive DNS Trail

Passive DNS resolution for the HBING IPs reveals hostnames that add another layer to the story:

• 102.129.200.117 → client.nodomain.vip, mag-tv.net, vodnew.nodomain.vip
• 45.88.0.252 → s120.likea8bitboss.xyz
• 45.148.145.60 → 45-148-145-60.ipv4.staticdns1.io

The domains tell a story: nodomain.vip is a domain parking service. mag-tv.net and vodnew.nodomain.vip suggest IPTV or streaming content — a common use case for IP addresses leased to avoid geolocation enforcement. likea8bitboss.xyz is a domain name that doesn't inspire confidence in legitimate business operations. staticdns1.io is a generic reverse DNS service used by hosting providers who haven't configured proper PTR records.

The libssh2 Fingerprint

All five HBING IPs share the same SSH client fingerprint: HASSH 14b2ddda386a4d10, identified as libssh2_1.11.0. This fingerprint appears in our database across 628 IPs in 48 countries — it's part of a massive scanning campaign using the libssh2 library.

The shared fingerprint means one of two things: either all five HBING IPs are using the same scanning toolkit (suggesting central coordination), or the HBING infrastructure was compromised and co-opted into a larger botnet. Given that the IPs run Hitrow management panels and share the same corporate infrastructure, central coordination is the more parsimonious explanation.

Chapter 9: The Numbers That Matter

Let's talk money. The IP address market is one of the internet's most opaque financial ecosystems, but enough data exists to reconstruct the economics — and they are staggering.

The IPv4 Exhaustion Premium

IPv4 address exhaustion is, by any measure, one of the most foreseeable infrastructure crises in computing history. Engineers have been warning about it since the early 1990s. IPv6 was designed specifically to solve it. The exhaustion timeline was:

After exhaustion, new allocations effectively stopped (only tiny fragments remain). Any organization needing IPv4 addresses must now acquire them on the secondary market — through purchases or leases. This transformed IPv4 addresses from free administrative resources into tradeable financial assets.

The Price History

The price trajectory tells the story of a market bubble and its partial deflation:

Sources: IPXO Market Stats (June 18, 2026), Brander Group market analysis.

IPXO's Revenue Model

IPXO's revenue comes from commissions on leases. With approximately 6 million IPs actively leased on the platform at ~$0.35/IP/month, the gross lease revenue flowing through the platform is approximately:

This is conservative. It doesn't include IPAM (IP Address Management) software fees, premium services, or revenue from the transfer brokerage side of the business. The $55M "paid to IP owners" figure, spread over approximately 4 years of operation, is consistent with this revenue model (the commission sits on top of the $55M).

The Global Market

IPXO is the largest player, but the total IP leasing market is bigger. Academic research (CAIDA, 2024) found that 4.1% of all advertised IPv4 prefixes are leased — approximately 45+ million IP addresses. At current lease rates:

Who Pays for Abuse?

Here's the critical economic insight: the costs of IP address abuse are externalized. The IP owner earns lease income. IPXO earns commission. The lessee earns whatever revenue their operations generate (legitimate or otherwise). But the costs — abuse reports, blocklisting, credential theft, botnet damage — are borne by the targets of the abuse, by ISPs who process abuse reports, by security researchers who track the threats, and by the internet community at large.

This is a textbook negative externality. The IP leasing market generates private profits while imposing public costs. No mechanism exists to price the externality — there's no "pollution tax" on IP address abuse. The closest equivalent, Spamhaus blocklisting, imposes costs on the IP owner (reduced reputation of their address block) but does not impose costs on the marketplace operator (IPXO's platform reputation is separate from the reputation of individual leased blocks).

Chapter 10: The Uncomfortable Questions

Every dossier in this series arrives at a point where the evidence demands questions that polite industry discourse avoids. The Lithuanian Connection is no different. The evidence has been presented. The corporate structures have been mapped. The honeypot data has been analyzed. Now we ask the questions that matter.

Chapter 11: Final Assessment — The Architecture of Plausible Deniability

This dossier has traced a single thread — IPXO UAB and its role in the IP address leasing ecosystem — from a Kaunas office to our honeypot's log files. The journey passed through corporate structures spanning five jurisdictions, governance bodies whose policies are shaped by the entities they govern, certification frameworks that certify process but not outcomes, and an economic model where abuse is a revenue driver disguised as a compliance problem.

What We Found

What We Didn't Find

This dossier does not prove that IPXO is a criminal organization. It does not prove that Vincentas Grinius or any IPXO employee knowingly facilitates cybercrime. It does not prove that HBING LIMITED is an IPXO subsidiary. What it proves is that the IP leasing marketplace, as IPXO has built and operates it, creates the conditions under which abuse flourishes — and that the incentives of the marketplace align with perpetuating, not preventing, that abuse.

The Lithuanian connection is not a scandal. It's a structure. And structures, unlike scandals, don't resolve themselves when exposed. They continue operating, invisibly, as long as the incentives that created them remain unchanged.

Recommendations

Sources & Methodology

The Phantom ASN Ecosystem Series

This dossier is part of an independent threat intelligence research project. All findings are based on publicly available data, honeypot observations, and open-source intelligence. No classified or proprietary data was used. Published at shuffle-on.com/threat-intel.