TI-2026-044C — The Nordic Paradox Part C: The Baltic Bridge — IPXO, Lithuania, and the IP Laundering Capital of Europe

Series: The Nordic Paradox

Executive Summary

The first two parts of this series described the Swedish side of the paradox: a privacy-hosting culture with ideological legitimacy and a commercial hosting market with unusually high-risk nodes. Part C moves to the layer that makes both environments more durable than they appear from the outside: the address market.

The central actor is IPXO, a Lithuanian IP marketplace headquartered in Kaunas. According to the investigation evidence, IPXO publicly claims management of 14 million-plus IPv4 addresses, more than $55 million paid to IP owners, and more than 63,000 completed leases. Those numbers are large enough to change the analytical category. This is not small-scale brokerage. It is industrial infrastructure for moving address reputation around as a tradable asset. [Evidence: "IPXO public claims on scale and payouts"]

That matters because public reputation systems, blocklists, and even many investigative workflows still treat IP space as if ownership and operational control were relatively stable. RIPE NCC can register formal resource holders and local internet registries. It cannot see real-time downstream leasing, subleasing, or rapid reassignment inside marketplaces. The investigation identifies that structural blind spot directly: IPXO operates inside the RIPE ecosystem while benefiting from the fact that real-time downstream movement is not publicly legible at the same speed as the market itself. [Finding: "RIPE NCC Oversight Gap"; Connection: IPXO -> RIPE NCC, operates_under]

In practical terms, this means an operator can acquire clean or less-burned address space, use it for a campaign window, and rotate again before blacklist propagation catches up. The mechanism is not magic. It is leasing. It is inventory management. It is a market for reputational reset. That is why this dossier uses the phrase IP laundering. The value is not the packets alone. The value is the temporary cleanliness of the address itself.

Lithuania's role is disproportionate. A country of roughly 2.8 million people sits at the center of a marketplace structure managing many multiples of that population in IPv4 quantity. The investigation does not argue that every Lithuanian company in the ecosystem is malicious. It does show that Lithuania has become a specialized jurisdiction for IP brokerage and lease-mediated opacity. [Finding 1; Evidence: "RIPE registration disproportionality"]

The Lithuanian layer also intersects with the region's privacy economy more broadly. The investigation links Tesonet and Nord Security through overlapping personnel, office presence in Vilnius, and the historical path from Panama-registered Tefincom S.A. to Lithuanian redomiciliation. It cites the 2018 Proton Technologies AG v. Tesonet UAB dispute as a legal anchor around allegations of scraping and adversarial data acquisition. None of this proves that VPN companies and IP marketplaces are the same business. It does show that the same national ecosystem simultaneously incubated privacy products, data-arbitrage capability, and IP-market infrastructure. [Evidence: "Tesonet-NordVPN employee and office overlap"; "Proton Technologies AG vs Tesonet UAB (2018)"]

This is the Baltic bridge of the series title. Sweden supplies legitimacy and resilient hosting culture. Lithuania supplies liquidity in address space. Germany and adjacent jurisdictions supply physical bulletproof infrastructure such as PIO-Hosting / XSServer, with the investigation describing the broader regional chain as a supply corridor rather than isolated national anomalies. [Finding 2; Evidence: "Lithuanian-sourced addressing in bulletproof hosting"]

Why 14 Million IPv4 Addresses Changes the Story

Address space is usually treated as background infrastructure. That is a mistake. In hostile operations, IP reputation is operational capital. A clean address lasts longer against blocklists. A fresh subnet delays detection heuristics. A newly leased range can buy enough time for credential stuffing, scanning, spam delivery, or relay operations before defenders catch up.

This is why IPXO's public scale claims matter so much. Fourteen million-plus IPv4 addresses, more than $55 million paid out, and more than 63,000 leases means the company is not simply matching a few address owners with a few enterprise tenants. It is industrializing a market in which address space can be monetized, repackaged, and rapidly reassigned. [Evidence: "IPXO public claims on scale and payouts"]

The investigation's third finding states the point clearly: the same model marketed as monetization for idle IPv4 space provides the economic substrate for abuse infrastructure. That sentence should be read literally. If address owners are paid at scale for leasing unused resources, a marketplace has strong incentives to maximize liquidity and occupancy. Abuse prevention becomes a friction cost. Every additional check reduces throughput. Every careful review slows turnover. [Finding 3]

None of this requires a marketplace to openly court criminal customers. The structure itself is enough. A marketplace can advertise efficiency, flexibility, and better returns to owners while still making life easier for hostile operators. If the market is fast and the public attribution layer is slow, abuse acquires a natural advantage.

That is the core of the laundering analogy. Traditional money laundering hides origin by moving value through intermediaries and transformations until the path is difficult to reconstruct. IP laundering hides operational continuity by moving campaigns through leased or subleased address space faster than reputation systems can stabilize attribution. The value is not anonymity in a pure sense. The value is time.

The investigation's infrastructure list is modest in item count but strong in signal. It includes 147.90.234.117 and 147.90.234.115 on AS27284, described as IPXO-linked marketplace infrastructure, with threat scores 60.0 and 53.4; 5.255.101.10 on AS60404, described as Nord Security-linked infrastructure, with threat 48.8; and 173.239.205.23 on AS137409, described as Tesonet-linked infrastructure, with threat 10.0. These are not proof that each company is operating maliciously. They do show that Lithuanian-linked ecosystem nodes are not abstract corporate paperwork; they surface in observable infrastructure. [Investigation infrastructure for TI-2026-044C]

When a country of 2.8 million becomes a hub for managing 14 million-plus IPv4 addresses, it is no longer enough to say the market is merely efficient. The scale itself creates geopolitical relevance. Lithuania is not only participating in the internet's address economy. It is shaping the conditions under which hostile operators can rent plausible new identities.

RIPE's Blind Spot Is the Market's Opportunity

The investigation's fourth finding is the most structurally important one in the dossier: RIPE NCC can register formal resource holders, but it cannot observe real-time downstream leasing, subleasing, or rapid reassignment inside marketplaces. That is not a criticism of RIPE as a regulator failing to do its job. It is a description of a governance boundary. RIR systems were built to record allocations and delegations, not to function as a live surveillance layer for every commercial movement of address space. [Finding 4; Actor data: RIPE NCC]

But that governance boundary is exactly what sophisticated operators exploit. When defenders investigate a suspicious IP, they often start with ASN ownership, whois, RIR records, and public routing context. Those layers can reveal who formally holds resources or which upstream appears visible. What they do not reliably reveal is the full chain of downstream control at the moment of abuse. A marketplace intermediary can stand between the resource holder and the user. A reseller can stand between the marketplace and the downstream tenant. A campaign can end before the paperwork trail becomes legible.

The investigation phrases this as structural opacity, and that is the correct term. The opacity is not necessarily produced by deception. It is produced by market design. High-volume leasing plus incomplete real-time visibility equals lagged attribution. [Finding 4]

This lag matters more now because IPv4 scarcity has made addresses economically valuable. Scarcity pushes owners to monetize. Monetization pushes marketplaces to scale. Scale pushes automation. Automation pushes faster turnover. Faster turnover shortens the useful life of public reputation signals.

That sequence explains why Lithuania's market role is so consequential for threat operations even if many participants are entirely legitimate. The more mature the leasing market becomes, the easier it is for bad actors to hide among ordinary commercial movement. Abuse prevention has to outrun an economy, not merely an attacker.

This is also why country-level reputational narratives break down. A Dutch, German, Swedish, or American IP can be operationally tied to Lithuanian brokerage or downstream marketplace movement without the country of the IP itself revealing that chain. The address becomes a temporary costume.

The Baltic Corridor Supply Chain

Part A showed Sweden's privacy-hosting architecture. Part B showed Sweden's commercial hosting density. Part C shows the supply chain beneath both. The investigation's second finding describes a Baltic corridor in which Lithuania supplies the address marketplace and leasing layer, Sweden supplies privacy-hosting legitimacy, and Germany supplies physical bulletproof infrastructure such as PIO-Hosting / XSServer. [Finding 2; Evidence: "Lithuanian-sourced addressing in bulletproof hosting"]

That formulation matters because it moves analysis away from national moralism and toward operational specialization. Different jurisdictions do different jobs in the same ecosystem. Sweden does not need to operate an address marketplace as aggressive as Lithuania's if it can benefit from upstream liquidity. Germany does not need Sweden's privacy ideology if it can consume Lithuanian-sourced address flexibility. The system becomes modular.

The connection between IPXO and PIO-Hosting / XSServer is explicit in the investigation. It states that marketplace access provides clean-reputation address acquisition and rapid rotation options for bulletproof hosting operators. The importance of that relationship is not only that a known high-risk hosting environment can obtain addresses through Lithuanian-linked channels. It is that the market provides a repeatable method for doing so. [Connection: IPXO -> PIO-Hosting / XSServer, enables]

This is the difference between static attribution and supply-chain analysis. Static attribution asks, "Who owns this IP?" Supply-chain analysis asks, "Which markets make this IP rentable, replaceable, and operationally useful to this type of actor?" The second question is harder and more important.

The investigation also notes geographic rotation toward Baltic jurisdictions in prior dossier work, specifically TI-2026-026N. That matters because it suggests the Lithuanian pattern is not an isolated observation attached only to IPXO. It reflects a broader movement toward intermediated jurisdictions where ownership, routing, and leasing layers can be separated more effectively. [Evidence: "Geographic rotation toward Baltic jurisdictions"]

Once the regional corridor is visible, the paradox from Parts A and B changes meaning. Sweden's problem is not only that it hosts contentious or risky infrastructure. It is that it can become the respectable front end for address-market dynamics occurring elsewhere in the region.

Tesonet, Nord Security, and the Privacy Economy's Lithuanian Center

The investigation's sixth finding is deliberately phrased with caution: NordVPN emerged through Tesonet-linked personnel, a Panama shell registration path, and later Lithuanian redomiciliation. The evidence cites overlapping personnel, shared office presence in Vilnius, and tech-press reporting connecting Tesonet with the early NordVPN buildout. It also cites the 2018 Proton Technologies AG v. Tesonet UAB dispute as a legal anchor around allegations of scraping and unfair competition. [Finding 6; Evidence: "Tesonet-NordVPN employee and office overlap"; "Proton Technologies AG vs Tesonet UAB (2018)"]

Several distinctions are important here. First, overlap is not identity. Shared offices, personnel, and ecosystem membership do not mean every entity in the cluster shares the same governance or intent. Second, allegations in litigation are allegations, not findings of guilt by this dossier. Third, the relevance here is structural: the same national ecosystem that became globally trusted for privacy-branded products also incubated data-extraction controversy and high-scale address-market infrastructure.

That structural observation is enough. The privacy economy is not cleanly separable from the address economy. VPN brands need networks, providers, servers, jurisdictions, and address continuity. IP marketplaces monetize those same layers from the opposite direction. The Lithuanian ecosystem sits at the intersection of both.

The infrastructure list reinforces the link symbolically if not conclusively: 5.255.101.10 is labeled Nord Security-linked infrastructure, while 173.239.205.23 is labeled Tesonet-linked infrastructure. Their presence in the investigation does not imply malicious operation by either company. It does show that the ecosystem is not theoretical. The privacy brands and the market intermediaries occupy overlapping infrastructural space. [Investigation infrastructure]

This is why Lithuania deserves attention in a series about the Nordic paradox even though Lithuania is not Nordic in the strict sense. It is part of the same operational geography. The corridor runs through the Baltics into Scandinavia and back into the wider European hosting market.

IP Leasing as Bulletproof Enabler

The fifth finding in the dossier is the most operationally direct: rapid lease-and-return cycles allow hostile operators to stay ahead of blacklist propagation, preserving clean address reputation long enough for each campaign window and then discarding the indicators. That is the core abuse-enabling function of the marketplace model. [Finding 5]

Traditional bulletproof hosting focused on permissive jurisdictions, tolerant operators, or hidden ownership. Marketplace leasing adds a new capability: agile identity rotation without having to own the resource base permanently. A campaign can rent reputation instead of building it. Once defenders respond, the campaign can move.

This matters because many defensive systems still assume that reputational decay will eventually punish bad infrastructure. That assumption remains true, but the punishment arrives later than it used to, and the market makes waiting less expensive. If a hostile operator can cycle through newly leased space at scale, reputation becomes a consumable input, not a durable liability.

The market's success metrics make the problem worse. More leases completed means more movement. More movement means more ambiguity. More ambiguity means more places for abuse to hide among legitimate commercial transactions. The same features that make the marketplace attractive to ordinary customers—speed, flexibility, utilization, lower idle cost—also make it attractive to operators who want their attribution trail to expire quickly.

This is why the dossier's language is unforgiving. The issue is not whether leasing can be used legitimately. Of course it can. The issue is that, at this scale and with this visibility gap, the market is structurally aligned with hostile needs.

FINDINGS

1. Lithuania has become a disproportionate hub for address-market power.

A country of 2.8 million sits at the center of a marketplace ecosystem handling 14 million-plus IPv4 addresses. [Finding 1]

2. IPXO's public scale creates industrial capacity for reputation turnover.

More than $55 million paid and 63,000-plus leases is not boutique brokerage. It is infrastructure. [Finding 3]

3. RIPE cannot see the market at the speed the market moves.

That governance gap is the mechanism by which downstream opacity persists. [Finding 4]

4. IP leasing is not neutral in operational effect.

Rapid lease-and-return cycles directly help operators stay ahead of blacklist propagation. [Finding 5]

5. The Baltic corridor is regional and modular.

Lithuania supplies address liquidity, Sweden supplies legitimacy, and Germany supplies physical bulletproof hosting nodes. [Finding 2]

6. Lithuania's privacy-tech ecosystem overlaps with the same environment that produced address-market power.

Tesonet and Nord Security links matter because they show privacy brands and infrastructure arbitrage grew in the same national space. [Finding 6]

Key Evidence Tables

Lithuanian-linked infrastructure in the investigation

Baltic bridge supply-chain map

EVIDENCE

1. IPXO scale: public claims of 14M+ IPv4 addresses, $55M+ paid, and 63K+ leases establish industrial market scale. [Source: investigation evidence, "IPXO public claims on scale and payouts"]
2. RIPE visibility gap: the investigation explicitly states that RIPE cannot track real-time downstream leasing and reassignment, creating structural opacity. [Source: investigation finding, "RIPE NCC Oversight Gap"]
3. Lithuanian disproportionality: RIPE registration patterns show Lithuanian entities managing address resources disproportionate to national population size. [Source: investigation evidence, "RIPE registration disproportionality"]
4. Bulletproof-hosting linkage: prior dossier work and this investigation connect Lithuanian marketplace structures to PIO-Hosting / XSServer and similar consumption layers. [Source: investigation evidence, "Lithuanian-sourced addressing in bulletproof hosting"]
5. Regional rotation: prior work recorded movement toward Baltic-linked intermediaries, reinforcing the idea that Lithuania's role is systemic rather than anecdotal. [Source: investigation evidence, "Geographic rotation toward Baltic jurisdictions"]
6. Tesonet/Nord overlap: shared personnel, office presence, and public reporting connect Tesonet to NordVPN's early path and to Nord Security's later Lithuanian center of gravity. [Source: investigation evidence, "Tesonet-NordVPN employee and office overlap"]
7. Legal controversy: the 2018 Proton Technologies AG v. Tesonet UAB dispute serves as a documented point of contention around allegations of scraping and unfair competition. [Source: investigation evidence, "Proton Technologies AG vs Tesonet UAB (2018)"]
8. Observable ecosystem nodes: the investigation's infrastructure list includes IPXO-linked, Nord Security-linked, and Tesonet-linked addresses, confirming that the ecosystem is represented in live infrastructure mapping rather than only in corporate narratives. [Source: investigation infrastructure for TI-2026-044C]

Questions That Remain

1. How much abusive traffic moves through IP-marketplace churn before blocklists catch up? The mechanism is clear; the exact time advantage remains to be quantified.
2. What proportion of IPXO's leased inventory is resold again through downstream intermediaries? That determines how many attribution layers defenders must cross in practice.
3. What compliance controls, if any, distinguish marketplaces that merely enable reputation turnover from those actively reducing it? Public scale claims tell us about growth, not governance.
4. How often do bulletproof or criminal-adjacent operators move between Lithuanian-linked marketplace space and Swedish-hosted infrastructure? That is the corridor's practical frequency question.
5. What parts of the Tesonet/Nord ecosystem overlap are historical, and what parts remain operationally relevant now? The investigation shows continuity, but temporal boundaries matter.
6. Can public RIR data models be adapted to expose downstream leasing movement without destroying legitimate commercial privacy? This is a policy question as much as a technical one.
7. How many European abuse investigations fail at the point where formal resource ownership stops and real-time downstream control begins? That is the blind-spot measurement the industry still lacks.

Bridge to Part D

Part C identifies the address market that feeds the paradox. If Sweden offers respectable hosting and Lithuania offers liquid reputation, the next question is how that infrastructure is turned into everyday privacy plumbing for millions of users. That brings the series to the VPN and backbone layer.

TI-2026-044D, "The Backbone," examines M247, NordVPN, and Mullvad—where trusted privacy brands, rented transport, and attack-relevant infrastructure meet in the same routing fabric. Parts A through C show the architecture, the commercial host layer, and the address market. Part D follows the traffic through the pipes.