On this page
The RIPE NCC ran out of IPv4 addresses in November 2019. A network that needs more IPv4 now buys it, or leases it from a holder with addresses to spare. IPXO is one of the largest leasing marketplaces: a 2024 study of leasing, Sublet Your Subnet, found it among the top three leasing facilitators in each of the RIPE, ARIN and APNIC regions. The same study found leased prefixes about five times as likely as other prefixes to be announced by a network Spamhaus lists as abusive.
That measures abuse reports. What leased blocks are used for has had less attention, so we matched IPXO's blocks, address by address, against our VPN, hosting and residential proxy data as built on October 30, 2026.
Finding IPXO's blocks in whois
A block leased through IPXO can show it in whois: the record's netname contains IPXO. On October 30 the registries held 5,655 IPv4 records like that, 2,711 of them named just IPXO: 3,180 at RIPE, 2,333 at ARIN, 126 at APNIC, 14 at AFRINIC and 2 at LACNIC. Merged where they overlap or touch, they come to 2,973 blocks and 11,437,055 addresses. A netname search for IPXO also finds Ipxon Networks, a separate Latin American network operator, so we left out names that continue with IPXON.
7,655,678 of those addresses, 66.9%, were announced in BGP that day. The counts below cover only announced space. The internet figures are the same counts over all 3,140,600,240 announced IPv4 addresses, and the leased rate is a count's share of the blocks over its share of the internet.
What runs in leased space
| Announced IPv4 | In IPXO's blocks | Share of the blocks | Whole internet | Share of the internet | Leased rate vs. internet |
|---|---|---|---|---|---|
| Consumer VPN servers | 111,799 | 1.46% | 3,335,080 | 0.106% | 13.7x |
| Any VPN address | 156,300 | 2.04% | 16,273,315 | 0.52% | 3.9x |
| Hosting IP | 3,082,668 | 40.3% | 467,371,703 | 14.9% | 2.7x |
| Residential proxy exits, 90 days | 157,415 | 2.06% | 68,508,100 | 2.18% | 0.94x |
Consumer VPN servers are VPN IP's addresses of named consumer services. Any VPN address adds the enterprise gateway vendors VPN IP also lists, and VPN servers not yet tied to a service.
The 111,799 consumer VPN addresses come from 106 services. They're 3.35% of all announced consumer VPN addresses, in blocks that hold 0.24% of announced IPv4. A handful of large services carry most of it, and for 11 of the 106, a quarter or more of their addresses are in IPXO's blocks.
The Hosting IP row is Hosting IP at every confidence level. Residential proxy exits, from Residential Proxy IP's 90-day window, are the one row near the internet's rate.
Who announces it
1,797 networks announced the addresses in IPXO's blocks. Networks our ASN database types as ISPs announced 58.5% of them, hosting networks 36.2% and businesses 5.2%.
The VPN servers are on the hosting side. Hosting networks announce 88.3% of the consumer VPN addresses in IPXO's blocks. On the 2,770,942 leased addresses hosting networks announce, consumer VPN servers are 3.56%. On the 4,477,953 that ISPs announce, residential proxy exits are 2.26%, VPN addresses of any kind 0.80% and Hosting IP 12.1%.
What it means for an IP check
Leasing separates three things a reputation check tends to treat as one: the block's record in whois, the network that announces it, and whoever runs the servers in it. Neither the whois record nor the network's name says that a /24 inside them is a VPN service's exit space. A block also outlives its lease: when one lessee leaves, the next can inherit whatever blocklist entries the last one earned.
So check the address, not the block's owner: VPN IP lists the VPN servers in these blocks address by address. IPXO publishes how it handles abuse in its blocks.
Finding leased space in our data
IP Whois has every registry record, with its netname in id and its holder in name. A search of id for IPXO, leaving out IPXON, gives the IPXO-named set. IP Abuse Contact has each range's abuse mailbox in email, abuse@ipxo.com among them; our post on abuse contacts covers who answers those mailboxes. IP ASN and ASN give the network that announces each range and its type. IP Company names the organization that uses it.
How we measured
Everything here is IPv4, as built on October 30, 2026. The IPXO-named set is every IPv4 record in IP Whois whose netname contains IPXO, except names that continue with IPXON. Its ranges were merged where they overlap, then intersected address by address with the announced space in IP ASN.
Consumer VPN servers are VPN IP's addresses with a named service, leaving out the enterprise gateway vendors our VPN Provider catalog flags with enterprise_vpn. Hosting IP counts every confidence level. Residential proxy exits are Residential Proxy IP's 90-day window. Each figure counts distinct addresses, and each internet figure is the same count over all announced IPv4. Network types are ASN's.
IP Whois and IP Abuse Contact come as gzipped CSV and MMDB, and their docs list the columns: IP Whois, IP Abuse Contact. To license them, see pricing or talk to us.
