# IPv4 leasing: VPN servers run 14x denser in IPXO's leased blocks

We matched IPXO's leased IPv4 blocks against VPN, hosting and residential proxy data: consumer VPN servers sit there at 14 times the internet's rate.

The RIPE NCC [ran out of IPv4 addresses in November 2019](https://www.ripe.net/about-us/news/the-ripe-ncc-has-run-out-of-ipv4-addresses/). A network that needs more IPv4 now buys it, or leases it from a holder with addresses to spare. IPXO is one of the largest leasing marketplaces: a 2024 study of leasing, [Sublet Your Subnet](https://www.caida.org/catalog/papers/2024_sublet_your_subnet/sublet_your_subnet.pdf), found it among the top three leasing facilitators in each of the RIPE, ARIN and APNIC regions. The same study found leased prefixes about five times as likely as other prefixes to be announced by a network Spamhaus lists as abusive.

That measures abuse reports. What leased blocks are used for has had less attention, so we matched IPXO's blocks, address by address, against our VPN, hosting and residential proxy data as built on October 30, 2026.

## Finding IPXO's blocks in whois

A block leased through IPXO can show it in whois: the record's netname contains `IPXO`. On October 30 the registries held 5,655 IPv4 records like that, 2,711 of them named just `IPXO`: 3,180 at RIPE, 2,333 at ARIN, 126 at APNIC, 14 at AFRINIC and 2 at LACNIC. Merged where they overlap or touch, they come to 2,973 blocks and 11,437,055 addresses. A netname search for IPXO also finds Ipxon Networks, a separate Latin American network operator, so we left out names that continue with `IPXON`.

7,655,678 of those addresses, 66.9%, were announced in BGP that day. The counts below cover only announced space. The internet figures are the same counts over all 3,140,600,240 announced IPv4 addresses, and the leased rate is a count's share of the blocks over its share of the internet.

## What runs in leased space

| Announced IPv4 | In IPXO's blocks | Share of the blocks | Whole internet | Share of the internet | Leased rate vs. internet |
|---|---|---|---|---|---|
| Consumer VPN servers | 111,799 | 1.46% | 3,335,080 | 0.106% | 13.7x |
| Any VPN address | 156,300 | 2.04% | 16,273,315 | 0.52% | 3.9x |
| Hosting IP | 3,082,668 | 40.3% | 467,371,703 | 14.9% | 2.7x |
| Residential proxy exits, 90 days | 157,415 | 2.06% | 68,508,100 | 2.18% | 0.94x |

Consumer VPN servers are [VPN IP](https://internetdata.io/databases/vpn-ip)'s addresses of named consumer services. Any VPN address adds the enterprise gateway vendors VPN IP also lists, and VPN servers not yet tied to a service.

The 111,799 consumer VPN addresses come from 106 services. They're 3.35% of all announced consumer VPN addresses, in blocks that hold 0.24% of announced IPv4. A handful of large services carry most of it, and for 11 of the 106, a quarter or more of their addresses are in IPXO's blocks.

The Hosting IP row is [Hosting IP](https://internetdata.io/databases/hosting-ip) at every confidence level. Residential proxy exits, from [Residential Proxy IP](https://internetdata.io/databases/residential-proxy-ip)'s 90-day window, are the one row near the internet's rate.

## Who announces it

1,797 networks announced the addresses in IPXO's blocks. Networks our [ASN](https://internetdata.io/databases/asn) database types as ISPs announced 58.5% of them, hosting networks 36.2% and businesses 5.2%.

The VPN servers are on the hosting side. Hosting networks announce 88.3% of the consumer VPN addresses in IPXO's blocks. On the 2,770,942 leased addresses hosting networks announce, consumer VPN servers are 3.56%. On the 4,477,953 that ISPs announce, residential proxy exits are 2.26%, VPN addresses of any kind 0.80% and Hosting IP 12.1%.

## What it means for an IP check

Leasing separates three things a reputation check tends to treat as one: the block's record in whois, the network that announces it, and whoever runs the servers in it. Neither the whois record nor the network's name says that a /24 inside them is a VPN service's exit space. A block also outlives its lease: when one lessee leaves, the next can inherit whatever blocklist entries the last one earned.

So check the address, not the block's owner: [VPN IP](https://internetdata.io/databases/vpn-ip) lists the VPN servers in these blocks address by address. IPXO publishes [how it handles abuse](https://www.ipxo.com/blog/how-ipxo-handles-abuse/) in its blocks.

## Finding leased space in our data

[IP Whois](https://internetdata.io/databases/ip-whois) has every registry record, with its netname in `id` and its holder in `name`. A search of `id` for IPXO, leaving out IPXON, gives the IPXO-named set. [IP Abuse Contact](https://internetdata.io/databases/ip-abuse-contact) has each range's abuse mailbox in `email`, `abuse@ipxo.com` among them; [our post on abuse contacts](https://internetdata.io/blog/ip-abuse-contact) covers who answers those mailboxes. [IP ASN](https://internetdata.io/databases/ip-asn) and ASN give the network that announces each range and its type. [IP Company](https://internetdata.io/databases/ip-company) names the organization that uses it.

## How we measured

Everything here is IPv4, as built on October 30, 2026. The IPXO-named set is every IPv4 record in IP Whois whose netname contains IPXO, except names that continue with IPXON. Its ranges were merged where they overlap, then intersected address by address with the announced space in IP ASN.

Consumer VPN servers are VPN IP's addresses with a named service, leaving out the enterprise gateway vendors our [VPN Provider](https://docs.internetdata.io/database/vpn-ip/vpn-provider) catalog flags with `enterprise_vpn`. Hosting IP counts every confidence level. Residential proxy exits are Residential Proxy IP's 90-day window. Each figure counts distinct addresses, and each internet figure is the same count over all announced IPv4. Network types are ASN's.

IP Whois and IP Abuse Contact come as gzipped CSV and MMDB, and their docs list the columns: [IP Whois](https://docs.internetdata.io/database/ip-whois), [IP Abuse Contact](https://docs.internetdata.io/database/ip-abuse-contact). To license them, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).