The Shady World of IP Leasing: How IPv4 Exhaustion Became a Geolocation Laundering Market

Developer acid.vegas published a detailed investigation into the IP leasing industry, revealing that IPv4 "exhaustion" is not a technical crisis but a landlord problem — addresses were hoarded and a grey-market sub-leasing economy emerged where anyone can rent clean, arbitrarily geolocated, and white-labeled IP blocks with no RIR accountability. The infrastructure enables geolocation selection from dropdown menus (no validation), paid delisting from Spamhaus and other blacklists, and residential-labeled IP space for rent — systematically corrupting the IP reputation, geolocation, and WHOIS trust layers that security tools depend on. Companies named in the report include LogicWeb, IPXO, IPFoxi, Heficed, AnyIP, and IPv4Deals, which supply major VPN providers including NordVPN, ExpressVPN, PureVPN, and BrightData.

Key Takeaways

• IP leasing providers offer geolocation choice from a dropdown (validated by nothing), paid spam blacklist delisting from Spamhaus/Barracuda/SORBS, and white-labeled "unattributable" WHOIS-free IP space — companies including LogicWeb, IPXO, Heficed, IPFoxi supply NordVPN, ExpressVPN, PureVPN, and BrightData
• RFC 8805 geofeeds and WHOIS country fields are the primary manipulation vectors: a lessee publishes a geofeed CSV claiming any country and major geolocation DBs (MaxMind, Cloudflare, Google) ingest it with no infrastructure validation — poisons every IP-to-location fraud detection system
• 75 HN points and 45 comments on March 6, 2026; security implication: IP reputation, geolocation databases, and WHOIS attribution are all compromised at industrial scale by services marketed openly with pricing pages and sales teams

Original source: acid.vegas