Leased IPv4 space is three to five times more likely to be on a blocklist than space its holder uses itself. That is the finding of two measurement studies from the last two years, and it is why every ipdata response now says whether an address sits in a rented block: is_leased. This post is about where leased addresses come from, why abuse concentrates in them, and what to do with the flag.
Where leased addresses come from
The internet ran out of new IPv4 addresses. IANA handed out its last blocks in February 2011, ARIN ran dry in September 2015 and the RIPE NCC in November 2019. Anyone who needs addresses now either waits in a registry queue, buys them from someone with spare, or rents them. The queues are long: in February 2025 the waiting lists at the RIPE NCC, ARIN and LACNIC stood at 498, 615 and 1,417 days.
Buying is a real market. In 2024, 6,184 transfers moved 30.2 million addresses, and another 29.7 million changed hands in the first half of 2026. The price peaked near $60 an address in late 2021 and has fallen to about $20.
Renting is the cheaper way in. A lease runs a month at a time, at roughly $0.59 per address per month, so a /24 of 256 addresses costs about $150 a month. The holder keeps the registration and the tenant gets the right to announce the block and use it. Nothing changes at the registry, and nothing has to. Brokers and marketplaces sit in between, listing blocks for rent the way a letting agent lists flats.
How much of the internet is rented this way? One study inferred that 4.1% of advertised IPv4 prefixes, 0.9% of routed address space, were leased in April 2024. The registries' rules don't settle whether that is fine. The RIPE NCC has a temporary-transfer policy written for it. ARIN allows it but says leased space doesn't count as use when you ask for more. APNIC, LACNIC and AFRINIC assign addresses for use inside the holder's own network.
Why leased space shows up in fraud
Three reasons, and they compound.
The tenant is whoever pays this month. A lease is quick, cheap and reversible, and the vetting varies from broker to broker. Spamhaus has documented this since the lease market was young. In 2014 it reported a Swedish provider that had leased 47 ranges, 17,664 addresses, to a single snowshoe spam operation, which kept sending for almost three months after the ranges were listed. The spammers, Spamhaus wrote, sub-lease space on the grey market "pretending to use it for SEO or VOIP".
Rotation beats reputation. Blocklists and reputation systems work by remembering an address's history. A tenant who rents a clean block, burns it and moves to the next one is never remembered for long. The 2025 study of the leasing market puts it plainly: by rotating blocks, taking clean ones and discarding used ones, abusers get around address-based filtering, and leasing hides who is really using a block, because the tenant's details never reach WHOIS. The market prices this in. Blocks with a clean history fetch a 10 to 15 percent premium, and a holder who rents out space grosses about 35 percent of the block's value a year, a yield one market report reads as the market saying it does not believe the asset is safe.
The listing outlives the tenant. When the abuser leaves, the block's record stays. The next tenant, who may be entirely legitimate, inherits an abuse history that "takes months to launder out of reputation systems". Some brokers now sell reputation monitoring and delisting as a service. Spamhaus has seen the reverse too: brokers leasing already-listed prefixes to new, unsuspecting customers, seemingly to force the listing off.
The measurements agree. The 2024 study found leased space about five times more likely to be abused than non-leased space. The 2025 study, using blocklists as the signal, found leased prefixes 2.89 times more likely to be flagged in February 2025. Bought space is not much better: a 2020 study found transferred /24s six times more likely to be blacklisted, and IPXO, a leasing marketplace, reported more than 22,000 abuse incidents on its own platform in a single quarter of 2022, spam the largest category.
What it does to geolocation and attribution
WHOIS names the holder, who is often a holding company or a registry member with spare space, not the tenant. The tenant can be in another country, announcing the block from a hosting provider's network. So the registry record points the wrong way, the announcing network is a middleman, and the location of a leased block is wherever its current tenant plugged it in.
For attribution that makes the registry record a lead, not an answer: it names who holds the block, not who is using it. The network that announces the block says who routes it today, which for a rented block is often a hosting provider rather than the holder.
How ipdata flags it
Every response carries is_leased at the top level, beside is_eu. It is present only when true, so a record that isn't leased is unchanged:
"is_leased": true
The page for any address on ipdata.co shows the same flag as a Leased badge next to the other network facts, and the fields to read it against are in the same response: asn for the network that announces the block, company for the organization it is assigned to, and the threat object for what the blocklists say.
What to do with it
Leased is a risk weight, not a verdict. Plenty of legitimate businesses rent address space: hosting providers between allocations, VPN services, companies that can't wait 600 days in a queue. What the flag tells you is that the address's past says less than usual about its present, and that the tenant can change next month.
- Weight it with the rest.
is_leasednext to anasn.typeof hosting, a fresh blocklist listing or a high proxy score is a different picture from a leased block on an ISP that is otherwise quiet. - Discount the history. A clean record on a leased block says less than usual, because the tenant may be new.
- Don't take its location as the user's. A leased block is wherever its tenant uses it, and it moves when the tenant changes. Treat the location as the tenant's, not as evidence about an individual.
- Step up, don't block. For sign-ups and payments from leased space, ask for a second factor or a verification rather than refusing outright.
Look up any address at ipdata.co/<the address> to see the badge, or call the API and read is_leased. If something you need is missing, write to me. I read every message.
Sources
- Du, Fontugne, Testart, Snoeren and claffy, Sublet Your Subnet: Inferring IP Leasing in the Wild, IMC 2024.
- Degen, Du, Mok, Sommese, Jonker, van Rijswijk-Deij and claffy, From Scarcity to Opportunity: Examining Abuse of the IPv4 Leasing Market, TMA 2025.
- Giotsas et al., A first look at the misuse and abuse of the IPv4 transfer market, PAM 2020, summarised on the APNIC blog.
- Spamhaus, Resilans incident report, March 2014, and Bulletproof hosting: cutting off the facilitators.
- ipregistry, The IPv4 Market at Mid-2026, July 2026.
- IPXO on the ARIN blog, Facing and mitigating IP address abuse in IPv4 transfer and lease markets, November 2022.
- Lee Howard, Policies regarding leasing IPv4 addresses, as of August 2024.