AS834

AS834 is an actively routed ASN registered to IPXO LLC, a large-scale IPv4 address leasing and monetization marketplace. Unlike a dormant legacy ASN, it currently announces both IPv4 and IPv6 prefixes and carries live, third-party-observed upstream and peer relationships — the opposite triage profile from a clean, inactive registration.

ARIN RDAP's autnum top-level registration event puts the current registration at 2021-04-14 (registrant IPXO LLC, org handle IL-845, Dallas, TX). RIPEstat separately shows BGP origin AS834 first seen in routing back on 2000-08-18, evidence this is a legacy or transferred ASN under its current registrant rather than a fresh 2021 allocation. A same-named UK entity, IPXO LIMITED (Companies House no. 06848949, incorporated 2009), was also found; its relationship to IPXO LLC remains Unknown.

The IPv4 prefix-count gap between sources is resolved rather than an open question: RIPEstat's announced-prefixes history for the 2026-07-24 to 2026-08-07 window lists four IPv4 prefixes present the entire time (69.33.194.0/23, 69.33.193.0/24, 148.163.252.0/24, 191.96.111.0/24) plus three single-day transient prefixes — together accounting for all seven prefixes bgp.he.net reports historically, against RIPEstat's and bgp.tools' four currently-live. Both IPv6 /32s (2c0f:f738::/32, 2c0f:ee78::/32) are agreed across sources.

CAIDA's historical customer cone lists roughly 14,336 IPv4 addresses across 15 prefixes with a singleton cone (no downstream customer ASNs), consistent with the currently-announced 1,280 addresses across 4 prefixes. A separate bgpview.io/ipinfo.io read reporting 517,848 addresses across 1,185 prefixes remains genuinely unexplained against canonical RDAP, RIPEstat, and CAIDA data.

Third-party route collectors (bgp.he.net, bgp.tools) name six upstream ASNs — Misaka Network (AS917/23961/35487/57695), NetActuate (AS36236), and Latitude.sh (AS396356) — plus one peer, AS219299 (Khinkali Industries). Canonical CAIDA data corroborates only the aggregate relationship counts (asnDegree 3, all classified "provider"; 6 observed neighbours total), not these individual identities — read them as route-collector-sourced, not RDAP-confirmed.

RPKI coverage is now confirmed directly from RIPEstat's Routinator validator rather than inferred solely from bgp.tools: of 5 of the 9 window-observed prefixes checked, 3 carry valid ROAs (both IPv6 /32s plus 69.33.193.0/24) and 2 have no covering ROA (69.33.194.0/23, 148.163.252.0/24); 191.96.111.0/24 was not included in the check.

IPXO operates a first-party geofeed at geofeed.ipxo.com/geofeed.txt (RFC 8805-style), named directly in the ARIN autnum record's own remark and refreshed at least daily — strong evidence of an actively managed, globally distributed leased-IP footprint. The company sponsors and presents at NANOG (e.g. NANOG 91, "Spam Wars Chronicles," and NANOG 94/95 sponsorship) and holds Gold Sponsor status on PeeringDB.

Abuse feeds

AS834 does not appear on the Spamhaus ASN-DROP list (directly fetched and checked; no AS number in the 800-900 range is listed); no AS834/IPXO-specific listing was found on Talos Intelligence or VirusTotal as of an August 2026 search, though neither offers a public ASN-level bulk lookup; AbuseIPDB's dedicated ASN check page returned HTTP 403, so only general per-IP search coverage was assessable.

Third-party spam signal

CleanTalk (a spam-tracking aggregator, not a formal blocklist) reports a modest ~1.56% aggregate spam-active rate across roughly 37,674 tracked IPs on AS834, concentrated in specific /24 subnets — one in the US at 55% — rather than spread ASN-wide.

RPKI posture

RIPEstat's Routinator validator checked 5 of the 9 window-observed prefixes and found 3 with valid ROAs and 2 with no covering ROA; one currently-announced prefix, 191.96.111.0/24, was not included in the check — partial coverage, not a validator failure.

Business-model exposure

AS834 is an IP-leasing marketplace, so abuse originating from leased blocks is often attributable to individual lessees rather than IPXO itself; the operator documents its own abuse-mitigation and reputation-monitoring processes.

NANOG record

No hijack, route-leak, or abuse-complaint threads naming AS834 or IPXO were found in NANOG archives as of an August 2026 search.

Community reputation

Trustpilot reviews for ipxo.com are mixed (80+ reviews), with complaints about account suspensions and slow response times alongside positive feedback on IP monetization services.

Operator

IPXO LLC (ARIN org handle IL-845, Dallas, TX, US); IPv4 address leasing/monetization marketplace [Confirmed] — https://rdap.arin.net/registry/autnum/834

Country / RIR

US, ARIN [Confirmed] — https://rdap.arin.net/registry/autnum/834

Allocated

2021-04-14 (ARIN RDAP autnum top-level registration event; last changed 2021-04-15); RIPEstat separately shows BGP origin first_seen 2000-08-18, evidence of a legacy/transferred ASN under the current registrant rather than a fresh 2021 allocation

[Confirmed] — https://rdap.arin.net/registry/autnum/834

Org status

Active per ARIN RDAP (registration event 2021-04-14, last changed 2021-04-15). Self-submitted PeeringDB record present, status ok, Gold Sponsor tier; general "updated" field 2022-07-27; rir_status_updated field 2024-06-26

[Confirmed] — https://rdap.arin.net/registry/autnum/834, https://www.peeringdb.com/asn/834

Contacts

Two group-kind role POCs on the ARIN RDAP autnum record — IAMT1-ARIN ("IPXO Abuse Management Team"; abuse@ipxo.com, per the entity's own RDAP registration comment: "for abuse queries, abuse reports should be sent to this email") and IST36-ARIN ("IPXO Support Team"; support@ipxo.com) — plus one individual-kind administrative POC (handle GRINI-ARIN) whose contact detail is withheld from this entry

[Confirmed] — https://rdap.arin.net/registry/autnum/834

Security/abuse context (NEUTRAL, DATED)

as of an August 2026 search, no ASN-level listing on Spamhaus ASN-DROP (directly checked), Talos Intelligence, or VirusTotal; AbuseIPDB's ASN check page returned 403. CleanTalk reports a modest ~1.56% aggregate spam-active rate across ~37,674 tracked IPs, concentrated in specific /24 subnets (up to 55% in one) rather than ASN-wide

Network & routing

Network type

IPv4 address leasing/monetization/management marketplace platform, not a traditional transit/access ISP — corroborated by operator-authored page titles indexed from ipxo.com itself ("IPXO | Global IPv4 Leasing, Monetization & Management Platform"); full page-body text remains unfetchable (403 on direct fetch)

[Likely] — https://www.peeringdb.com/asn/834, https://www.ipxo.com/

Size

4 IPv4 prefixes / 1,280 addresses currently announced (69.33.194.0/23, 69.33.193.0/24, 148.163.252.0/24, 191.96.111.0/24); 2 IPv6 /32s (2c0f:f738::/32, 2c0f:ee78::/32); CAIDA historical cone ~14,336 IPv4 addresses / 15 prefixes. The bgp.he.net-vs-RIPEstat count gap (7 vs 4) is resolved — see Analyst note. A separate bgpview.io/ipinfo.io read of 517,848 addresses / 1,185 prefixes remains unexplained

[Confirmed] — https://stat.ripe.net/data/announced-prefixes/data.json?resource=834, https://bgp.he.net/AS834

Routing/peering

CAIDA AS rank 16577; asnDegree total 3 (all classified "provider," 0 "peer"); 6 observed neighbours; customer cone = 1 ASN (self), 15 prefixes, 14,336 addresses [Confirmed, CAIDA]. Third-party route collectors additionally name six upstream ASNs — AS917/23961/35487/57695 (Misaka Network), AS36236 (NetActuate), AS396356 (Latitude.sh) — and one peer, AS219299 (Khinkali Industries); these identities come from route collectors, not RDAP, and canonical data corroborates only the counts, not the names

[Likely] — https://api.asrank.caida.org, https://bgp.he.net/AS834, https://bgp.tools/as/834

Peering policy

Open; no traffic-ratio requirement; contract not required (self-submitted PeeringDB record, general "updated" field 2022-07-27) [Confirmed] — https://www.peeringdb.com/asn/834

RPKI

Confirmed via RIPEstat's Routinator validator — of 5 of the 9 window-observed prefixes checked, 3 carry valid ROAs (2c0f:f738::/32, 2c0f:ee78::/32, 69.33.193.0/24) and 2 have no covering ROA (69.33.194.0/23, 148.163.252.0/24); 191.96.111.0/24 was not included in the check (checked_count 5 of 9, incomplete). Corroborates bgp.tools' independent count of 3 valid ROAs

[Confirmed] — https://stat.ripe.net/data/rpki-validation/data.json?resource=834, https://bgp.tools/as/834

Notable usage

Operator-hosted, first-party geofeed at geofeed.ipxo.com/geofeed.txt (RFC 8805-style), named directly in the ARIN autnum record's own remark; refreshed at least daily, listing roughly 2,000+ IPv4/IPv6 CIDR ranges across 100+ countries. IPXO sponsors and presents at NANOG (e.g. NANOG 91, "Spam Wars Chronicles") and holds Gold Sponsor status on PeeringDB [Confirmed] — https://geofeed.ipxo.com/geofeed.txt, https://rdap.arin.net/registry/autnum/834, https://storage.googleapis.com/site-media-prod/meetings/NANOG91/5139/20240608_Anfalovas_Spam_Wars_Chronicles_v1.pdf

Related ASNs

none confirmed as directly related. A same-named UK entity, IPXO LIMITED (Companies House no. 06848949, incorporated 2009-03-17), exists; its relationship to registrant IPXO LLC is Unknown [Unknown] — https://find-and-update.company-information.service.gov.uk/company/06848949

Analyst note

AS834 is an actively-routed marketplace ASN — the opposite profile from a dormant legacy ASN. The IPv4 prefix-count gap between sources (bgp.he.net's 7 vs RIPEstat's/bgp.tools' 4) is resolved: four prefixes are continuously announced across the 2026-07-24 to 2026-08-07 window, and three more appear as single-day transients, together accounting for all seven. A separate bgpview.io/ipinfo.io read of roughly 518,000 addresses across 1,185 prefixes remains unexplained. RPKI posture is now confirmed directly via RIPEstat's Routinator validator rather than inferred solely from bgp.tools. Named upstream/peer ASNs are third-party-sourced; canonical CAIDA data corroborates only the relationship counts (3 provider relationships, 6 observed neighbours), not the identities. The US/UK IPXO corporate relationship stays Unknown. None of this changes the clean security posture: no formal ASN-level blocklist hits, only a localized third-party spam signal in specific leased subnets.