subnethistory.

How to lease out unused IPv4 space without wrecking it

5 min read ·

Idle address space earns nothing and costs membership fees, and at 2026 lease rates a /22 rents for several hundred dollars a month, so the case for leasing it out writes itself. What the marketplace landing pages leave out: reputation attaches to your addresses, not to the tenant, and what a lessee does with your space outlives the lease. This is the lessor's guide the platforms do not write, because the honest version admits the risk.

Your block, and the dashed outline of it in a lessee's hands, with clean and flagged outcomes being watched yours leased
The block stays yours; only the use moves. The dots underneath are the point of the whole piece: what the sampled addresses inside your range read as, month by month, while somebody else is using them.

What the income really is

Published lease rates in mid-2026 sit around $0.30 to $0.50 per address per month, so a /24 grosses roughly $90 to $130 a month and a /22 four times that. From it comes the intermediary's cut, and the spread is wide: IPXO charges holders 5% of lease revenue, InterLIR's global fee schedule takes a 20% leasing commission, and newer platforms sit in between. Direct deals keep the whole rate and cost you the platform's KYC, paperwork automation and abuse handling, which, as the rest of this piece argues, is not a saving to make casually.

Against the income, price the alternative honestly: purchase prices for large blocks fell to ten-year lows through 2025 before recovering in mid-2026, and leasing out rather than selling is partly a bet that holding is worth it. It often is. It is a bet, though, and the lease rate is the coupon on it, not free money.

The risk you are pricing

The asymmetry is simple: the lessee rents your addresses, but every blocklist entry, fraud score and classification their behaviour earns is written against the addresses themselves, and stays there after they leave. A tenant who trashes an apartment costs the deposit. A lessee who runs spam or proxy exits from your /22 can leave labels that outlast the lease by years, some held in systems that never revisit them, and the next lessee, or your own future use, pays the rate that history commands.

This is not hypothetical. Spamhaus has documented lessors burned this way for over a decade, from a Swedish registry customer caught leasing netblocks to spam operations in 2013 to millions of addresses routed for snowshoe spam gangs on the strength of forged authorisation paperwork. The pattern in every case is the same: the space was fine, the paperwork looked fine, and the use was the problem.

Vet the lessee like a landlord

Marketplaces run KYC on lessees, which is a floor, not a ceiling: verification proves a legal entity exists, not that its business model deserves your addresses. Whether you lease direct or through a platform, do your own reading:

  • Look up their network. If the lessee operates an AS, read it: what they announce today, what their space has been flagged as, how old the registration is. A two-month-old ASN with no announced history asking for a /21 is a different conversation from an established hoster expanding. That read has its own post, including the one column on a network report that looks like a history and is not.
  • Ask what the space is for, in writing. A declaration of use belongs in the contract. "VPN egress", "mail" and "proxy services" are answers that should change your price or your mind; vagueness is an answer too.
  • Check where their traffic will announce from. The ASN on the LOA is the ASN whose history you are attaching your space to. If it is not their own, ask why.

LOA, ROA and the paperwork that limits damage

The instruments that let a lessee use your space are also the instruments that limit what they can do with it, if you write them tightly.

  • LOA. Scope it to the exact prefix, the exact ASN, and an expiry date matching the lease. An open-ended letter naming a whole aggregate is how space ends up announced long after a relationship sours. Forged and over-broad LOAs are exactly how the worst leasing abuse in the Spamhaus record got routed.
  • ROA. Publish one authorising the lessee's ASN for the leased prefix, with maxLength matching what they may announce and nothing more. A tight maxLength stops the lessee splitting your block into more-specifics you never agreed to. Keep control of the RIR account and the signing: the authorisation should be yours to revoke the day the lease ends, and a ROA you published also protects the block against third parties while it is leased.
  • WHOIS. Record the sub-assignment where your registry supports it, and route abuse for the leased range to a mailbox that is actually read, whether that is yours, the platform's, or the lessee's with your visibility. An abuse report that lands nowhere becomes a listing.
  • Geofeed. Publish one for the leased range's actual location, or the space will keep geolocating to you, and the lessee's users' problems will arrive at your door.

The contract terms that matter

Rate and term are the easy clauses. These are the ones that decide how bad a bad month gets:

  • Prohibited uses, named. Spam, unsolicited scanning, proxy resale if you do not want to be proxy space, and anything that would put the range on the lists you care about.
  • Abuse SLA. Who answers a complaint, in what window, and what happens on the second one. Suspension rights you can actually exercise, meaning the LOA expiry and ROA revocation above.
  • Remediation. Who pays for delisting work, and who owns the problem when a listing outlives the lease. If the contract is silent, you do, by default, forever.
  • Exit obligations. Announcement withdrawn by a date, records reverted, and a final state you can verify rather than take on trust.

Watch your space while it is leased

Everything above is prevention. This is the part almost nobody does: watch what your addresses actually become while somebody else uses them. The lessee's monthly report says what they want it to say; the routing table and the reputation feeds say what is happening.

Look up your own prefix on the front page from time to time and read it as a stranger would: who is announcing it, whether more-specifics have appeared that you never authorised, what independent feeds currently flag sampled addresses inside it as, and how that compares with the months before. Because every reading is dated and archived, the history builds while you watch, and a dispute later, with the lessee, a marketplace, or a blocklist, is argued from a dated record rather than from memory. A flagged share that was zero in March and climbing since June is a conversation to have in July, not a discovery to make when the lease ends and the space comes back needing months of rehabilitation.

When the lease ends

Expire the LOA, revoke or reissue the ROA, revert the WHOIS and geofeed records, and confirm the announcement is withdrawn rather than assuming it. Then, before the space is re-leased or brought home, read its history one more time: what the lessee's era added to the record is now part of the block's past, it is what the next counterparty will judge, and it is the honest input to what you charge them. Address space is the rare asset whose condition report writes itself, dated and public, for anyone who cares to read it. As a lessor, the reading is the job.

Your own prefixes can be looked up on the front page like anyone else's. The report shows who announces them, what the addresses inside are flagged as with dates, and archives every change it observes, which is exactly the record a lessor wants to exist.