History
Originally founded as Ecatel in 2005 by two Dutch nationals, the company was registered in Kent, United Kingdom, with its operational headquarters located in The Hague, Netherlands. Following a 2011 dispute with a data center in Alphen aan den Rijn where they rented servers, the founders established their own data center, DataOne, in Wormer.
In 2010, the security firm HostExploit named Ecatel the "worst hosting company in the world". Ecatel maintained a fourth-place ranking in 2012.
During a campaign against online child abuse in 2012, the hacktivist collective Anonymous alleged that Ecatel hosted significant amounts of child pornography. Under the banner #OpEcatel, the group targeted the company with DDoS attacks. That same year, at the request of cybersecurity firm FireEye, Dutch authorities seized two Ecatel servers identified as command-and-control hubs for the Grum botnet.
In 2013, a judicial court in The Hague ruled that Ecatel close eighteen websites for selling counterfeit luxury goods. Ecatel won a lawsuit in 2015 filed by the Premier League, which sought to have illegal streams taken offline. In 2018, this decision was reversed, and Ecatel was required to take the streams offline.
Rebranding to Quasi Networks and IP Volume
In December 2015, Ecatel's IP address blocks were transferred to Quasi Networks, registered in the Seychelles. Ecatel was formally dissolved in 2017. In subsequent years, large blocks of IP addresses were transferred to IP Volume, also based in the Seychelles. Despite the offshore registration, investigative reporting indicates the company continues to operate physically from the Netherlands. Other shell companies using the same registration details have purchased services from IP Volume or its predecessors to obscure their operations.
Ecatel was linked to the July 2015 data breach of Ashley Madison, a website facilitating extramarital affairs. One of the servers used to distribute stolen data was traced to Ecatel's infrastructure in Amsterdam.
2019–Present Investigations
In 2019, The New York Times identified IP Volume (then operating as Novogara) as being complicit in the distribution of child sexual abuse material. A 2020 report by the Dutch Ministry of Justice and Security ranked IP Volume as the second-largest host of such material in the Netherlands, linked to 4,500 out of 175,000 verified reports. The ministry noted that unlike other providers who cooperated with authorities, IP Volume deliberately obstructed efforts to remove illicit content.
The FIOD raided IP Volume's data center in September 2020. During the raid, hundreds of thousands of euros worth of Bitcoin, 70,000 euros in cash, five cars, and two tasers were seized.
In 2021, IP Volume was linked to the theft and hijacking of millions of IPv4 addresses from South Africa.
In 2025, security researchers from Intrinsec Cyber Threat Intelligence (CTI) reported that IP Volume was observed as a source of massive brute‑force password‑spraying attacks targeting SSL, VPN, and RDP services. The attacks were linked to a cluster of abusive autonomous systems operating from Ukraine and the Seychelles, with rapid IPv4 prefix rotation used to evade blocklists.
According to Google Transparency Report, websites using IP Volume were found to be responsible for 10 million reported cases of non-consensually shared explicit imagery (NCSEI) by the end of 2025.
