3 ms·

This is very likely the case. Check the IP on a site that does IP reputation scoring [1]. They probably don't have a database of "bad" addresses for IPv6, so

by ryan29 6y ago

This is very likely the case. Check the IP on a site that does IP reputation scoring [1]. They probably don't have a database of "bad" addresses for IPv6, so it squeaks by for now. I'm sure that'll change in the future though. My current IP shows "0 - low risk" with that tool. Grabbing a random PIA IP shows "93% - Abusive IP" with a warning about being a high risk proxy connection. The random VPN IP is also on SPAM blocklists. I'm guessing a huge portion of cheap shared hosting is the same. 1. https://www.ipqualityscore.com/ip-reputation-check https://www.ipqualityscore.com/ip-reputation-check

yokem55 6y ago
FWIW - I suspect the "IP reputation" site you referenced is utter bullshit when it comes to its "Proxy Detection". Looking at my own residential public address it calls it a 'low risk proxy' when I can assure that it most definitely is not. It doesn't help that their explanation for how they attempt to detect this is a pile of marketing word salad. I don't expect them to be completely transparent to their methodology, but they should make some attempt at presenting a bit of technical background.
- viraptor 6y ago
  It doesn't have to be bullshit. You have a sample size of 1 and realistically we can't expect 100% accuracy. We also don't know how often your IP is changing - maybe it was a proxy endpoint recently?
  - yokem55 6y ago
    It's a static address that hasn't changed for 3+ years. The only thing I can think of the makes it proxy-ish, is that I have a 6 person household here. Edit- The IP my employer uses as its outbound nat IP that we vpn from while WFH (so it actually is a proxy) gets a clean bill of health while our corporate email server (not a proxy at all) is tagged as one.
    - grahamburger 6y ago
      It's not just IPs that have reputation scores but IP ranges and AS entities. Residential IP ranges are often dinged by default because of the risk of infected home PCs sending spam.
      - yokem55 6y ago
        There absolutely is a reputation associated with individual addresses and ranges of addresses. And that reputation can be derived from numerous legitimate means (honeypot activity, spam, reverse dns info), but whatever these folks are doing regarding "proxy/vpn detection" is indistinguishable from snake oil.
        grahamburger 6y ago
        I would guess that all or nearly all residential IPs are marked as at least 'low proxy' risk because of the risk of malware on personal devices.
- jsmith99 6y ago
  It says that for me too, so I tried 8.8.8.8 and it was rated as "100% abuse". I don't think this tool is very accurate.
- ryan29 6y ago
  > I suspect the "IP reputation" site you referenced is utter bullshit when it comes to its "Proxy Detection". It very well could be. That wasn't an endorsement by any means. The problem from what I can see is if services like that are convincing CTOs to use their lists it becomes relevant (even if the info isn't accurate).
hertzrat 6y ago
Disreputable and reputable services alike change ip all the time. The only people who don’t are home users and I suspect VPN users. I don’t fully understand how this is supposed to help you decide if something is safe
- viraptor 6y ago
  > Disreputable and reputable services alike change ip all the time. If you're running a serious mail service your IPs don't change that much. Not only will you have a pool of IP addresses just for that reason, you'll also likely need a few unused ones for when one of your users tanks your reputation and you have to roll them. Nobody taking real money for email will use a randomly assigned IP as source. (unless it's randomly selected and then tested for reputation before use) Mailgun and other services even allow you to book a dedicated IP just for your outgoing emails.
  - hertzrat 6y ago
    That's a good point

by ryan29 6y ago

yokem55 6y ago

FWIW - I suspect the "IP reputation" site you referenced is utter bullshit when it comes to its "Proxy Detection". Looking at my own residential public address it calls it a 'low risk proxy' when I can assure that it most definitely is not. It doesn't help that their explanation for how they attempt to detect this is a pile of marketing word salad. I don't expect them to be completely transparent to their methodology, but they should make some attempt at presenting a bit of technical background.

viraptor 6y ago
It doesn't have to be bullshit. You have a sample size of 1 and realistically we can't expect 100% accuracy. We also don't know how often your IP is changing - maybe it was a proxy endpoint recently?
- yokem55 6y ago
  It's a static address that hasn't changed for 3+ years. The only thing I can think of the makes it proxy-ish, is that I have a 6 person household here. Edit- The IP my employer uses as its outbound nat IP that we vpn from while WFH (so it actually is a proxy) gets a clean bill of health while our corporate email server (not a proxy at all) is tagged as one.
  - grahamburger 6y ago
    It's not just IPs that have reputation scores but IP ranges and AS entities. Residential IP ranges are often dinged by default because of the risk of infected home PCs sending spam.
    - yokem55 6y ago
      There absolutely is a reputation associated with individual addresses and ranges of addresses. And that reputation can be derived from numerous legitimate means (honeypot activity, spam, reverse dns info), but whatever these folks are doing regarding "proxy/vpn detection" is indistinguishable from snake oil.
      - grahamburger 6y ago
        I would guess that all or nearly all residential IPs are marked as at least 'low proxy' risk because of the risk of malware on personal devices.
jsmith99 6y ago
It says that for me too, so I tried 8.8.8.8 and it was rated as "100% abuse". I don't think this tool is very accurate.
ryan29 6y ago
> I suspect the "IP reputation" site you referenced is utter bullshit when it comes to its "Proxy Detection". It very well could be. That wasn't an endorsement by any means. The problem from what I can see is if services like that are convincing CTOs to use their lists it becomes relevant (even if the info isn't accurate).

hertzrat 6y ago

Disreputable and reputable services alike change ip all the time. The only people who don’t are home users and I suspect VPN users. I don’t fully understand how this is supposed to help you decide if something is safe

viraptor 6y ago
> Disreputable and reputable services alike change ip all the time. If you're running a serious mail service your IPs don't change that much. Not only will you have a pool of IP addresses just for that reason, you'll also likely need a few unused ones for when one of your users tanks your reputation and you have to roll them. Nobody taking real money for email will use a randomly assigned IP as source. (unless it's randomly selected and then tested for reputation before use) Mailgun and other services even allow you to book a dedicated IP just for your outgoing emails.
- hertzrat 6y ago
  That's a good point