4 ms·

The VPN connection here intrigues me. Do these VPN companies know how their IPs are being procured/by whom? > In a 2020 interview, Golestan told KrebsOnSecurit

The VPN connection here intrigues me. Do these VPN companies know how their IPs are being procured/by whom? > In a 2020 interview, Golestan told KrebsOnSecurity that Micfo was at one point responsible for brokering roughly 40 percent of the IP addresses used by the world’s largest VPN providers This would be an interesting deep dive for a tech-focused investigative journalist.

walrus01 5y ago
in my opinion almost all VPN companies are shady/gray-market entities, so yes, they absolutely know. the colocation hosts and regional ISPs that will accept VPN operators as dedicated server and 1U server colocation customers are towards the more suspicious end of the hosting segment market spectrum, in my experience. dig hard enough on a modern vpn hosting company with a slick marketing presence and you'll find like, a cypriot corporation with a cyprus bank account run by a guy who 15 years ago was in the adult website hosting business, who currently lives and works remotely from cambodia. Or similar.
- AnthonyMouse 5y ago
  This is kind of the nature of the market. On the one hand, it's effectively a commodity, so there is a lot of competition. On the other hand, the entire point is to protect the privacy of the customer. So if you're doing it right and any of your customers are actually in need of that privacy protection, you're going to be taking flack from angry jerks who don't like that you're providing it. The same thing happens to people hosting adult websites, so it's the same kind of people who are willing to put up with that in exchange for money.
  - duskwuff 5y ago
    > On the other hand, the entire point is to protect the privacy of the customer. I'm not so sure. As far as most of these companies are concerned, "the entire point" is to collect customers' money. The quality of the service they're providing is secondary, beyond that it has to be good enough that customers won't leave -- and the privacy properties of that service are even less important, since most customers aren't equipped to evaluate that.
    - darkwater 5y ago
      In the world these providers and clients are operating, clients are definitely equipped and aware about privacy concerns. Not for their users but for themselves
- radicaldreamer 5y ago
  The real scandal is the number of vpns routing traffic over random customers networks…
  - walrus01 5y ago
    yes if you google "Residential proxies for sale" there's a whole slew of grey/black market things using peoples' trojaned home routers or home PCs as relays. IP traffic from legit seeming residential IP space is important in circumventing all sorts of things for not only scraping, but also straight out credit card fraud and other more nefarious purposes.
    - mopsi 5y ago
      I have a similar experience. A friend of mine was staying on SE Asia for an extended period of time and asked me to configure her router with an always-on VPN connection to the US to access her media subscription services. She had already signed up with a VPN provider. None of the standard VPN connection types worked (OpenVPN, L2TP etc) with Netflix, only the custom application that they provided. When I analyzed it, I found out that it routed traffic through other users' residential connections.
    - kbenson 5y ago
      It's not all trojaned home routers and PCs, at least not in the sense that the user is unaware that they're running the program (even if they're unaware they're routing traffic). For example, all/most the mobile IPs offered done through offering SDKs for app developers to implement and paying them based on usage. Now that phone is a relay while that app is running/backgrounded. Those free apps don't just make money off of ads, they make money this way too. For those, it's probably in the fine print what's going on, but people are conditioned to trade something non-monetary for usage these days, even if they aren't really aware of what they're trading.
- TedDoesntTalk 5y ago
  None of this is accurate in the slightest for the vpn company i work for. But such vpn companies do exist.
  - kortilla 5y ago
    What is the point of your vpn company’s product? The ones op is referring too usually only exist to torrent and bypass geolocation content restrictions. What is the usecase for a paid VPN otherwise?
    - Renaud 5y ago
      >What is the usecase for a paid VPN otherwise? Added protection against ISP and local snooping of traffic, either for commercial gain or by some local agencies in less-free countries where such things are common. Bypassing geo restricted content is also a big one, says for people living abroad who want to enjoy access to content from their country of origin, or content that is not locally filtered. Maintaining privacy when visiting websites that use your geolocation or IP to correlate your visits and profile you for advertisement based on your (more or less) precise location for instance. Or maybe you want some added privacy when visiting some adult or political sites whose data may be breached or monitored and make your habits more public than you'd want. In principle a VPN is just another level of privacy protection, as long as it's one that can be trusted, which is probably another issue since apparently not many can.
- bugbuddy 5y ago
  These are very broad and bold claims. Do you have any evidence to support any of these claims you made? Also, why do you think a shady person would be likely to reside in Cambodia? Do you have any evidence to support this claim?
  - walrus01 5y ago
    a) having been on the side of the ISPs that shady vpn providers approach when they're looking to rent dedicated servers or colocation space. 90% of the time when we did research into the potential "client" it turned out to be too much risk. Lots of common things like we couldn't tie them to a specific LLC or corporation in the USA or Canada, they couldn't provide any information of creditworthiness, the persons who wanted to sign the service agreement we had no way of verifying they were officers of the entity they purported to represent. People who would only contact by email and refuse to have a phone conversation or face to face. b) that's a specific person, but I won't say who, for obvious reasons. Lots of reasons why from the POV of a shady vpn service provider you might want to live offshore and pay as little money in taxes as possible, I suppose, so there's a certain logic to it. Please keep in mind I have been seeing weird/shady things in internet infrastructure for a very long time. I was helping set up OpenBSD firewalls for online casinos colocated in small island nation states 22 years ago, so I have a certain jaded perspective on these things.
    - bugbuddy 5y ago
      Beside VPN providers and casinos, what other categories of online business do you often find shady? It is unfair to label a country a tax haven based on a single anecdote. However, Cambodia is cheap and pretty safe for expats so it makes sense.
      - walrus01 5y ago
        What else is shady on the internet? Click farms Review farms Residential proxies Captcha solving services employing people in very low cost of labor locations Fake tech support scams Canada revenue agency / IRS scam call centers Porn website hosting Anything involving Rob Monster Bitcoin tumblers Cryptocurrency exchanges Fad of the week newly created cryptocurrency College essay writing services NFTs Selling used panties online Website hosting for services similar to the now shutdown Backpage.com (anything escort or prostitution related) Buying drugs with cryptocurrency

walrus01 5y ago

in my opinion almost all VPN companies are shady/gray-market entities, so yes, they absolutely know. the colocation hosts and regional ISPs that will accept VPN operators as dedicated server and 1U server colocation customers are towards the more suspicious end of the hosting segment market spectrum, in my experience. dig hard enough on a modern vpn hosting company with a slick marketing presence and you'll find like, a cypriot corporation with a cyprus bank account run by a guy who 15 years ago was in the adult website hosting business, who currently lives and works remotely from cambodia. Or similar.

AnthonyMouse 5y ago
This is kind of the nature of the market. On the one hand, it's effectively a commodity, so there is a lot of competition. On the other hand, the entire point is to protect the privacy of the customer. So if you're doing it right and any of your customers are actually in need of that privacy protection, you're going to be taking flack from angry jerks who don't like that you're providing it. The same thing happens to people hosting adult websites, so it's the same kind of people who are willing to put up with that in exchange for money.
- duskwuff 5y ago
  > On the other hand, the entire point is to protect the privacy of the customer. I'm not so sure. As far as most of these companies are concerned, "the entire point" is to collect customers' money. The quality of the service they're providing is secondary, beyond that it has to be good enough that customers won't leave -- and the privacy properties of that service are even less important, since most customers aren't equipped to evaluate that.
  - darkwater 5y ago
    In the world these providers and clients are operating, clients are definitely equipped and aware about privacy concerns. Not for their users but for themselves
radicaldreamer 5y ago
The real scandal is the number of vpns routing traffic over random customers networks…
- walrus01 5y ago
  yes if you google "Residential proxies for sale" there's a whole slew of grey/black market things using peoples' trojaned home routers or home PCs as relays. IP traffic from legit seeming residential IP space is important in circumventing all sorts of things for not only scraping, but also straight out credit card fraud and other more nefarious purposes.
  - mopsi 5y ago
    I have a similar experience. A friend of mine was staying on SE Asia for an extended period of time and asked me to configure her router with an always-on VPN connection to the US to access her media subscription services. She had already signed up with a VPN provider. None of the standard VPN connection types worked (OpenVPN, L2TP etc) with Netflix, only the custom application that they provided. When I analyzed it, I found out that it routed traffic through other users' residential connections.
  - kbenson 5y ago
    It's not all trojaned home routers and PCs, at least not in the sense that the user is unaware that they're running the program (even if they're unaware they're routing traffic). For example, all/most the mobile IPs offered done through offering SDKs for app developers to implement and paying them based on usage. Now that phone is a relay while that app is running/backgrounded. Those free apps don't just make money off of ads, they make money this way too. For those, it's probably in the fine print what's going on, but people are conditioned to trade something non-monetary for usage these days, even if they aren't really aware of what they're trading.
TedDoesntTalk 5y ago
None of this is accurate in the slightest for the vpn company i work for. But such vpn companies do exist.
- kortilla 5y ago
  What is the point of your vpn company’s product? The ones op is referring too usually only exist to torrent and bypass geolocation content restrictions. What is the usecase for a paid VPN otherwise?
  - Renaud 5y ago
    >What is the usecase for a paid VPN otherwise? Added protection against ISP and local snooping of traffic, either for commercial gain or by some local agencies in less-free countries where such things are common. Bypassing geo restricted content is also a big one, says for people living abroad who want to enjoy access to content from their country of origin, or content that is not locally filtered. Maintaining privacy when visiting websites that use your geolocation or IP to correlate your visits and profile you for advertisement based on your (more or less) precise location for instance. Or maybe you want some added privacy when visiting some adult or political sites whose data may be breached or monitored and make your habits more public than you'd want. In principle a VPN is just another level of privacy protection, as long as it's one that can be trusted, which is probably another issue since apparently not many can.
bugbuddy 5y ago
These are very broad and bold claims. Do you have any evidence to support any of these claims you made? Also, why do you think a shady person would be likely to reside in Cambodia? Do you have any evidence to support this claim?
- walrus01 5y ago
  a) having been on the side of the ISPs that shady vpn providers approach when they're looking to rent dedicated servers or colocation space. 90% of the time when we did research into the potential "client" it turned out to be too much risk. Lots of common things like we couldn't tie them to a specific LLC or corporation in the USA or Canada, they couldn't provide any information of creditworthiness, the persons who wanted to sign the service agreement we had no way of verifying they were officers of the entity they purported to represent. People who would only contact by email and refuse to have a phone conversation or face to face. b) that's a specific person, but I won't say who, for obvious reasons. Lots of reasons why from the POV of a shady vpn service provider you might want to live offshore and pay as little money in taxes as possible, I suppose, so there's a certain logic to it. Please keep in mind I have been seeing weird/shady things in internet infrastructure for a very long time. I was helping set up OpenBSD firewalls for online casinos colocated in small island nation states 22 years ago, so I have a certain jaded perspective on these things.
  - bugbuddy 5y ago
    Beside VPN providers and casinos, what other categories of online business do you often find shady? It is unfair to label a country a tax haven based on a single anecdote. However, Cambodia is cheap and pretty safe for expats so it makes sense.
    - walrus01 5y ago
      What else is shady on the internet? Click farms Review farms Residential proxies Captcha solving services employing people in very low cost of labor locations Fake tech support scams Canada revenue agency / IRS scam call centers Porn website hosting Anything involving Rob Monster Bitcoin tumblers Cryptocurrency exchanges Fad of the week newly created cryptocurrency College essay writing services NFTs Selling used panties online Website hosting for services similar to the now shutdown Backpage.com (anything escort or prostitution related) Buying drugs with cryptocurrency