6 ms·
The shady world of IP leasing
- CloakHQ 7mo ago[dead]
- ACCount37 7mo agoGood. GeoIP should be dead, and "IP reputation" should be meaningless garbage.
- observationist 7mo agoIP Reputation is only as meaningful as the duration of ownership. If it's the same owner for years, then reputation is meaningful, and that should count; if it changes hands every 6 hours being assigned to VPS clients or whatnot, then make the reputation stick to the /24 owner, and so on, with varying degrees of scope and duration, so that the responsible party - the shady companies renting their IPs to bad people - actually have their reputations stick. Then block the /24 or larger subnets, or aggressively block all ranges owned by the company, isolating them and their clients, good and bad. That sort of pressure can work. But then you risk brigading and activist fueled social media mobs and that's definitely no way to run the internet.
- BLKNSLVR 7mo ago100% agree with your point regarding long term ownership allowing for meaningful reputation. I don't necessarily think that's 'no way to run the internet' or even 'no way to run anything', in that people can choose to whom they listen in regards to blocking, protesting, boycotting. As long as none of the different groups of opinions are forced on anyone else, then pick and choose those you apply and those you ignore. With my lists of blocking, I classify them, personally, into different tiers such as Basic, Recommended, Aggressive, and Paranoid when I apply the rules to other people's (family) setups - I'm the only one that uses Paranoid.
- gzread 7mo agoWhat's the purpose of blocking them, anyway? Is it to make you feel good? To clean up logs? To reduce spam? With the residential proxy industry - which, I note, is directly boosted by such blocking practices and funnels money into organized crime - IPs don't mean a whole lot to those who can pay.
- paulddraper 7mo agoHow do you protect against DDoS?
- deleted 7mo ago[deleted]
- gzread 7mo agoTemporary blocks if and when you are actually being DDoSed, presumably?
- johncolanduoni 7mo agoLarge DDoS botnets will have hundreds of thousands of return-path-capable IP addresses. Your temporary blocks will have to be very sensitive (i.e. trigger on a relatively small number of requests within the time window) for an application-level DDoS to be usefully mitigated.
- gzread 7mo agoSo how does your other plan solve that?
- johncolanduoni 7mo agoOnce an IP in a botnet attacks someone, it ends up on a blocklist and can’t attack anyone else who uses that blocklist. This is a big part of Cloudflare’s DDoS model: if you attack one CF property (with non-volumetric DDoS) you will not be able to attack any others with the same bot for an extended period. This makes attacks to CF properties limited in scope and way more costly, because you have to essentially “burn” IP addresses after sending relatively little traffic.
- gzread 7mo agoHow long does it take for a whole major ISP, say Verizon, to get on your blocklist?
- tptacek 7mo agoI think all the points about IP reputation impact are well taken, but as someone who had to deal with the RIRs at an ISP before and who now works at a firm that buys blocks, I would 10x rather operate in today's environment than in the old RIR environment. It's transparent and predictable by comparison. I never had much faith in reputation to begin with, and the residential block issue is muddied by the fact that large-scale residential proxies already make that an unreliable abuse check.
- hananova 7mo agoI bet if residential proxy ips were added to blocklists en masse that those ISPs would rather quickly clean up their network.
- sandworm101 7mo agoIf residential IPs were blocked, cutting off innocent users from services as IPs rotate, customers would bring lawsuits against ISPs and cell providers. Blocked IPs would have to be parked. Impacted users would rush to VPNs and other privacy tools, damaging the ad industry that is the backbone of most big tech. Everyone would rather deal with today's problems than that chaos.
- Mindwipe 7mo agoI hate to break it to you but services have been routinely blocking residential IPs associated with being part of VPN endpoints for the better part of a decade now. Akamai will even sell you (granted they are just reselling another vendors product) a database to do this.
- sandworm101 7mo agoThe number of residential IPs acting as endpoints is vanishingly small. It isn't an issue. The number of residential IPs that are part of botnets is something else. They are not blocked. Their bad traffic might be, but nobody cuts of an IP simply because a machine on it got a virus once upon a time. If they did, we would all have to negotiate for a new IP every time a machine was compromised.
- phil21 7mo agoHard to take much of this too seriously, since there are total misrepresentations like this: > Their automated reputation management system actively maintains the "cleanliness" of leased IPs, ensuring they don't end up on blacklists — which is a polished way of saying they launder IP reputation as a service. No, as someone who leases some unused blocks via IPXO the entire point of the reputation management system is to centralize abuse reports for them to respond to so they get categorized, tracked, and handled. If more than a few come in the lease gets canceled as that’s against the AUP. I’ve had folks lease a /24 and try some dirt with it, only for IPXO to pull the route within hours. Far faster than I could have responded. As an ip holder I don’t want my resources being abused and added to blocklists so this is important to me. I do indeed plan on taking them off the market for my own use as my IPv4 usage needs increase over time. Until then, leasing them was a way to be able to justify the money spent acquiring some blocks before I got entirely frozen out forever by the hyperscalers and giant companies of the world eating practically every large block they could get their hands on. It’s future proofing my digital sovereignty. IPv4 scarcity is used by the AWS of the world to reduce competition and choice. Geolocation is such a stupid game as it is. I’m in strong support for anything that makes it even more obviously worthless. It’s been gamed by those with the skills and access since it first existed. The internet would be a better place without it. The Whois database stuff is actually a decent point, and I’m working on some ways to automate RIR registration this weekend as chance has it. From time to time I do indeed check where my blocks get advertised and utilized. One /22 right now is being used by a broadband ISP in Europe - and via nmap, traceroute, and BGP looking glass it appears to be legitimate, or at least quite well faked. The other blocks are colo and dedicated server providers competing with AWS/GCP/etc. Who knows what those customers are doing with them - probably a mix of good and bad like everything on the Internet. Functioning as-intended imo. If I'm helping reduce the need for CGNAT and helping a small company stand up to the giant tech conglomerates eating the world I'm calling it a job well done.
- _zoltan_ 7mo agoI agree with 100% also as an IP space owner.
- BLKNSLVR 7mo agoSounds like making IPv6 more commonly used is part of the solution. Reduce the importance of IPv4 and the stranglehold of big conglomerates is forcibly relaxed (in this context at least). I don't like that I've ignored IPv6 for so long that now it feels overwhelming to have to try to grasp. That may be true for a lot of networking folks for whom IPv4 is written in their DNA, given the incredibly slow uptake of IPv6.
- BLKNSLVR 7mo agoI have my own system of IP reputation whereby if an IP address hits one of my systems with some probe or scan that I didn't ask for, then it's blocked for 12 months. https://github.com/UninvitedActivity/UninvitedActivity https://github.com/UninvitedActivity/UninvitedActivity P.S. just to add a note here that I have been blocked out of my own systems occasionally from mobile / remote IPs due to my paranoia-level setup. But I treat that as learning / refinement, but also can accept that as the cost of security sometimes.
- observationist 7mo agoNice, thanks for the link. Good to be ruthless about those things when you can.
- Latty 7mo agoMy first thought is that with CGNAT ever more present, this kind of approach seems like it'll have a lot of collateral damage.
- BLKNSLVR 7mo agoYeah, my setup is purely for my own security reasons and interests, so there's very little downside to my scorched earth approach. I do, however, think that if there was a more widespread scorched earth approach then the issues like those mentioned in the article would be much less common.
- lxgr 7mo agoIn such a world you can say goodbye to any kind of free Wi-Fi, anonymous proxy etc., since all it would take to burn an IP for a year is to run a port scan from it, so nobody would risk letting you use theirs. Fortunately, real network admins are smarter than that.
- deleted 7mo ago[deleted]
- 7mo ago
- mrbluecoat 7mo agoIf only those services required age verification.. /s
- jimz 7mo agoI'm sure that it's real nice to have the lack of IPs be a problem that only tangentially affect one's daily experience but try speaking to someone who lives in a jurisdiction that is de facto independent but because of a frozen conflict or some sort of political dispute that predates their birth can neither be assigned a TLD nor be a member of an RIR. There's a giant first mover advantage and the system devised to dish out IPv4 subnets is essentially a cartel. The secondary markets is the rational economic response in the face of a market that is monopolistic, poorly designed, and acts as an absolute gatekeeper to something that's fundamental to life in modern times. The fact is that just because states and police really wish that 1 IP = 1 person but in reality that's hardly true. Residential and non-residential IPs are not really different. The resource is misallocated and what else does anyone expect? If investigations into actual criminal activity is solely based on IP addresses then it has always been one that is done incompetently. Sorry that the heuristic most convenient to the state isn't actually that great for what the state appropriated it to do. Whose fault is that? IP Geolocation is a massive backdoor whose purported efficacy has been used for geofencing warrants that basically make a mockery out of probable cause. It is also used for no good reason to help authoritarian nations and in the name of jingoism ends up inconveniencing people at the very least. My father spends 3-5 months out of the year in China and while there, he can't access his mortgage company and can't call them, can't renew his vehicle registration, can't check his gmail, and can't even purchase, but can nevertheless run, Turbotax. He's American, and there are hundreds of thousands of Americans overseas that find themselves in this awkward spot because of overreliance on one bad heuristic. So I have to pay his mortgage until he returns, every year for months, and also essentially while imitating him take care of a bunch of quotidian things that he can certainly do himself but since it's hard to teach a 65 year old man how to hop the GFW reliably, I have to go through this rigamarole. Imagine if I didn't have some cash set aside, or that I haven't paid for my own dwelling already. It certainly doesn't stop state actors from attacking when they want, but it sure makes it easy to pretend like you did something meaningful while in reality all you've done is inconvenienced your own customers. The system is broken, lamenting that fact isn't a good look. The marketplace, in fact, is hardly a mess. It has competition, it has decentralized regulatory features, do you prefer all such deals go through say LET's massive thread on it instead? https://lowendtalk.com/discussion/160162/aio-ip-related-ipv4-ipv6-asn-thread-only-providers-lirs-are-allowed-to-post-offers#latest https://lowendtalk.com/discussion/160162/aio-ip-related-ipv4...
- gzread 7mo agoacidvegas is a pretty shady guy himself, running an IRC spam network pretty much in broad daylight. I don't know what to make of this connection, except he probably has a reason for posting this that's slightly more nefarious than sharing some interesting knowledge.
- acid_vegas 7mo ago[flagged]
- ackbar03 7mo agothis guy most dangerous motherf* man, so edgy, what do you expect
- JasonADrury 7mo agoYou've also got the fugitive neo-Nazi weev, who now hides in the Russian-backed separatist region of Transnistria as an admin on his IRC. Not to mention the ransomware guy who is again being sought by Interpol, also an op on acidvegas's IRC. irc.supernets.org is truly one of the shadiest places on the internet. I wouldn't connect even over Tor.
- gzread 7mo agoOh I've been there. If he doesn't like you he spams you with "you just joined a channel" protocol messages until your client crashes from being in too many channels - most clients don't survive that. I can't fault the ingenuity.
- _notdan_ 7mo agoThis is absolutely unbelievable. I cant believe weev has admin on supernets and I dont, wtf.
- JasonADrury 7mo agoI've read on Brian Krebs that you and Sergio Gor are both russian. I don't think you'll have difficulty getting ops
- 9cb14c1ec0 7mo agoBanning IP leasing would concentrate power in the hands of those who have large IP blocks. Makes one wonder what the real motivation behind this post is.
- zbentley 7mo agoI mean…not curtailing leasing concentrates power with sketchy rent seekers and empowers the enterprises which use them (many of which range from “sketchy” to “evil and criminal”). So I guess I’m having trouble envisioning a world without IP leasing that’s materially worse than the one we have.
- TZubiri 7mo agoHave you tried getting an ipblock from a RIR and failed? they seem widely available if you justify it and at a reasonable price. If not, you can always go to a host and buy at a smaller fraction...
- oarsinsync 7mo ago> Have you tried getting an ipblock from a RIR and failed? they seem widely available if you justify it and at a reasonable price RIPE wont "sell" me an IP block, no matter how reasonable a price I offer. RIPE will gladly let me pay them LIR annual membership dues for 2 years before they consider allocating me a /24 (based on current waiting list times)
- TZubiri 7mo agoI was aware of the yearly membership (600$/yr in my RIR), and that they are on a per request basis where you have to demonstrate that you will put those IPs to the use and benefit of the general public, so you need to talk about your users basically, and if you are B2B you need to talk about your client's users. But in my RIR I don't think there's a 2 year minimum. Regarding IPv6 blocks do those require a 2 year membership as well? They are probably easier to get.
- dsl 7mo ago
- TZubiri 7mo agoIt's like selling shell companies, or buying passports. This extends to IP proxies and yes VPNs. The issue with the latter is that they psyop some genuine users into using the tech for dumb reasons like less gaming latency so that they have plausible deniability
- sjtgraham 7mo ago> The "exhaustion" isn't a technical crisis. It's a landlord problem. > These aren't niche services. They are the backbone of how major VPN and proxy providers operate. > This isn't datacenter IP space being labeled as residential — it's actual ISP networks being leveraged as proxy pipes The "this isn't X, it's Y" construction is a bright red tell for AI slop. Posting AI slop is just bad manners.
- efilife 7mo agoAlso, the "why it matters" and bullet lists that directly follow it. But I think this post was hand written to some extent then fed to AI for "polishing it up"
- pigggg 7mo agoRenting /24s by the hour is like a motel room rented by the hour. You know some shit is going on in there.
- pigggg 7mo agoMy biggest issue with IP brokers is how they'll avoid taking any responsibility for their customers action. A fair amount of bullet proof hosters (and we're talking malware distribution, botnet c2s, ransomware c2s, proxy/scanning) get their space from brokers. When you engage with the brokers they say go talk to the transit providers - and because the bullet proof guys can switch off to another transit provider easily they maintain connectivity/continue to operate. Super common in Europe where most of this goes on and they have a super plentiful transit market - but they are still rolling with the same set of IPs they get from these brokers (and one in particular).
- 47282847 7mo agoI thought these days one can go directly to the RIR in case neither LIR nor the IP end-user acts on repeated/ongoing abuse? With the ongoing tension between central policy enforcement mechanisms vs. net/jurisdictional neutrality…
- nubinetwork 7mo ago> When you can pay to delist an IP from every major spam blacklist, those blacklists stop being useful. Ohhh.... is that why I'm broke? /s
- xunairah 7mo agosourcing crises, industry is currently split into two camps: The 'Dark' Supply Chain: SDKs hidden in flashlight apps, cracked IoT devices (Kimwolf), and malware. The user has no idea they are a proxy. This is unsustainable and, frankly, unethical. The 'Ethical' Supply Chain: Bandwidth sharing apps (like Honeygain, Pawns, etc.) where the user knowingly installs the software in exchange for payment. The problem is that Camp #1 is cheaper to run, so it floods the market with 'cheap residential IPs.' Camp #2 requires paying the end-user, which raises the floor price. Until buyers stop chasing the absolute lowest price per GB, the incentive for 'malware proxies' remains. The solution isn't just router-level blocking (which creates false positives for legitimate P2P), but transparency in sourcing. If a provider can't tell you how they acquired the IP, it's likely stolen.
- ting0 7mo agoThis is an AI generated article.
- malklera 7mo agoAre these problems we want to fix? A direct example of this is the situation of Spain and soccer.
- drnick1 7mo ago> We're talking about paying to get IPs delisted from spam blacklists, choosing arbitrary geolocations with no validation, buying "unattributable" white-labeled address space, and renting residential IPs that make traffic look like it's coming from someone's house. Sounds pretty good from a privacy point of view, and a natural response to big tech and governments trying to fingerprint and track everyone.
- Btmviolet123 7mo agoInteresting perspective. The IPv4 leasing ecosystem does have areas that lack transparency, especially in multi-layer subleasing models. Some newer platforms, like LARUS (larus.net), are trying to address this by offering direct first-party IPv4 leasing and verified resource ownership, which could bring more structure and trust to the market.