The shady world of IP leasing

I think all the points about IP reputation impact are well taken, but as someone who had to deal with the RIRs at an ISP before and who now works at a firm that buys blocks, I would 10x rather operate in today's environment than in the old RIR environment. It's transparent and predictable by comparison.

I never had much faith in reputation to begin with, and the residential block issue is muddied by the fact that large-scale residential proxies already make that an unreliable abuse check.

My biggest issue with IP brokers is how they'll avoid taking any responsibility for their customers action. A fair amount of bullet proof hosters (and we're talking malware distribution, botnet c2s, ransomware c2s, proxy/scanning) get their space from brokers. When you engage with the brokers they say go talk to the transit providers - and because the bullet proof guys can switch off to another transit provider easily they maintain connectivity/continue to operate. Super common in Europe where most of this goes on and they have a super plentiful transit market - but they are still rolling with the same set of IPs they get from these brokers (and one in particular).

acidvegas is a pretty shady guy himself, running an IRC spam network pretty much in broad daylight. I don't know what to make of this connection, except he probably has a reason for posting this that's slightly more nefarious than sharing some interesting knowledge.

Banning IP leasing would concentrate power in the hands of those who have large IP blocks. Makes one wonder what the real motivation behind this post is.

I have my own system of IP reputation whereby if an IP address hits one of my systems with some probe or scan that I didn't ask for, then it's blocked for 12 months.

https://github.com/UninvitedActivity/UninvitedActivity

P.S. just to add a note here that I have been blocked out of my own systems occasionally from mobile / remote IPs due to my paranoia-level setup. But I treat that as learning / refinement, but also can accept that as the cost of security sometimes.

Hard to take much of this too seriously, since there are total misrepresentations like this:

> Their automated reputation management system actively maintains the "cleanliness" of leased IPs, ensuring they don't end up on blacklists — which is a polished way of saying they launder IP reputation as a service.

No, as someone who leases some unused blocks via IPXO the entire point of the reputation management system is to centralize abuse reports for them to respond to so they get categorized, tracked, and handled. If more than a few come in the lease gets canceled as that’s against the AUP. I’ve had folks lease a /24 and try some dirt with it, only for IPXO to pull the route within hours. Far faster than I could have responded.

As an ip holder I don’t want my resources being abused and added to blocklists so this is important to me. I do indeed plan on taking them off the market for my own use as my IPv4 usage needs increase over time. Until then, leasing them was a way to be able to justify the money spent acquiring some blocks before I got entirely frozen out forever by the hyperscalers and giant companies of the world eating practically every large block they could get their hands on.

It’s future proofing my digital sovereignty. IPv4 scarcity is used by the AWS of the world to reduce competition and choice.

Geolocation is such a stupid game as it is. I’m in strong support for anything that makes it even more obviously worthless. It’s been gamed by those with the skills and access since it first existed. The internet would be a better place without it.

The Whois database stuff is actually a decent point, and I’m working on some ways to automate RIR registration this weekend as chance has it.

From time to time I do indeed check where my blocks get advertised and utilized. One /22 right now is being used by a broadband ISP in Europe - and via nmap, traceroute, and BGP looking glass it appears to be legitimate, or at least quite well faked. The other blocks are colo and dedicated server providers competing with AWS/GCP/etc. Who knows what those customers are doing with them - probably a mix of good and bad like everything on the Internet. Functioning as-intended imo. If I'm helping reduce the need for CGNAT and helping a small company stand up to the giant tech conglomerates eating the world I'm calling it a job well done.

Renting /24s by the hour is like a motel room rented by the hour. You know some shit is going on in there.

Interesting perspective. The IPv4 leasing ecosystem does have areas that lack transparency, especially in multi-layer subleasing models. Some newer platforms, like LARUS (larus.net), are trying to address this by offering direct first-party IPv4 leasing and verified resource ownership, which could bring more structure and trust to the market.

> We're talking about paying to get IPs delisted from spam blacklists, choosing arbitrary geolocations with no validation, buying "unattributable" white-labeled address space, and renting residential IPs that make traffic look like it's coming from someone's house.

Sounds pretty good from a privacy point of view, and a natural response to big tech and governments trying to fingerprint and track everyone.

It's like selling shell companies, or buying passports.

This extends to IP proxies and yes VPNs. The issue with the latter is that they psyop some genuine users into using the tech for dumb reasons like less gaming latency so that they have plausible deniability

Are these problems we want to fix?

A direct example of this is the situation of Spain and soccer.

sourcing crises, industry is currently split into two camps: The 'Dark' Supply Chain: SDKs hidden in flashlight apps, cracked IoT devices (Kimwolf), and malware. The user has no idea they are a proxy. This is unsustainable and, frankly, unethical. The 'Ethical' Supply Chain: Bandwidth sharing apps (like Honeygain, Pawns, etc.) where the user knowingly installs the software in exchange for payment. The problem is that Camp #1 is cheaper to run, so it floods the market with 'cheap residential IPs.' Camp #2 requires paying the end-user, which raises the floor price. Until buyers stop chasing the absolute lowest price per GB, the incentive for 'malware proxies' remains. The solution isn't just router-level blocking (which creates false positives for legitimate P2P), but transparency in sourcing. If a provider can't tell you how they acquired the IP, it's likely stolen.