IP is unexpectedly listed as "toxic"

smileBeda · 2023-11-13 9:46 am

I am using a VPN often, and today I connected to it through Germany.
The VPN offers the address as "Germany - Frankfurt am Main #006"
This is a STATIC IP.

I immediately got kicked out from my website where I deploy a SFS check for listed IPs.
Indeed maybe I should increase tolerance a little, since the specific IP (`169.150.209.215`) is listed "only" four times in SFS:
https://www.stopforumspam.com/ipcheck/169.150.209.215

However, I wanted to hear what the community here has to say in regard. This appears a bit weird to me.
How could that IP be listed as _verified_ in SFS, if it is a VPN Static IP?
(And, I now understand why it is so important that lists at SFS are actually verified IP/Mail/Username etc. It is exactly this kind of issues that you try to avoid with it, I do understand that now even better than when I asked about).

Concluding - what is the general suggestion to avoid these "false flags? Should I rather contact my VPN Provider and tell them about the misuse of their STATIC IPs? (Note that this is the important bit for me. A "random IP" is obviously going to be high target for anything, but Static? They should own it, I presume? And thus also monitor for blacklists?)

Perhaps I get all this wrong. I would appreciate some input.

Thanks!

BlueEyed Zebra · 2023-11-13 11:41 am

Hi!

I'm one of the hardest bones in ZB Block. My policy is, that servers do not vissit websites, only humans do.
Did you ever looked at your server/website logfiles and thought about them? You can trash 90% of all requests.

Take that IP and ask AbuseDB, anything listed in FireHOL and multirbl.valli.0rg, you will see, that this IP was not only used for forumspam. ProjectHoneypot lists most IPv4 (with a date), because IPs and ASNs change and most things were used for something in the past.

Setup some "weighting/rating"-system is job of the plugin vendor, but such a thing can remove security, because there will be people, who will lower their security, due to one important user uses this and that, and they will end up with SPF requests, but they are nullifyed.

That is only my opinion.

,,,^..^(")

Alex Kemp · 2023-11-13 3:41 pm

Look for "Confidence scoring" in the SFS API Usage page for the SFS in-built system.

pedigree · 2023-11-16 2:26 am

It's not listed as toxic but it does have 4 records associated with it.

If 169.150.209.215 is a VPN provider then how many people use this IP as their egress IP? If its a large VPN provider then it could be carrier grade NAT which means hundreds or even thousands of people share an IP address. That's a lot of trust being placed in every one to not be a bad net citizen.

Almost every VPN provider, consumer grade ones anyway, are abused by spammers. The collateral is the legitimate user

pedigree · 2023-11-16 4:24 am

BlueEyed Zebra has the right line of thinking, that being...

"Why would I let a data center IP address post messages on my forum about Gerbils?"

... you wouldn't

#1 2023-11-13 9:46 am

IP is unexpectedly listed as "toxic"

#2 2023-11-13 11:41 am

Re: IP is unexpectedly listed as "toxic"

#3 2023-11-13 3:41 pm

Re: IP is unexpectedly listed as "toxic"

#4 2023-11-16 2:26 am

Re: IP is unexpectedly listed as "toxic"

#5 2023-11-16 4:24 am

Re: IP is unexpectedly listed as "toxic"

Board footer