Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › Shadiest Web Hosts?
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Shadiest Web Hosts?

KobeKobe Member
edited June 2018 in Providers

What are the shadiest networks that I should block on all my networks? I want to do a blanket ban on all hosts that knowingly host malicious applications and controllers.

So far my list is Ecatel, Ubiquity, 2x4 and removed.

Kind of on the fence about [Redacted], awesome provider that I use but often used by skiddies for their public VPN nodes. Same goes for HostSailor.

Thanked by 2GCat mehargags
«1

Comments

  • jarjar Patron Provider, Top Host, Veteran

    Don't forget Ecatel is now Quasi Networks. So make sure you get all of those ranges :)

    Thanked by 1GCat
  • GCatGCat Member
    edited August 2016

    Well, since we're listing...

    1. Retrosnub ( http//www.retrosnub.co.uk/dedicated )

    https//spoofer.caida.org/report.php?sessionid=65855

    1. PacketHost( https//www.packet.net/ )

    https//spoofer.caida.org/report.php?sessionid=65700

    1. SuperHostingCZ ( https//www.superhosting.cz/ )

    https//spoofer.caida.org/report.php?sessionid=65431

    1. 10Gbps.io (SuperHostingCZ) ( https//10gbps.io/ )

    https//spoofer.caida.org/report.php?sessionid=65431

    1. Iperweb ( http//iperweb.com/home/ )

    https//spoofer.caida.org/report.php?sessionid=65015

    1. Prometeus ( http//www.prometeus.net/site/ )

    https//spoofer.caida.org/report.php?sessionid=64231

    1. HostSailor ( https//hostsailor.com/ )

    https//spoofer.caida.org/report.php?sessionid=62294

    1. QueryFoundry ( https//queryfoundry.com )

    https//spoofer.caida.org/report.php?sessionid=61433

    1. ReliableHosting ( https//www.reliablehostingservices.net )

    https//spoofer.caida.org/report.php?sessionid=55958

    1. IPServerSU ( https//www.ipserver.su/ )

    https//spoofer.caida.org/report.php?sessionkey=oope4rtioq1lbl

    1. Tele2 ( https//www.tele2.at/business/managed-se...ted-server )

    https//spoofer.caida.org/report.php?sessionid=57267

    1. FirstHeberg ( https//www.firstheberg.com/ )

    https//spoofer.caida.org/report.php?sessionid=56718

    1. WOWRack ( http//www.wowrack.com/ )

    https//spoofer.caida.org/report.php?sessionid=56632

    1. SoftLayer (FR DC) ( http//www.softlayer.com/ )

    https//spoofer.caida.org/report.php?sessionid=56565

    1. NTX ( http//ntx.ru/ )

    https//spoofer.caida.org/report.php?sessionid=56505

    1. IOFlood ( http//www.ioflood.com/ )

    https//spoofer.caida.org/report.php?sessionid=56417

    1. CnServers ( http//billing.cnservers.com/ )

    https//spoofer.caida.org/report.php?sessionid=56315

    1. Ecatel (QuasiNetworks) ( http//ecatel.co.uk/cdn.php )

    https//spoofer.caida.org/report.php?sessionid=56292

    1. QuasiNetworks (Ecatel) ( http//quasinetworks.com/ )

    https//spoofer.caida.org/report.php?sessionid=56292

    1. LibertyVPS (QuasiNetworks)( https//libertyvps.net/ )

    https//spoofer.caida.org/report.php?sessionid=56292

    1. HostAG ( https//www.host.ag/ )

    https//spoofer.caida.org/report.php?sessionid=55167

    1. DediDam ( http//dedidam.net )

    https//spoofer.caida.org/report.php?sessionid=54872

    1. HostHatch ( https//hosthatch.com/ )

    https//spoofer.caida.org/report.php?sessionid=56223

    1. PrivateLayer ( https//privatelayer.com/ )

    https//spoofer.caida.org/report.php?sessionid=56204

    1. StepHostMD ( https//stephost.md/ )

    https//spoofer.caida.org/report.php?sessionid=62212

    1. Verdina ( http//verdina.net/ )

    https//spoofer.caida.org/report.php?sessionid=56169

    1. Contabo ( https//contabo.de/ )

    https//spoofer.caida.org/report.php?sessionid=56082

    1. SimplexHosts (Contabo) ( http//simplexhosts.com/)

    https//spoofer.caida.org/report.php?sessionid=56082

    1. ColoCrossing ( https//www.colocrossing.com/ )

    https//spoofer.caida.org/report.php?sessionid=54817

    1. NociX (nDeviX) ( https//www.nocix.net/ )

    https//spoofer.caida.org/report.php?sessionid=56977

    1. WholeSaleInternet (nDeviX) ( https//www.wholesaleinternet.net )

    https//spoofer.caida.org/report.php?sessionid=56977

  • ZeastZeast Member

    There is a lot of no-malicious websites on hostsailor.

  • KobeKobe Member

    @Zeast said:
    There is a lot of no-malicious websites on hostsailor.

    Valid point, I kind of want to add that to HostUS and what not - case by case basis.

  • busbrbusbr Member

    @GCat said:

    1. Iperweb ( http//iperweb.com/home/ )

    https//spoofer.caida.org/report.php?sessionid=65015

    1. Prometeus ( http//www.prometeus.net/site/ )

    I thought these guys have a nice reputation on LET. Did anything change?

  • jarjar Patron Provider, Top Host, Veteran

    @GCat I think you might be almost in this territory:

    ip route add blackhole 0.0.0.0/0

    Thanked by 3GCat HyperSpeed Inglar
  • ZeastZeast Member

    @GCat said:
    Well, since we're listing...

    Time to buy new spoofed servers for my stresser!!!11one

    jk

    Thanked by 1GCat
  • KobeKobe Member
    edited August 2016

    @busbr said:

    @GCat said:

    1. Iperweb ( http//iperweb.com/home/ )

    https//spoofer.caida.org/report.php?sessionid=65015

    1. Prometeus ( http//www.prometeus.net/site/ )

    I thought these guys have a nice reputation on LET. Did anything change?

    Seflow and Prometeus have really stringent abuse policies for sure, but they're used for VPN exit nodes a lot by skiddies. In general, I'd list them as good though.

    Thanked by 1eLohkCalb
  • ricardoricardo Member

    Surely any host of appreciable size is going to end up on one list or another, for an amount of time.

    Various shades of grey etc. OVH must seem quite shady by some standards, yet one of the biggest providers on the planet.

  • MikeAMikeA Member, Patron Provider

    @ricardo said:
    Surely any host of appreciable size is going to end up on one list or another, for an amount of time.

    Various shades of grey etc. OVH must seem quite shady by some standards, yet one of the biggest providers on the planet.

    Good thing about OVH is that they automatically block IPs that send out attacks from their network, same for mass mail spam.

  • Domin43Domin43 Member

    any good script for blocking tons of ip blocks from a list

  • seriesnseriesn Member
    edited August 2016

    Unless you are running your own switch, all these blocking might have a very bad affect on your box. Then again I might be thinking about something completely different. It is Sunday night after all.

  • Domin43Domin43 Member

    @seriesn said:
    Unless you running your own switch, all these blocking might have a very bad affect on your box. Then again I might be thinking about something completely different. It is Sunday night after all.

    I heard iptables can handle an extreme quantity with no problem or am i hearing things?

  • IshaqIshaq Member

    @Domin43 said: I heard iptables can handle an extreme quantity with no problem or am i hearing things?

    If not OpenVZ, ipset is a good choice.

  • globalRegistersglobalRegisters Member

    Psychz Networks.

    Used to get a ton of malicious activity from these guys.
    I have been blocking them for a year now.

  • IshaqIshaq Member

    @globalRegisters said:
    Psychz Networks.

    Used to get a ton of malicious activity from these guys.
    I have been blocking them for a year now.

    They've cleaned up their act. We use them.

    They don't tolerate anything.

  • globalRegistersglobalRegisters Member

    @Ishaq said:

    @globalRegisters said:
    Psychz Networks.

    Used to get a ton of malicious activity from these guys.
    I have been blocking them for a year now.

    They've cleaned up their act. We use them.

    They don't tolerate anything.

    Good to know, thanks!

  • ZeastZeast Member

    @globalRegisters said:

    @Ishaq said:

    @globalRegisters said:
    Psychz Networks.

    Used to get a ton of malicious activity from these guys.
    I have been blocking them for a year now.

    They've cleaned up their act. We use them.

    They don't tolerate anything.

    Good to know, thanks!

    same, lol

  • WilliamWilliam Member

    Ishaq said: They don't tolerate anything.

    Anything not targeted at Asia.

  • pbgbenpbgben Member, Host Rep

    @MikeA said:

    @ricardo said:
    Surely any host of appreciable size is going to end up on one list or another, for an amount of time.

    Various shades of grey etc. OVH must seem quite shady by some standards, yet one of the biggest providers on the planet.

    Good thing about OVH is that they automatically block IPs that send out attacks from their network, same for mass mail spam.

    Yes, this happened again for me yesterday. The spammer got two IP's blocked before the account was disabled.

  • jh_aurologicjh_aurologic Member, Patron Provider

    Makes no sense to block them, as they only allow spoofing or dont have some spoofing protection like RPF in place. Spoofing means, that you may receive traffic from their network, but not from prefixes which has been announced by them.

    @GCat said:
    Well, since we're listing...

    1. Retrosnub ( http//www.retrosnub.co.uk/dedicated )

    https//spoofer.caida.org/report.php?sessionid=65855

    1. PacketHost( https//www.packet.net/ )

    https//spoofer.caida.org/report.php?sessionid=65700

    1. SuperHostingCZ ( https//www.superhosting.cz/ )

    https//spoofer.caida.org/report.php?sessionid=65431

    1. 10Gbps.io (SuperHostingCZ) ( https//10gbps.io/ )

    https//spoofer.caida.org/report.php?sessionid=65431

    1. Iperweb ( http//iperweb.com/home/ )

    https//spoofer.caida.org/report.php?sessionid=65015

    1. Prometeus ( http//www.prometeus.net/site/ )

    https//spoofer.caida.org/report.php?sessionid=64231

    1. HostSailor ( https//hostsailor.com/ )

    https//spoofer.caida.org/report.php?sessionid=62294

    1. QueryFoundry ( https//queryfoundry.com )

    https//spoofer.caida.org/report.php?sessionid=61433

    1. ReliableHosting ( https//www.reliablehostingservices.net )

    https//spoofer.caida.org/report.php?sessionid=55958

    1. IPServerSU ( https//www.ipserver.su/ )

    https//spoofer.caida.org/report.php?sessionkey=oope4rtioq1lbl

    1. Tele2 ( https//www.tele2.at/business/managed-se...ted-server )

    https//spoofer.caida.org/report.php?sessionid=57267

    1. FirstHeberg ( https//www.firstheberg.com/ )

    https//spoofer.caida.org/report.php?sessionid=56718

    1. WOWRack ( http//www.wowrack.com/ )

    https//spoofer.caida.org/report.php?sessionid=56632

    1. SoftLayer (FR DC) ( http//www.softlayer.com/ )

    https//spoofer.caida.org/report.php?sessionid=56565

    1. NTX ( http//ntx.ru/ )

    https//spoofer.caida.org/report.php?sessionid=56505

    1. IOFlood ( http//www.ioflood.com/ )

    https//spoofer.caida.org/report.php?sessionid=56417

    1. CnServers ( http//billing.cnservers.com/ )

    https//spoofer.caida.org/report.php?sessionid=56315

    1. Ecatel (QuasiNetworks) ( http//ecatel.co.uk/cdn.php )

    https//spoofer.caida.org/report.php?sessionid=56292

    1. QuasiNetworks (Ecatel) ( http//quasinetworks.com/ )

    https//spoofer.caida.org/report.php?sessionid=56292

    1. LibertyVPS (QuasiNetworks)( https//libertyvps.net/ )

    https//spoofer.caida.org/report.php?sessionid=56292

    1. HostAG ( https//www.host.ag/ )

    https//spoofer.caida.org/report.php?sessionid=55167

    1. DediDam ( http//dedidam.net )

    https//spoofer.caida.org/report.php?sessionid=54872

    1. HostHatch ( https//hosthatch.com/ )

    https//spoofer.caida.org/report.php?sessionid=56223

    1. PrivateLayer ( https//privatelayer.com/ )

    https//spoofer.caida.org/report.php?sessionid=56204

    1. StepHostMD ( https//stephost.md/ )

    https//spoofer.caida.org/report.php?sessionid=62212

    1. Verdina ( http//verdina.net/ )

    https//spoofer.caida.org/report.php?sessionid=56169

    1. Contabo ( https//contabo.de/ )

    https//spoofer.caida.org/report.php?sessionid=56082

    1. SimplexHosts (Contabo) ( http//simplexhosts.com/)

    https//spoofer.caida.org/report.php?sessionid=56082

    1. ColoCrossing ( https//www.colocrossing.com/ )

    https//spoofer.caida.org/report.php?sessionid=54817

    1. NociX (nDeviX) ( https//www.nocix.net/ )

    https//spoofer.caida.org/report.php?sessionid=56977

    1. WholeSaleInternet (nDeviX) ( https//www.wholesaleinternet.net )

    https//spoofer.caida.org/report.php?sessionid=56977

    Thanked by 1UrDN
  • doughmanesdoughmanes Member

    GlobalFrag?

    Thanked by 6OpticalSwoosh Francisco eLohkCalb PrColo GCat DomainBop
  • joepie91joepie91 Member, Patron Provider

    IP blocking isn't really a reasonable way to deal with abuse. You're going to have a ton of false positives, and still not actually prevent the abuse.

    Block the actual abuse itself instead. Plenty of methods for that, and I'll happily make suggestions if you describe a concrete scenario...

    Thanked by 1GCat
  • FalzoFalzo Member

    @Ishaq said:

    @Domin43 said: I heard iptables can handle an extreme quantity with no problem or am i hearing things?

    If not OpenVZ, ipset is a good choice.

    https://github.com/trick77/ipset-blacklist

  • lootloot Member

    Well, I also think that some of these have a business strategy that's affiliate-centered and hosting-second, which would explain things.

  • PrColoPrColo Member

    @doughmanes said:
    GlobalFrag?

    GlobalFrag is quite the headache.

  • ButtersButters Member

    Ecatel, NFOrce, Dotsi (owned by blazingfast.io)

  • plueschopathplueschopath Member

    @Butters said:

    NFOrce

    hmm.. why?

  • UrDNUrDN Member

    IP blocking is security through obscurity.

    If you run vulnerable stuff on your network, then pebcak and you should reconsider yourself. You also better get compromised by script-kiddies rather than facing a more sophisticated attack.

    Thanked by 1vimalware
  • globalRegistersglobalRegisters Member

    @UrDN said:
    IP blocking is security through obscurity.

    Apparently everything one does nowadays is classified as "security through obscurity". LOL.

Sign In or Register to comment.