New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Let's find the dirtiest VPS IP on LowEndTalk
Bought a cheap VPS recently?
Before deploying anything, I usually want to know whether the IP already has a bad history.
So I built NetRiskScan.
Paste an IP → it combines several reputation/risk signals → gives one 0–100 NetRiskScan Index.
Higher = cleaner.
https://netriskscan.com
Try yours:
NetRiskScan.com
I want to do a small LET experiment:
Post your provider + location + NetRiskScan Index.
Especially interested in:
$1–3 VPS
recently reassigned IPs
IPs triggering Cloudflare/Google CAPTCHA
VPN/datacenter false positives
If the score looks completely wrong, even better — send it to me so I can fix the scoring.
Comments
Anyway, the scores are kind of wrong. The Tor exit relays I host seem to get 15% high-risk, which is silly for an IP that gets an abuse report on AbuseIPDB every few minutes and literally functions as an open proxy.
That's a very good catch — and I agree.
A confirmed Tor exit node should be treated as a strong risk signal rather than being averaged out by lower-risk reputation signals from other providers.
I'm going to review the scoring logic here. My current thinking is that a reliably detected Tor exit/open proxy should place a hard upper limit on the NetRiskScan Index, regardless of otherwise clean geolocation/reputation data.
If you're willing, I'd also be very interested in testing a few of your Tor exit IPs against the updated scoring logic. With 50+ relays, that would be extremely useful real-world test data.
Thanks — this is exactly the kind of edge case I was hoping LET would find.
I wouldn't always set it at a hard upper limit. Each exit can define an "exit policy" which determines what ports can be accessed through it. The strictest possible exit policy only allows ports 80 and 443. An exit with that policy cannot be used to send outbound SMTP or perform SSH brute forcing, for example. More relaxed exit policies increase the potential for abuse.
I only run a few exits. Most of my relays are middles. Here are the exits:
IPv4: 94.156.152.8, 151.242.30.113, 102.211.56.20, 150.40.126.103, 23.137.105.248, 178.175.148.155, 176.65.134.8, 45.133.73.184, 45.133.73.35, 195.47.238.50
IPv6: 2c0f:6c0:0:11::b00:b1e5, 2a0e:bfc7:300:c0::734c, 2602:fb54:1400::1d, 2a00:1dc0:caff:f4::bad5, 2602:f915:7:5a6c::1, 2a14:c380:d70:8d::a, 2a14:c380:d70:1b::a, 2a0c:5700:3133:507:9e7b:4fff:fe4d:4813
Btw, an up-to-date complete list of Tor exits is published by the Tor Project.