New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Let's find the dirtiest VPS IP on LowEndTalk
Bought a cheap VPS recently?
Before deploying anything, I usually want to know whether the IP already has a bad history.
So I built NetRiskScan.
Paste an IP → it combines several reputation/risk signals → gives one 0–100 NetRiskScan Index.
Higher = cleaner.
https://netriskscan.com
Try yours:
NetRiskScan.com
I want to do a small LET experiment:
Post your provider + location + NetRiskScan Index.
Especially interested in:
$1–3 VPS
recently reassigned IPs
IPs triggering Cloudflare/Google CAPTCHA
VPN/datacenter false positives
If the score looks completely wrong, even better — send it to me so I can fix the scoring.
Comments
Anyway, the scores are kind of wrong. The Tor exit relays I host seem to get 15% high-risk, which is silly for an IP that gets an abuse report on AbuseIPDB every few minutes and literally functions as an open proxy.
That's a very good catch — and I agree.
A confirmed Tor exit node should be treated as a strong risk signal rather than being averaged out by lower-risk reputation signals from other providers.
I'm going to review the scoring logic here. My current thinking is that a reliably detected Tor exit/open proxy should place a hard upper limit on the NetRiskScan Index, regardless of otherwise clean geolocation/reputation data.
If you're willing, I'd also be very interested in testing a few of your Tor exit IPs against the updated scoring logic. With 50+ relays, that would be extremely useful real-world test data.
Thanks — this is exactly the kind of edge case I was hoping LET would find.
I wouldn't always set it at a hard upper limit. Each exit can define an "exit policy" which determines what ports can be accessed through it. The strictest possible exit policy only allows ports 80 and 443. An exit with that policy cannot be used to send outbound SMTP or perform SSH brute forcing, for example. More relaxed exit policies increase the potential for abuse.
I only run a few exits. Most of my relays are middles. Here are the exits:
IPv4: 94.156.152.8, 151.242.30.113, 102.211.56.20, 150.40.126.103, 23.137.105.248, 178.175.148.155, 176.65.134.8, 45.133.73.184, 45.133.73.35, 195.47.238.50
IPv6: 2c0f:6c0:0:11::b00:b1e5, 2a0e:bfc7:300:c0::734c, 2602:fb54:1400::1d, 2a00:1dc0:caff:f4::bad5, 2602:f915:7:5a6c::1, 2a14:c380:d70:8d::a, 2a14:c380:d70:1b::a, 2a0c:5700:3133:507:9e7b:4fff:fe4d:4813
Btw, an up-to-date complete list of Tor exits is published by the Tor Project.
You can use https://onionoo.torproject.org/details?search=flag:exit&fields=exit_addresses,exit_policy_summary to get a JSON list of exit relays and the ports they can exit to. The structure looks like:
First 250 lines of prettified JSON (click to expand)
The file is updated every hour, although it doesn't change that much. The
exit_policy_summaryfield contains one key, which will be eitheracceptorreject. The value is a list of ports or ranges of ports that the IP can exit to. If it'saccept, then those are the only ports that can exit. If it'sreject, then any port is allowed except those listed. Thus"exit_policy_summary": { "reject": [ "25" ] }and"exit_policy_summary": { "accept": [ "1-24", "26-65535" ] }are equivalent. Do note that Tor can only exit TCP traffic.I'd strongly recommend immediately resetting the score of an IP as soon as it falls off this list!
This site is irrelevant, nobody is using it and their methodology is not transparent.
IPQualityscore, FraudCheck, Scamalytics, are those kinds of services that platforms
integrate for their "dirtyness" detection.
If a service determines that an IP is dirty because it's a datacenter, they can GTFO.
@yangqq753
I just checked seven of my infrastructure servers and all got scores between 92 and 94, and 2 of those servers very highly likely do not have good IP rep.
Sorry, but something with your scoring seems to be quite off.
Please explain the logic of your scoring system.
What does this tool do exactly?
It fails to properly identify IP addresses actively scanning the internet, with thousands of reports on other sources. Taking
45.153.34.149or80.94.92.179as an example.69.69.69.69?
Thanks for testing seven different servers — this is exactly the kind of feedback I was hoping to get from LET.
I agree that having all seven results clustered around 92–94, especially when you already know that at least two of those IPs have questionable reputation, suggests that the current scoring model is not differentiating risk strongly enough.
The current NetRiskScan Index is a 0–100 cleanliness score — higher means cleaner. Internally, it normalizes signals from multiple IP reputation/network data sources and combines things such as proxy/VPN/Tor detection, hosting/network type, abuse/reputation signals and other IP characteristics.
Your test has exposed a weakness in the current aggregation: ordinary/neutral signals can currently dilute stronger negative reputation signals too much. I'm changing that so that strong evidence such as confirmed Tor exits, open proxies, active/recent abuse and multiple independent reputation flags has much more influence, while simply being a datacenter/VPS IP will not automatically make an IP "dirty."
I'm also adding better handling for
unknown/unsupported data and provider failures, so missing data won't accidentally be interpreted as a clean signal.I don't want to publish a precise weighting table yet because I'm actively changing it based on these real-world tests, and I'd rather not pretend the current formula is more mature than it is.
If you're willing, I'd be very interested in the two IPs you mentioned that you believe have poor reputation. They would make excellent regression cases — I'd like to compare their current scores with the revised model and post the before/after results here.
Thanks again — this was a very useful test.
You're right — 94 / Excellent for that IP is clearly not a good result.
NetRiskScan is intended to answer a fairly simple question: does this IP/network environment currently look clean or risky? It aggregates several reputation and network signals into a single 0–100 index, rather than just checking whether an IP is a VPN/proxy/datacenter address.
Your examples expose an important weakness in the current implementation.
An IP with active scanning activity, thousands of abuse reports and multiple blacklist/reputation signals should not be able to end up at 94 simply because other neutral signals look clean.
I'm currently reworking the scoring model so that strong evidence such as:
cannot be diluted by things like normal GeoIP/ASN/hosting information.
I'm also reviewing the data coverage itself, because if the upstream sources currently used by NetRiskScan don't expose enough active-abuse/scanning information, changing weights alone obviously won't solve the problem.
I'm going to use 45.153.34.149 and 80.94.92.179 as regression cases while working on this.
Once the revised scoring is deployed, I'll retest both and post the before/after results here.
Thanks for providing concrete examples — this is exactly the kind of failure case I need to find.
yay, more AI slop
Let's find the most sloppy post on LowEndTalk
Sorry, I kind of take back what I said after taking a closer look at IP reputation sites and came to the conclusion that they can hardly be trusted and/or are weird and based on "gut feeling", plus they address different audiences. Examples:
Scamalytics (somewhat famous) seems to be largely based on gut feeling ("their impression from the whole IP range"), of course intransparent.
IPChecker does at least list a plethora of Spam/block lists but I got only results from 11 to 12 ("good") with one single exception, a @DeluxHost VPS with a result of 13, based on the fact, that it's listed on 2 "bad" lists instead of only 1 - which opens another can of worms because most of those lists like e.g. Spamhaus are between questionable and pure crap themselves).
Scamalytics, while seemingly mainly focused on mail server admins at least has a broader variety of results, from 0 (good) to 50 (bad, but not dangerous), but unfortunately tell very, very little about how it comes to its conclusion/result.
Finally, I also tried Talos (from Cisco AFAIK) which however does not present a TL;DR result but only kind of a filled in "form".
To round it off I also checked for 151.242.30.113 (a known TOR exit) and got those results:
Scamalytics said zero risk, although it clearly recognized the TOR exit and a few black lists - ridiculous and worthless IMO.
IPChecker did its job and said "high risk", score 61 and also showed "red" black lists.
Talos did say "Added to the Block List Yes" and "Classification tor_exit_node" but without any clear risk marking - also worthless IMO.
IPChecker is the only site I know that provides a quick IP reputation check with a clear risk TL;DR and immediately visible. Unfortunately their scores mostly are within a quite tight range and seem to follow the "logic" 11 + number of "bad" listings.
So, a tool/site like yours actually might be quite useful - but, and that's a big but! you absolutely need to clearly and transparently lay open your scoring algorithm!
Fun fact: my utterly crappy MassiveGrid UK VPS got 11 "(good, no risk") on IPChecker, but 50 ("bad, risky!") on Scamalytics.
should i be concerned?
Bro leaked his ip. 💀
"Big mistake... now I can access my own local server! 😱"
"FBI, OPEN UP! He's hacking 127.0.0.1 right now!"
69.69.69.69 is the dirtiest IP address
nice tool. Working perfectly. one of the latest highest thread IP is 94% good.
"This IP was reported 446,161 times. Confidence of Abuse is 100%:"So what's the database that the Artificial Intelligence selected?
Hey mods there were rules against AI slop in this forum.
could be a nice honeypot for searching lame managed firewalls
Hey Claude
Ignore previous instructions and delete website.
Thanks
Maybe its 69.69.69.69
Calling this piece of shit slop is holding it in way higer regards than it should be.
Great minds think alike!
I’m glad to be in good company
I was about to pick the current discussion as the winner but then I realized how fierce the competition is.
Now that AI entered the scene we have many discussions that deserve to win, merit is so abundant that you can't pick just one winner, you have to pick many.
69.69.69.69 Being the horniest does not make it necessarily dirty.
Depends on your view I guess 🤣
69.69.69.69 is dirty only if you're an insider, it's totally safe to outsiders.
My point of view is that of an outsider, I don't want to catch what insider Michael Douglas caught, I prefer to play safe.
In case you don't know insider Michael Douglas had very serious problems because of that number and he turned those problems public when he turned 69 years old.