On 14/10/2019 12:33, Nick via mailop wrote:
On 2019-10-14 11:21 BST, Laura Atkins via mailop wrote:
Yeah. I think there’s been a bit of a shift back to looking at your
network space and surrounding IPs.
Why?
(I ask this in ignorance of the underlying technicalities, and about
ipv4 only.)
There are only about 3 billion public ipv4 addresses. I will make the
claim that a few billion entries in a lookup table doesn't seem much
of a challenge, least of all for a party with the kind of resources
that Google has available.
So why care about the "neighborhood" at all? Why not consider each
and every ipv4 address on its own merits?
Consider cloud providers, VPS providers, ESPs etc, and
whether they enforce any sort of ToS forbidding abusive traffic
from their customers.
If a provider consistently allows abusive traffic from their
customers then they attract abusive customers and the
odds of any particular traffic from their customers being
unwanted goes up.
If you see significant abusive traffic from a providers network
space you can assume they allow it. Make go together motions
and a policy of being suspicious of traffic coming from networks
that have a history of sending abusive traffic makes perfect
sense.
At the next level up the providers who are selling connectivity
to the generally dirty VPS providers generally have other dirty
customers.
Also there are a lot of snowshoe spammers around who rent
/27s, /25s, whatever from a provider and move their spam
traffic around to avoid detection. Same heuristic applies.
So IP reputation does get smeared around a little. Not the same
at all peers, and how much it does probably depends on the
details of historical traffic, and other behaviour across those
ranges (is it SWIPed, does it have distinctive reverse DNS, ...).
One group of people who object to this tend to be people renting
dirt cheap VMs on really dirty VPS or cloud providers. Another is
ESPs who really want to keep their spamming customers on
dedicated IP addresses and not have that impact the delivery rates
of their good customers.
Cheers,
Steve
_______________________________________________
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
