Is this IP range fraud or not? - GoFuckYourself.com

iSpyCams · 01-20-2013, 07:08 PM

I've got join page activity from the following IP range. Many of these (all of them) are listed as confirmed proxies at whatismyipaddress.com A few are also reported spam sources.

However, they seem to be AT&T cell phone towers for mobile browsing, and its possible the proxy designation comes from that. What do you guys think? - Here are the IP's

198.228.200.144
198.228.200.147
198.228.200.147
198.228.200.148
198.228.200.150
198.228.200.156
198.228.200.157
198.228.201.144
198.228.201.148
198.228.201.148
198.228.201.150
198.228.201.153
198.228.201.153
198.228.201.154
198.228.201.159
198.228.217.150
198.228.217.152
198.228.217.154
198.228.217.155
198.228.217.157
198.228.217.159
198.228.217.160
198.228.228.159
198.228.228.169
198.228.228.175
198.228.228.176

Struggle4Bucks · 01-20-2013, 07:22 PM

Quote:

Originally Posted by pompousjohn

I've got join page activity from the following IP range. Many of these (all of them) are listed as confirmed proxies at whatismyipaddress.com A few are also reported spam sources.

However, they seem to be AT&T cell phone towers for mobile browsing, and its possible the proxy designation comes from that. What do you guys think? - Here are the IP's

198.228.200.144
198.228.200.147
198.228.200.147
198.228.200.148
198.228.200.150
198.228.200.156
198.228.200.157
198.228.201.144
198.228.201.148
198.228.201.148
198.228.201.150
198.228.201.153
198.228.201.153
198.228.201.154
198.228.201.159
198.228.217.150
198.228.217.152
198.228.217.154
198.228.217.155
198.228.217.157
198.228.217.159
198.228.217.160
198.228.228.159
198.228.228.169
198.228.228.175
198.228.228.176

Fraud? nah... probably someone checking your site on his mobile trying to sign up while driving around in his car... That would explain the different ip's... since he's moving he constantly is closer to another cellphone tower.

iSpyCams · 01-20-2013, 08:02 PM

Quote:

Originally Posted by Struggle4Bucks

Fraud? nah... probably someone checking your site on his mobile trying to sign up while driving around in his car... That would explain the different ip's... since he's moving he constantly is closer to another cellphone tower.

Each ip is a unique join - its not the same guy for sure. I just don't know if they are open proxies being controlled by carders.

Supz · 01-20-2013, 08:06 PM

whois.arin.net

Struggle4Bucks · 01-20-2013, 08:09 PM

Quote:

Originally Posted by pompousjohn

Each ip is a unique join - its not the same guy for sure. I just don't know if they are open proxies being controlled by carders.

I was kidding...

but ok...

What is the time range between these ip's actions?
All sign ups or just join form hits without joins?
Do you have a log report from your site and
can you see these ip's there showing strange behaviour?

iSpyCams · 01-21-2013, 08:59 AM

Quote:

Originally Posted by Struggle4Bucks

I was kidding...

but ok...

What is the time range between these ip's actions?
All sign ups or just join form hits without joins?
Do you have a log report from your site and
can you see these ip's there showing strange behaviour?

Everything is perfectly normal except that these IP's are listed as proxies. Each entry in the list is a paid signup over a 30 day period. I exported to excel, sorted by IP and these caught my attention because there are a few duplicates. It's not common for more than one customer to sign up[ on the same IP, but it happens. All of them are owned by AT&T wireless and I believe they are cell phone towers.

fris · 01-21-2013, 09:08 AM

are they trying to brute force?

iSpyCams · 01-21-2013, 10:03 AM

Quote:

Originally Posted by fris

are they trying to brute force?

Nope. I am going to stop worrying about it and just watch the CB's. People use mobiles more now I guess.

ChatCash_Rob · 01-21-2013, 12:00 PM

Yeah, whatismyipaddress.com lists a lot of the mobile i.p.'s as proxies...pain in the ass. Everyone with a blackberry seems to get routed through Kansas.

iSpyCams · 01-21-2013, 01:07 PM

Quote:

Originally Posted by ChatCash_Rob

Yeah, whatismyipaddress.com lists a lot of the mobile i.p.'s as proxies...pain in the ass. Everyone with a blackberry seems to get routed through Kansas.

Yes I freaked out a few years back when I logged into Gmail and noticed that someone in the USA was getting into my Gmail. Turns out it was my blackberry's push email service.

So I realize mobile IP's can distort geoIP stuff. I guess the question is if any of these IP's available to black hats and carders. I feel like if they were I would have heard something by now, also fraud rates from mobile IP's over time does not seem significantly higher.

livexxx · 01-21-2013, 04:24 PM

make sure that 127.0.0.1 is not in the list, always shady traffic from that source. I always ban those people and the 10.0.0.1 idiots and the 192.168.0.1 pervs

Also look at maxmind, they do a geo module, you can buy and block by name of ISP if you dont like the look of them.

ls101 · 01-21-2013, 08:15 PM

In my experience some of the IP's came from AT&T are fraud most of them.

If you are working on chatters then that's basically a fraud!

iSpyCams · 01-21-2013, 08:45 PM

Quote:

Originally Posted by ls101

In my experience some of the IP's came from AT&T are fraud most of them.

If you are working on chatters then that's basically a fraud!

can you elaborate? I really did not want to hear that.

lagcam · 01-22-2013, 04:03 AM

Quote:

Originally Posted by pompousjohn

can you elaborate? I really did not want to hear that.

Take what that guy said with a pinch of salt. There is something sounds a little off here, but saying AT&T is nearly all fraud is ridiculous.

I don't like talking about these things on open forums, but if you drop me a mail to paul at my gfy user name from your site's email, I will tell you what I would be doing in a case like this. No guarantee I will be able to tell you something you don't already know, but consider it a string-less offer of help from a fellow site owner.

iSpyCams · 01-22-2013, 06:59 AM

Quote:

Originally Posted by lagcam

Take what that guy said with a pinch of salt. There is something sounds a little off here, but saying AT&T is nearly all fraud is ridiculous.

I don't like talking about these things on open forums, but if you drop me a mail to paul at my gfy user name from your site's email, I will tell you what I would be doing in a case like this. No guarantee I will be able to tell you something you don't already know, but consider it a string-less offer of help from a fellow site owner.

emailing you now.

k0nr4d · 01-22-2013, 08:17 AM

It's probably all legit mobile joins. There is no way that AT&T could give ever mobile device it's own ip address...

lagcam · 01-22-2013, 04:22 PM

Quote:

Originally Posted by pompousjohn

emailing you now.

Didn't get any email. lagcam dotcom and paul at

iSpyCams · 01-22-2013, 04:24 PM

strange - I will review and send again

iSpyCams · 01-22-2013, 04:27 PM

ok emailed you again from a different account.

lagcam · 01-23-2013, 03:12 AM

Quote:

Originally Posted by pompousjohn

ok emailed you again from a different account.

Still absolutely nothing. Somebody else had trouble connecting with you on another thread I believe? Try sending me a message from online support in the header of the site in my sig, or drop your email here and I will mail you.

iSpyCams · 01-23-2013, 03:56 AM

Quote:

Originally Posted by lagcam

Still absolutely nothing. Somebody else had trouble connecting with you on another thread I believe? Try sending me a message from online support in the header of the site in my sig, or drop your email here and I will mail you.

Alright try my username here @ yahoo.

lagcam · 01-23-2013, 05:07 AM

Quote:

Originally Posted by pompousjohn

Alright try my username here @ yahoo.

Email sent.

iSpyCams · 01-23-2013, 07:41 AM

got it. I kept reading your username as legcam, so that is the problem.

iSpyCams · 01-23-2013, 09:19 AM

Quote:

Originally Posted by livexxx

make sure that 127.0.0.1 is not in the list, always shady traffic from that source. I always ban those people and the 10.0.0.1 idiots and the 192.168.0.1 pervs

Also look at maxmind, they do a geo module, you can buy and block by name of ISP if you dont like the look of them.

PornDiscounts-V · 01-23-2013, 09:20 AM

Quote:

Originally Posted by pompousjohn

got it. I kept reading your username as legcam, so that is the problem.

I think its kind of cute

01-20-2013, 07:08 PM	#1
iSpyCams Amateur Gynecologist Industry Role: Join Date: May 2009 Location: Medellin Posts: 4,436	Is this IP range fraud or not? I've got join page activity from the following IP range. Many of these (all of them) are listed as confirmed proxies at whatismyipaddress.com A few are also reported spam sources. However, they seem to be AT&T cell phone towers for mobile browsing, and its possible the proxy designation comes from that. What do you guys think? - Here are the IP's 198.228.200.144 198.228.200.147 198.228.200.147 198.228.200.148 198.228.200.150 198.228.200.156 198.228.200.157 198.228.201.144 198.228.201.148 198.228.201.148 198.228.201.150 198.228.201.153 198.228.201.153 198.228.201.154 198.228.201.159 198.228.217.150 198.228.217.152 198.228.217.154 198.228.217.155 198.228.217.157 198.228.217.159 198.228.217.160 198.228.228.159 198.228.228.169 198.228.228.175 198.228.228.176 __________________ - As soon as I think up a good sig it's going here.

01-21-2013, 09:08 AM	#7
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,241	are they trying to brute force? __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

01-21-2013, 12:00 PM	#9
ChatCash_Rob Confirmed User Industry Role: Join Date: Apr 2004 Posts: 749	Yeah, whatismyipaddress.com lists a lot of the mobile i.p.'s as proxies...pain in the ass. Everyone with a blackberry seems to get routed through Kansas. __________________ www.chatcash.com ...coming soon! icq # 131127104 rob{AT}chatcash

01-21-2013, 04:24 PM	#11
livexxx Confirmed User Industry Role: Join Date: May 2005 Location: UK Posts: 1,201	make sure that 127.0.0.1 is not in the list, always shady traffic from that source. I always ban those people and the 10.0.0.1 idiots and the 192.168.0.1 pervs Also look at maxmind, they do a geo module, you can buy and block by name of ISP if you dont like the look of them. __________________ http://www.webcamalerts.com for auto tweets for web cam operators

01-22-2013, 08:17 AM	#16
k0nr4d Confirmed User Industry Role: Join Date: Aug 2006 Location: Poland Posts: 9,228	It's probably all legit mobile joins. There is no way that AT&T could give ever mobile device it's own ip address... __________________ Mechanical Bunny Media Mechbunny Tube Script \| Mechbunny Webcam Aggregator Script \| Custom Web Development

01-20-2013, 08:06 PM	#4
Supz Arthur Flegenheimer Industry Role: Join Date: Jul 2006 Location: New York City Posts: 11,056	whois.arin.net

01-21-2013, 08:15 PM	#12
ls101 Confirmed User Industry Role: Join Date: Nov 2012 Posts: 713	In my experience some of the IP's came from AT&T are fraud most of them. If you are working on chatters then that's basically a fraud!

01-22-2013, 04:24 PM	#18
iSpyCams Amateur Gynecologist Industry Role: Join Date: May 2009 Location: Medellin Posts: 4,436	strange - I will review and send again __________________ - As soon as I think up a good sig it's going here.

01-22-2013, 04:27 PM	#19
iSpyCams Amateur Gynecologist Industry Role: Join Date: May 2009 Location: Medellin Posts: 4,436	ok emailed you again from a different account. __________________ - As soon as I think up a good sig it's going here.

01-23-2013, 07:41 AM	#23
iSpyCams Amateur Gynecologist Industry Role: Join Date: May 2009 Location: Medellin Posts: 4,436	got it. I kept reading your username as legcam, so that is the problem. __________________ - As soon as I think up a good sig it's going here.