Is this IP range fraud or not?
 

I've got join page activity from the following IP range. Many of these (all of them) are listed as confirmed proxies at whatismyipaddress.com A few are also reported spam sources.

However, they seem to be AT&T cell phone towers for mobile browsing, and its possible the proxy designation comes from that. What do you guys think? - Here are the IP's

198.228.200.144
198.228.200.147
198.228.200.147
198.228.200.148
198.228.200.150
198.228.200.156
198.228.200.157
198.228.201.144
198.228.201.148
198.228.201.148
198.228.201.150
198.228.201.153
198.228.201.153
198.228.201.154
198.228.201.159
198.228.217.150
198.228.217.152
198.228.217.154
198.228.217.155
198.228.217.157
198.228.217.159
198.228.217.160
198.228.228.159
198.228.228.169
198.228.228.175
198.228.228.176

Fraud? nah... probably someone checking your site on his mobile trying to sign up while driving around in his car... That would explain the different ip's... since he's moving he constantly is closer to another cellphone tower.

Each ip is a unique join - its not the same guy for sure. I just don't know if they are open proxies being controlled by carders.

whois.arin.net

I was kidding...

but ok...

What is the time range between these ip's actions?
All sign ups or just join form hits without joins?
Do you have a log report from your site and
can you see these ip's there showing strange behaviour?

Everything is perfectly normal except that these IP's are listed as proxies. Each entry in the list is a paid signup over a 30 day period. I exported to excel, sorted by IP and these caught my attention because there are a few duplicates. It's not common for more than one customer to sign up[ on the same IP, but it happens. All of them are owned by AT&T wireless and I believe they are cell phone towers.

are they trying to brute force?

Nope. I am going to stop worrying about it and just watch the CB's. People use mobiles more now I guess.

Yeah, whatismyipaddress.com lists a lot of the mobile i.p.'s as proxies...pain in the ass. Everyone with a blackberry seems to get routed through Kansas.

Yes I freaked out a few years back when I logged into Gmail and noticed that someone in the USA was getting into my Gmail. Turns out it was my blackberry's push email service.

So I realize mobile IP's can distort geoIP stuff. I guess the question is if any of these IP's available to black hats and carders. I feel like if they were I would have heard something by now, also fraud rates from mobile IP's over time does not seem significantly higher.

make sure that 127.0.0.1 is not in the list, always shady traffic from that source. I always ban those people and the 10.0.0.1 idiots and the 192.168.0.1 pervs

Also look at maxmind, they do a geo module, you can buy and block by name of ISP if you dont like the look of them.

In my experience some of the IP's came from AT&T are fraud most of them. :) If you are working on chatters then that's basically a fraud!

can you elaborate? I really did not want to hear that.

Take what that guy said with a pinch of salt. There is something sounds a little off here, but saying AT&T is nearly all fraud is ridiculous.

I don't like talking about these things on open forums, but if you drop me a mail to paul at my gfy user name from your site's email, I will tell you what I would be doing in a case like this. No guarantee I will be able to tell you something you don't already know, but consider it a string-less offer of help from a fellow site owner.

emailing you now.

It's probably all legit mobile joins. There is no way that AT&T could give ever mobile device it's own ip address...

Didn't get any email. lagcam dotcom and paul at

strange - I will review and send again

ok emailed you again from a different account.

Still absolutely nothing. Somebody else had trouble connecting with you on another thread I believe? Try sending me a message from online support in the header of the site in my sig, or drop your email here and I will mail you.

Alright try my username here @ yahoo.

Email sent.

got it. I kept reading your username as legcam, so that is the problem.

I think its kind of cute