Hacker News Reader

Comment by viraptor | Hacker News Reader

> I have no idea why ipv6 would indicate that I’m not a spammer

It's likely not about ipv6, but instead it's about your ipv4 having bad reputation in the past. Basically you changed your source address to a cleaner one.

View on HN

This is very likely the case. Check the IP on a site that does IP reputation scoring [1]. They probably don't have a database of "bad" addresses for IPv6, so it squeaks by for now. I'm sure that'll change in the future though.

My current IP shows "0 - low risk" with that tool. Grabbing a random PIA IP shows "93% - Abusive IP" with a warning about being a high risk proxy connection. The random VPN IP is also on SPAM blocklists.

I'm guessing a huge portion of cheap shared hosting is the same.

1. https://www.ipqualityscore.com/ip-reputation-check

FWIW - I suspect the "IP reputation" site you referenced is utter bullshit when it comes to its "Proxy Detection". Looking at my own residential public address it calls it a 'low risk proxy' when I can assure that it most definitely is not. It doesn't help that their explanation for how they attempt to detect this is a pile of marketing word salad. I don't expect them to be completely transparent to their methodology, but they should make some attempt at presenting a bit of technical background.

It doesn't have to be bullshit. You have a sample size of 1 and realistically we can't expect 100% accuracy. We also don't know how often your IP is changing - maybe it was a proxy endpoint recently?

It's a static address that hasn't changed for 3+ years. The only thing I can think of the makes it proxy-ish, is that I have a 6 person household here.

Edit- The IP my employer uses as its outbound nat IP that we vpn from while WFH (so it actually is a proxy) gets a clean bill of health while our corporate email server (not a proxy at all) is tagged as one.

It's not just IPs that have reputation scores but IP ranges and AS entities. Residential IP ranges are often dinged by default because of the risk of infected home PCs sending spam.

There absolutely is a reputation associated with individual addresses and ranges of addresses. And that reputation can be derived from numerous legitimate means (honeypot activity, spam, reverse dns info), but whatever these folks are doing regarding "proxy/vpn detection" is indistinguishable from snake oil.

I would guess that all or nearly all residential IPs are marked as at least 'low proxy' risk because of the risk of malware on personal devices.

It says that for me too, so I tried 8.8.8.8 and it was rated as "100% abuse". I don't think this tool is very accurate.

> I suspect the "IP reputation" site you referenced is utter bullshit when it comes to its "Proxy Detection".

It very well could be. That wasn't an endorsement by any means. The problem from what I can see is if services like that are convincing CTOs to use their lists it becomes relevant (even if the info isn't accurate).

Disreputable and reputable services alike change ip all the time. The only people who don’t are home users and I suspect VPN users. I don’t fully understand how this is supposed to help you decide if something is safe

> Disreputable and reputable services alike change ip all the time.

If you're running a serious mail service your IPs don't change that much. Not only will you have a pool of IP addresses just for that reason, you'll also likely need a few unused ones for when one of your users tanks your reputation and you have to roll them.

Nobody taking real money for email will use a randomly assigned IP as source. (unless it's randomly selected and then tested for reputation before use) Mailgun and other services even allow you to book a dedicated IP just for your outgoing emails.

That's a good point

Interesting perspective. My primary mailserver is AWS lightsail, my test mailserver is DigitalOcean. Both have a process to request a ‘good’ IP address. The latter works with ipv6, despite being (in my opinion) a lower credibility service.

Reply on news.ycombinator.com