IPv4 Address Auctions
As the CTO of an API SaaS who sees a lot of promotion fraud on our service (i.e. bots attempting to sign up for thousands of free-tier accounts, because enough free-tier API-keys lashed together ≡ the capabilities of one paid-tier account), I see fraudulent sign-ups coming from IP addresses reallocated by these auction providers all the time. Addresses sold on IPXO (<a href="https:&#x2F;&#x2F;www.ipxo.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.ipxo.com&#x2F;</a>) are seemingly especially bad for this.<p>If there was a big list of all reallocatable &#x2F; not-permanently-allocated IP ranges, I&#x27;d willingly — gleefully! — just dump it into Cloudflare as an IP blocklist for our website &#x2F; registration flow. And there&#x27;d be zero fear in my mind of getting any false positives or user complaints by doing so.<p>After all, none of these reallocatable ranges are ever purchased by residential&#x2F;commercial broadband ISPs; those customers would much rather solve their IPv4 problems permanently, by doing either IPv6 enablement or CGNAT, than solve them for only the next 1024 customers, by buying a piddly &#x2F;22 — especially at an unpredictable, un-budget-able price!<p>And for registrations, any IP <i>other than</i> ISP IPs doesn&#x27;t matter. IaaS IP? Bot. VPS IP? Bot. Colo IP? Bot. &quot;Internal-use&quot; IP? Bot. if someone&#x27;s traffic isn&#x27;t coming from an IP address owned by an ISP, then <i>for purposes of registration</i>, it&#x27;s not good traffic, 99.999% of the time†. Those IPs are perfectly fine when it comes to actual requests — obviously, your application backend using our API is a &quot;bot&quot; in some sense — but your application backend shouldn&#x27;t be going to our website and filling out a sign-up form. :)<p>(† The other 0.0001% are people using &quot;workstation in the cloud&quot; services. But people using those are used to being treated as second-class Internet citizens when trying to do web browsing from their cloud workstation; and they already know the solution is always to switch back to their real computer&#x27;s web browser for anything requiring IP reputation.)