I can remember as far back as the 1990's working at an ISP in DFW and periodically seeing traffic coming from addresses with IP addresses belonging to netblocks belonging to EOP.GOV, having DNS that round-tripped to some EOP.GOV hostname, and being puzzled by it since if it was some sort of investigatory traffic by a federal agency, that's not the office you'd expect it to come from. As mentioned, this was early Internet (relatively speaking) and back then we hosted the BUGTRAQ mailing list, so I chalked it up to some nerd working there being proactive, keeping up to date but in hindsight I have to wonder if it's been a zombie horde all along.
I'd like to apply Hanlon's razor here, but I honestly can't tell if it's malicious intent, incompetence or malicious intent disguised as incompetence for plausible deniability?
If you're the Qatari royal family, you can just buy the whole white house instead, should you happen to have an extra gaudily furnished 747-800 laying around.
I'd like to know how to reliably detect whether a machine serves as a residential proxy. For example, ipinfo.io flags any ProtonVPN connection from my machine as residential proxy but how do I know it's not a false positive?
There's also "residential data center" proxies you can buy, it sound weird but it's ISPs selling some of their regular residential IP space to proxy companies so they don't look like data center IPs.
5 comments