We’re seeing a steady stream of (seemingly) legitimate entities complaining that they’ve rented SBL-listed IPs from an IP broker, essentially being sold or leased broken goods.

Some IP brokers seem to abuse legitimate customers for coercing the removal of SBL listings previously created due to persistent spam or bulletproof hosting incidents:
👉 https://www.spamhaus.org/resource-hub/bulletproof-hosting/the-anatomy-of-bulletproof-hosting-past-present-future-/#the-rise-of-ip-v4-address-brokers

A related trend is...

1/2 ⤵️

legitimate Russian entities taking over prefixes previously used by poor-reputation hosting providers (and inheriting the reputation baggage that comes with them).

📣 Takeaway: Always check the blocklist status of an IP range before leasing or buying it (use 👉 https://check.spamhaus.org). Be wary of IP brokers with a high amount of live SBL listings.

#Threatintel #IPv4 #IPReputation

2/2

Reputation Checker - Spamhaus