<story><title>A distributed peer to peer list of bad actor IP addresses and phone numbers</title><url>https://sentrypeer.org/</url></story><parent_chain><item><author>mabbo</author><text>To give a good example of why something like this matters...&lt;p&gt;I spent a bit more than a year as the most senior dev on the team that owned the sign up page for a cloud computing company. We faced bot attacks constantly. They had a variety of reasons to attack, but International revenue sharing fraud (IRSF) was a major one. In short, bots would convince our sign up flow to make verification phone calls to numbers that charge a lot of money but don&amp;#x27;t actually exist. (Note: whatever &amp;quot;why don&amp;#x27;t you just&amp;quot; you&amp;#x27;re about to reply with, we had an entire team of people doing nothing but trying to stop this for months and years- we tried that and it didn&amp;#x27;t succeed, or there were business reasons it was not feasible.)&lt;p&gt;I switched companies. In my new role, I happened to be on a team in the same org as their sign up page. Chatting with them, I learned that they were not facing &lt;i&gt;similar&lt;/i&gt; attacks, but &lt;i&gt;identical&lt;/i&gt; ones. The countries involved, the patterns of the attack, everything- this was the same attacker, going up against two completely unrelated companies.&lt;p&gt;I don&amp;#x27;t know if this system is the right implementation- I need to do a deeper dive on this- but I do know that something like this is needed so that companies can coordinate their defenses.</text></item></parent_chain><comment><author>jsnell</author><text>I&amp;#x27;ve worked on a large federated IP reputation system. It sounds like a great idea, but does not work in practice.&lt;p&gt;The main problem is that it&amp;#x27;s just too hard to map different kinds of abusive&amp;#x2F;non-abusive actions to a shared scale. The model here seems to be basically a boolean OR: if anyone flagged an IP as bad, it&amp;#x27;s marked as bad in the data set. Let&amp;#x27;s say that you&amp;#x27;re running a shop and detect a bunch of fraudulent transactions for expensive items, and add the IPs to the list. What can somebody else using this list for say spam-filtering comments to a web forum do with your data points in isolation? Not much, because the action you&amp;#x27;re protecting is rare, high impact, and unlikely to have FPs so the threshold where you&amp;#x27;d mark the IP as abusive would be very different than for the spam-filter use case.&lt;p&gt;At a minimum you&amp;#x27;d need all the client of the IP reputation signal to also share the positive reputation signals, not just the negative, and to export some forms of volumes or ratios of good and bad traffic. But it&amp;#x27;ll still be really hard to combine those reports to a single verdict that&amp;#x27;s generally useful.&lt;p&gt;A secondary problem is that different kinds of abuse don&amp;#x27;t even correlate particularly well. Let&amp;#x27;s say that you&amp;#x27;ve got an IP address sending SMTP spam; the odds are that this IP will not be doing ssh credential stuffing, credit card fraud, mass-scraping, traffic pumping, warez distribution, or DDOS attacks.&lt;p&gt;The classic SMTP IP blocklists work only because everyone using them is using them for the same purpose, and is as such on a shared scale, and there is a high likelihood of the same abusive actor attacking multiple different organizations. Your example would fit that as well, and doing reputation for that one domain would actually tractable unlike federated cross-domain IP reputation.</text></comment>
<story><title>A distributed peer to peer list of bad actor IP addresses and phone numbers</title><url>https://sentrypeer.org/</url></story><parent_chain><item><author>mabbo</author><text>To give a good example of why something like this matters...&lt;p&gt;I spent a bit more than a year as the most senior dev on the team that owned the sign up page for a cloud computing company. We faced bot attacks constantly. They had a variety of reasons to attack, but International revenue sharing fraud (IRSF) was a major one. In short, bots would convince our sign up flow to make verification phone calls to numbers that charge a lot of money but don&amp;#x27;t actually exist. (Note: whatever &amp;quot;why don&amp;#x27;t you just&amp;quot; you&amp;#x27;re about to reply with, we had an entire team of people doing nothing but trying to stop this for months and years- we tried that and it didn&amp;#x27;t succeed, or there were business reasons it was not feasible.)&lt;p&gt;I switched companies. In my new role, I happened to be on a team in the same org as their sign up page. Chatting with them, I learned that they were not facing &lt;i&gt;similar&lt;/i&gt; attacks, but &lt;i&gt;identical&lt;/i&gt; ones. The countries involved, the patterns of the attack, everything- this was the same attacker, going up against two completely unrelated companies.&lt;p&gt;I don&amp;#x27;t know if this system is the right implementation- I need to do a deeper dive on this- but I do know that something like this is needed so that companies can coordinate their defenses.</text></item></parent_chain><comment><author>shirly88</author><text>Oh good, mob justice on the networks. Surely this IP system itself can never be manipulated to cut off people by mistake or for revenge.&lt;p&gt;Humans always investigate thoroughly before serving themselves.&lt;p&gt;None of these IPs could be zombies; here come internet Supermen to save us!</text></comment>