Hi,

We have found that about 90% of our signups that come from a European or Asian IP address are fraudulent and we're now blocking certain IP ranges (193.*, 212.*, etc) from completing our automated signup process.

Does anyone know of a resource that lists ALL European (RIPE) and Asian (APNIC) IP ranges?

(My apologies to the vast majority of folks in Asia and Europe who don't commit credit card fraud.)

You can find a list of IP ranges assigned to APNIC here:

http://www.apnic.net/db/ranges.html

Originally posted by magnafix
Hi,

We have found that about 90% of our signups that come from a European or Asian IP address are fraudulent and we're now blocking certain IP ranges (193.*, 212.*, etc) from completing our automated signup process.

Does anyone know of a resource that lists ALL European (RIPE) and Asian (APNIC) IP ranges?

(My apologies to the vast majority of folks in Asia and Europe who don't commit credit card fraud.)

I know some other hosts have blocked out certain IP ranges, (Malaysian ones etc.), but have you found credit card fraud is a serious issue from European based people?
I live in the UK, and I know that most of western Europe, ie. UK, France, Germany, Sweden etc. have very very stringent laws on credit card fraud, so it occurs on a less frequent basis...

Yes, our western europe signups are often good, but eastern europe signups are almost always fraudulent. We are not taking these changes lightly, but we're awfully sick of all these fraudulent charges that cost us time and money.

Looks like these are the ranges for RIPE..
http://www.ripe.net/ripencc/mem-services/registration/statistics/as-usage.2001.html

thats a address space usage chart
:eek:

Ummm..... yes, for the /8 IP address ranges assigned to RIPE. In other words, for the first one shown 81/8, means 81.0.0.0/8

John

Check out this thread

http://www.webhostingtalk.com/showthread.php?s=&threadid=25585&highlight=block

I added a bunch of ips to that list, It would be very very nice to see other hosts add to it, sorta a current list of ips that have had fraudulent activity against them so to make other hosts aware.

I know of other host oriented forums that have such lists, but those forums are pretty small compared to WHT.

Awesome, thanks.

I posted this on that thread, but I'll post it here too. This list isn't quite complete -- I find that the 157. and 150. class A networks have both american and international class Bs with no obvious pattern, so I just left them out.

As a result of help from people on this thread and a few hours of research, here's our International IP checker.



sscanf($ip, "%d.%d.%d.%d", &$quad1, &$quad2, &$quad3, &$quad4);

switch($quad1)
{
case 57:
case 61:
case 62:
case 80:
case 151:
case 193:
case 194:
case 195:
case 202:
case 203:
case 210:
case 211:
case 212:
case 213:
case 217:
case 218:
case 219:
return true;

case 24:
if($quad2 > 132 && $quad2 < 136) return true;

case 130:
if($quad2 == 237 ||
$quad2 == 242 ||
$quad2 == 243) return true;

case 134:
if($quad2 == 75) return true;

case 141:
if($quad2 < 86) return true;

case 165:
if($quad2 == 21) return true;

case 169:
if($quad2 > 207 && $quad2 < 224) return true;

case 170:
if($quad2 == 60) return true;

case 192:
if($quad2 == 36 ||
$quad2 == 164 ||
$quad2 == 165 ||
$quad2 == 166 ||
$quad2 == 167) return true;
}

return false;
}