Scamalytics have released the April 2020 report for the top 100 high risk ISPs for dating fraud. The list is compiled based on ISPs used by reported scammers in April 2020 across the Scamalytics network. ISPs must meet a minimum traffic level to make the list. They are then ranked by the proportion of traffic coming through that ISP’s network which is reported to be fraudulent.
Dating services can use the list to supplement their existing ISP blacklists. An updated list is released each month, based on the previous month’s scammer activity.
The top ten highest risk ISPs are listed in the table below.
Dating fraud: Top ten high risk ISPs during April 2020
Click an ISP to see the full fraud report for that ISP.
| Rank | ISP | Fraud Score |
| 1 | Net-style Atarim LTD | 99 |
| 2 | kgovps Services | 99 |
| 3 | Global IP Exchange | 98 |
| 4 | Hostroyale Finland | 98 |
| 5 | IN-HOSTROYALE | 98 |
| 6 | ATI – ISP | 98 |
| 7 | STRONG-TECHNOLOGY | 97 |
| 8 | Hostroyale Glasgow Network | 97 |
| 9 | Saddam Hossain t/a Asian Network | 97 |
| 10 | Sharktech | 95 |
You can see the full list of 100 high risk ISPs here.
What’s changed since March 2020?
There are several familiar faces in our top ten this month. Net-Style Atarim Ltd, which was knocked off the number one spot last month by Simply Transit Ltd, is back at number one with an even higher fraud score, while Hostroyale Glasgow Network makes an unwelcome return too. You’ll see that the Hostroyale name appears three times in our top ten this month, so the fraud problems are clearly not limited to one geographical area.
Net-style Atarim is once again the highest risk ISP. It operates two websites, http://www.netstyle.co.il in Hebrew and a secondary one in English, and its offices are in a science park in Israel. Founded in 1998 as a web design operation it became a RIPE LIR in 2013 and began “supporting and accepting any crypto currency payments” in 2015. The site promises testimonials from the VPN provider HideMyAss and the IP address provider VPNStaticIP.com, but the appropriate section is not on the site.
kgoVPS, at number 2 on the list, is based in Milan in Italy but operates globally – although at the time of writing its website is unreachable. It’s known primarily for its willingness to accept payments in bitcoin.
Global IP Exchange moves up from last month’s number 6 to this month’s number 3. The hosting firm is based in Stockholm, Sweden and its website is currently showing nothing but an Apache server status message. It operates over 7,600 IP addresses, almost all of which are running anonymising VPNs or servers.
Number 4, Hostroyale Finland, is another climber: up from last month’s number 9. Hostroyale, started in Pune, India in 2009, where its head office is still located, and has 33 colocation units around the world – which is why it features more than once in this month’s top ten, with high levels of fraudulent activity detected across multiple partners. The company offers the familiar mix of dedicated and virtual servers and domains.
ATI-ISP, at number six, is Tunisia’s main internet service provider. It is located in Mutuelleville in Tunis and operated by the country’s Ministry of Communications, and it provides services to a range of organisations including commercial ISPs. While the proportion of server addresses pointing to high risk services is relatively low at 13%, that’s a proportion of a very large user base.
STRONG-TECHNOLOGY may be smaller than Tunisia’s state ISP, but the proportion of servers pointing to high risk services is a whopping 100%. That’s because it’s a VPN service, operating the StrongVPN brand. It has over 950 servers in more than 30 countries and corporate HQ is in Seattle, USA.
Number 8 is another Hostroyale division, this time from Glasgow, and at number nine we have another familiar name: Saddam Hossain, trading as Asian Network. The company operates 255 IP addresses, some of which run public proxies. The company is based in Gazipur in Bangladesh.
Finally at number 10 we have our last new entrant, Sharktech. The firm was founded in 2003 to offer protection against distributed denial of service (DDoS) attacks and offers a range of dedicated and virtual servers as well as gaming servers.
IP lookup tools
The top 100 list builds on Scamalytics’ IP fraud risk lookup tool and ISP risk reports. Their IP lookup tool allows dating services to lookup an IP address and see information such as whether that IP address is running a proxy server. Their ISP risk reports show information such as the distribution of proxy servers across the ISP’s range of IP addresses.
Scamalytics maintain the world’s largest anti-scammer blacklists dedicated to the dating industry, including IP addresses, ISPs, photos, profiles, email addresses and chat handles used by reported scammers.
Visit Scamalytics.com for more information.