Scamalytics Release High Risk ISPs For May 2020
Scamalytics have released the May 2020 report for the top 100 high risk ISPs for dating fraud. The list is compiled based on ISPs used by reported scammers in April 2020 across the Scamalytics network. ISPs must meet a minimum traffic level to make the list. They are then ranked by the proportion of traffic coming through that ISP’s network which is reported to be fraudulent.
Dating services can use the list to supplement their existing ISP blacklists. An updated list is released each month, based on the previous month’s scammer activity.
The top ten highest risk ISPs are listed in the table below.
Dating fraud: Top ten high risk ISPs during May 2020
Click an ISP to see the full fraud report for that ISP.
| Rank | ISP | Fraud Score |
| 1 | Net-style Atarim LTD | 100 |
| 2 | Internet Engineering | 100 |
| 3 | STRONG-TECHNOLOGY | 99 |
| 4 | kgovps Services | 99 |
| 5 | Hostroyale Finland | 99 |
| 6 | Global IP Exchange | 98 |
| 7 | NetProtect abuse@com | 97 |
| 8 | Clues IPs | 97 |
| 9 | IN-HOSTROYALE | 97 |
| 10 | Edis Network | 96 |
You can see the full list of 100 high risk ISPs here.
What’s changed since April 2020?
Last month’s chart topper had a risk score of 99 out of a possible 100; this month it’s still at the top, but its risk score has increased to the full 100.
Net-style Atarim is once again the highest risk ISP. It operates two websites, http://www.netstyle.co.il in Hebrew and a secondary one in English, and its offices are in a science park in Israel. Founded in 1998 as a web design operation it became a RIPE LIR in 2013 and began “supporting and accepting any crypto currency payments” in 2015. The site promises testimonials from the VPN provider HideMyAss and the IP address provider VPNStaticIP.com, but the appropriate section is not on the site.
At number 2, Internet Engineering is a new entry. Internet Engineering resolves to HostingUK.net, an Iomart company in the UK, and runs anonymising VPNs.
At number three we have STRONG-TECHNOLOGY, up from last month’s number 7. It’s a VPN service, operating the StrongVPN brand. It has over 950 servers in more than 30 countries and corporate HQ is in Seattle, USA.
kgoVPS, down from number 2 to number 4 on the list, is based in Milan in Italy but operates globally – although at the time of writing its website is unreachable. It’s known primarily for its willingness to accept payments in bitcoin.
At number 5, Hostroyale Finland continues its extended visit to our chart: it was number four last month and number nine the month before. Hostroyale started in Pune, India in 2009, where its head office is still located, and has 33 colocation units around the world – which is why it often features more than once in the high risk top ten, with high levels of fraudulent activity detected across multiple partners. The company offers the familiar mix of dedicated and virtual servers and domains.
Global IP Exchange is another regular visitor. This month it’s moved back down to number six after a month as the third most high risk ISP. The hosting firm is based in Stockholm, Sweden and its website is currently showing nothing but an Apache server status message. It operates over 7,600 IP addresses, almost all of which are running anonymising VPNs or servers.
At 7 we have a new name: NetProtect abuse@com. Netprotect operates in 40 countries and provides both branded, cloud-based VPN and white-label services for businesses that want to resell its VPN services. It claims its white label products have powered 100 businesses and 10 million VPN users. Our database records similar levels of risk from Netherlands, UK and German IP addresses.
Clues IPs operates from Bucharest in Romania. Its Clues.ro domain redirects to m247.com, which promotes business-scale hosting and VPN services. The high risk IP addresses recorded by Scamalytics are all anonymising VPNs.
At number 9, we have another appearance from Hostroyale, this time the Indian operation.
Last but not least, there’s Edis Network at number 10. Based in Warsaw, Poland, it’s a hosting firm that appears to be hosting a high proportion of anonymising services.
IP lookup tools
The top 100 list builds on Scamalytics’ IP fraud risk lookup tool and ISP risk reports. Their IP lookup tool allows dating services to lookup an IP address and see information such as whether that IP address is running a proxy server. Their ISP risk reports show information such as the distribution of proxy servers across the ISP’s range of IP addresses.
Scamalytics maintain the world’s largest anti-scammer blacklists dedicated to the dating industry, including IP addresses, ISPs, photos, profiles, email addresses and chat handles used by reported scammers.
Visit Scamalytics.com for more information.
