Hi everybody,
While doing some measurement work earlier this weekend I discovered
that there are a large amount of probes on AS47583 that look like
they are being set up to farm credits. With a suspiciously high amount
of purely software probes on the same IP prefix and sequential IPv6
addresses.
$ curl -s 'https://stat-ui.stat.ripe.net/data/atlas-probes/data.json?resource=47583'
| jq .data.probes[] -c | grep Connected | jq '.address_v4 + " " +
.address_v6' | sort
"153.92.14.66 2a02:4780:6:c0de::e"
"153.92.14.67 2a02:4780:6:c0de::f"
"153.92.14.68 2a02:4780:6:c0de::11"
"153.92.14.69 2a02:4780:6:c0de::12"
"153.92.14.70 2a02:4780:6:c0de::13"
"153.92.14.71 2a02:4780:6:c0de::14"
"153.92.14.72 2a02:4780:6:c0de::15"
"153.92.14.73 2a02:4780:6:c0de::16"
"153.92.14.74 2a02:4780:6:c0de::17"
"153.92.14.75 2a02:4780:6:c0de::18"
"153.92.14.76 2a02:4780:6:c0de::19"
"153.92.14.77 2a02:4780:6:c0de::1b"
"156.67.223.15 2a02:4780:3:1::2a"
"156.67.223.16 2a02:4780:3:1::2b"
"156.67.223.29 2a02:4780:3:1::35"
"156.67.223.30 2a02:4780:3:1::36"
"156.67.223.31 2a02:4780:3:1::37"
"156.67.223.36 2a02:4780:3:1::38"
"156.67.223.37 2a02:4780:3:1::39"
"156.67.223.38 2a02:4780:3:1::3a"
"156.67.223.39 2a02:4780:3:1::3b"
"156.67.223.40 2a02:4780:3:1::3c"
"156.67.223.41 2a02:4780:3:1::3d"
"156.67.223.42 2a02:4780:3:1::49"
"156.67.75.19 2a02:4780:b:c0de::16"
"156.67.75.20 2a02:4780:b:c0de::17"
"156.67.75.21 2a02:4780:b:c0de::18"
"156.67.75.22 2a02:4780:b:c0de::19"
"156.67.75.23 2a02:4780:b:c0de::1a"
"156.67.75.24 2a02:4780:b:c0de::1b"
"156.67.75.25 2a02:4780:b:c0de::1c"
"156.67.75.26 2a02:4780:b:c0de::1d"
"156.67.75.27 2a02:4780:b:c0de::1e"
"156.67.75.28 2a02:4780:b:c0de::1f"
"156.67.75.29 2a02:4780:b:c0de::20"
"156.67.75.30 2a02:4780:b:c0de::21"
"156.67.75.31 2a02:4780:b:c0de::22"
"156.67.75.32 2a02:4780:b:c0de::23"
"156.67.75.33 2a02:4780:b:c0de::24"
"185.201.11.3 2a02:4780:1::3"
"185.224.136.17 2a02:4780:8::12"
"185.224.136.18 2a02:4780:8::13"
"185.224.136.19 2a02:4780:8::16"
"185.224.136.22 2a02:4780:8::1a"
"194.5.158.13 2a02:4780:8:b::11"
"194.5.158.15 2a02:4780:8:b::12"
"194.5.158.16 2a02:4780:8:b::13"
"194.5.158.18 2a02:4780:8:b::15"
"194.5.158.223 2a02:4780:8:b::f"
"194.5.158.226 2a02:4780:8:b::10"
"194.5.158.228 2a02:4780:8:b::16"
"194.5.158.238 2a02:4780:8:b::14"
"212.1.215.106 2a02:4780:1:12::3"
"212.1.215.107 2a02:4780:1:12::4"
"212.1.215.108 2a02:4780:1:12::5"
"212.1.215.109 2a02:4780:1:12::6"
"212.1.215.110 2a02:4780:1:12::7"
"212.1.215.111 2a02:4780:1:12::8"
"212.1.215.112 2a02:4780:1:12::9"
"212.1.215.113 2a02:4780:1:12::a"
"212.1.215.114 2a02:4780:1:12::b"
"212.1.215.115 2a02:4780:1:12::c"
"212.1.215.116 2a02:4780:1:12::d"
"217.21.86.65 2a02:4780:11:c0de::d"
"217.21.86.66 2a02:4780:11:c0de::e"
"217.21.86.67 2a02:4780:11:c0de::f"
"217.21.86.68 2a02:4780:11:c0de::10"
"217.21.86.69 2a02:4780:11:c0de::11"
"217.21.86.70 2a02:4780:11:c0de::12"
"217.21.86.71 2a02:4780:11:c0de::13"
"217.21.86.72 2a02:4780:11:c0de::14"
"217.21.86.73 2a02:4780:11:c0de::15"
"217.21.86.74 2a02:4780:11:c0de::16"
"217.21.86.75 2a02:4780:11:c0de::17"
"217.21.86.76 2a02:4780:11:c0de::18"
"217.21.86.77 2a02:4780:11:c0de::19"
"217.21.86.78 2a02:4780:11:c0de::1a"
"217.21.86.79 2a02:4780:11:c0de::1b"
"2.57.90.18 2a02:4780:a:c0de::3"
"2.57.90.38 2a02:4780:a:c0de::2"
"2.57.90.41 2a02:4780:a:c0de::4"
"2.57.90.42 2a02:4780:a:c0de::5"
"2.57.90.43 2a02:4780:a:c0de::6"
"2.57.90.44 2a02:4780:a:c0de::7"
"2.57.90.45 2a02:4780:a:c0de::8"
"2.57.90.46 2a02:4780:a:c0de::9"
"2.57.90.47 2a02:4780:a:c0de::a"
"2.57.90.48 2a02:4780:a:c0de::b"
"2.57.90.49 2a02:4780:a:c0de::c"
"2.57.90.50 2a02:4780:a:c0de::d"
"45.128.160.100 2a02:4780:9:c0de::2be"
"45.128.160.101 2a02:4780:9:c0de::1ae"
"45.128.160.102 2a02:4780:9:c0de::3f"
"45.128.160.104 2a02:4780:9:c0de::10a"
"45.128.160.108 2a02:4780:9:c0de::3c2"
"45.128.160.111 2a02:4780:9:c0de::11f"
"45.128.160.112 2a02:4780:9:c0de::38f"
"45.128.160.116 2a02:4780:9:c0de::12"
"45.128.160.119 2a02:4780:9:c0de::c6"
"45.128.160.121 2a02:4780:9:c0de::116"
"45.128.160.124 2a02:4780:9:c0de::94"
"45.143.83.65 2a02:4780:13:c0de::b"
"45.143.83.66 2a02:4780:13:c0de::c"
"45.143.83.67 2a02:4780:13:c0de::d"
"45.143.83.68 2a02:4780:13:c0de::e"
"45.143.83.69 2a02:4780:13:c0de::f"
"45.143.83.70 2a02:4780:13:c0de::10"
"45.143.83.71 2a02:4780:13:c0de::11"
"45.143.83.72 2a02:4780:13:c0de::12"
"45.143.83.73 2a02:4780:13:c0de::13"
"45.143.83.74 2a02:4780:13:c0de::14"
"45.143.83.75 2a02:4780:13:c0de::15"
"45.143.83.76 2a02:4780:13:c0de::16"
"45.143.83.77 2a02:4780:13:c0de::17"
"45.143.83.78 2a02:4780:13:c0de::18"
"45.143.83.79 2a02:4780:13:c0de::19"
"89.116.146.65 2a02:4780:27:c0de::b"
"89.116.146.66 2a02:4780:27:c0de::c"
"89.116.146.67 2a02:4780:27:c0de::d"
"89.116.146.68 2a02:4780:27:c0de::e"
"89.116.146.69 2a02:4780:27:c0de::f"
"89.116.146.70 2a02:4780:27:c0de::10"
"89.116.146.71 2a02:4780:27:c0de::11"
"89.116.146.72 2a02:4780:27:c0de::12"
"89.116.146.73 2a02:4780:27:c0de::13"
"89.116.146.74 2a02:4780:27:c0de::14"
"89.116.146.75 2a02:4780:27:c0de::15"
"89.116.146.76 2a02:4780:27:c0de::16"
"89.116.146.77 2a02:4780:27:c0de::17"
"89.116.146.78 2a02:4780:27:c0de::18"
"89.116.146.79 2a02:4780:27:c0de::19"
Now while I myself don't particularly care about credit farming on
RIPE Atlas (After all RIPE Atlas credit is kind of like Monopoly
money), I do care about things becoming biased towards these software
probes.
For example, when I had selected for a selection of probes in Brazil I
ended up with several of these software probes giving me the exact
same results. this is not very useful and this has the potential to
bias academic measurements, had I not looked at the probe list
results this would not have been immediately obvious.
Is there an immediate way to report these probes other than this
mailing list? I don't know of one and so I'm here :)
Cheers
Ben
