Turns out what constitutes "claiming" an IP on the site is nothing like you’d expect. You don’t need to prove you control the IP. All it takes is embedding a transparent 1x1 tracking pixel on a website, and every IP that loads the page gets counted as “claimed” by you. In other words, it’s just a tally of visitors (or even ad impressions), not actual control of the IPs. So there’s really nothing meaningful here.
treve · 15m ago
It's still an interesting post, because if true I'd still be curious how you'd get 20 million people to load anything.
But the title here is totally misleading because it sure sounds like someone took control of 9% of the ipv4 address space but the actual post starts with context.
karel-3d · 3m ago
I would guess a WordPress plugin or something.
20 million is a lot, but if you look at geoip, they are around the whole world; I took 3 random latest IPs and I saw Vietnam, Brazil and Angola. So it's not that much when it's worldwide.
But it suggests it's not a geographically limited website. If it's through a website. It's probably not a ad buy. (Who would burn money on that...)
However the requests are literally every second. So it's something very popular. (Or a bot and they are somehow faking the source address...)
flerchin · 1m ago
How is 20M IPs 9% of all IPv4 hosts? That works out to something like 220M IPv4 hosts, when I'd naively think there should be more like 4B or so.
On the new site I see that the post has a link at the bottom which claims to take you to non-JS version of the site, but following it and clicking on the "list overview" button takes you to a page that doesn't work without JS, and clicking anything from the "all threads" page just takes you back to the JS version.
progbits · 17m ago
Buying ads or embedding on some popular sites seems like best theory.
@jart: You could log referer header maybe, or user agent?
But the title here is totally misleading because it sure sounds like someone took control of 9% of the ipv4 address space but the actual post starts with context.
20 million is a lot, but if you look at geoip, they are around the whole world; I took 3 random latest IPs and I saw Vietnam, Brazil and Angola. So it's not that much when it's worldwide.
But it suggests it's not a geographically limited website. If it's through a website. It's probably not a ad buy. (Who would burn money on that...)
However the requests are literally every second. So it's something very popular. (Or a bot and they are somehow faking the source address...)
I've been using https://seclists.org/nanog/ since the switch and it's so much better.
On the new site I see that the post has a link at the bottom which claims to take you to non-JS version of the site, but following it and clicking on the "list overview" button takes you to a page that doesn't work without JS, and clicking anything from the "all threads" page just takes you back to the JS version.
@jart: You could log referer header maybe, or user agent?