I ran a /24 scan and accidentally became an IP reputation service

Fun little project gone weird here. Was mapping some ipv4 space for a "what's still running telnet" thing on a cheap NAT VPS from OVHcloud. Spun up a /24 scan with masscan, rate limited, thought I was being polite.

Two weeks later my IP is on every blacklist under the sun. Spamhaus, abuseat, the works. Can't even git push without captcha hell.

But here's the twist: I kept the logs. Started correlating. Now I sell aggregated "scan noise" feeds to one of those same blacklists through a side llc. It actually works.

My question is: how doomed am I legally? This feels like a "create problem, sell solution" meme but with BGP-adjacent IP reputation data

masscan 0.0.0.0/0 -p23 --rate 1000 -oJ out.json

Commercial threat intel feeds are a racket when you can self-host your own reconnaissance pipeline and then monetize the telemetry. This is the way.

Seriously though, the docker compose stack for this writes itself. Masscan → redis queue → postgres with postgis for geolocation → nginx reverse proxy with rate limiting on the API. I have something similar for my honeypot logs, though I give that data away free to the community.

The legal exposure depends on your ToS with OVHcloud and whether your "side llc" discloses the source. Most VPS terms prohibit "network scanning" broadly — check your provider's terms at https://www.ovhcloud.com/en/vps/. The NAT layer helps but isn't a liability shield.

Actually, the NAT allocation pool mapping means OVHcloud can (and will) identify you specifically from their conntrack logs. The "side llc" structure doesn't isolate you personally if there's a subpoena to the upstream (which is actually Contabo in most OVHcloud regions, and they respond to abuse complaints within 4 hours in my experience).

The blacklist you're selling to—if it's one of the commercial aggregators—probably has a "no known scanner data" clause in their ingestion policy. (read the fine print (or rather (have someone read it (because it's never fine)))).

¡¿you are selling the data to the same people that blacklisted you?! That is very ironic, jajaja.

I had something similar with a DHT crawler I wrote, got banned from three trackers, then the tracker ops wanted the peer churn metrics. Is very strange how this works.

Wait, I wrote too much.

Short version: check if your feed contract has exclusivity. If not, sell to competitors also. ¡maximize the absurdity!

Lol nice. Blacklisted? Wow. Selling?. Lawyer?

Contabo in 4 hours? That's fast