Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


is m247 faking their locations?
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

is m247 faking their locations?

Comments

  • jackbjackb Member, Host Rep
    edited March 2021

    Geolocation can be set to anything the provider wants really.

    M247 helpfully sent us some unsolicited mail the other day, so here's a list of the full virtual => physical mappings for their services.

    (Direct lift from their email. It's implied any other locations are physical PoPs).
    IP Geolocated in :

    Asia - Vietnam – Hanoi (Physical Server located in Singapore)
    Asia - Philippines – Manila (Physical Server located in Singapore)
    Asia - Cambodia - Phnom Penh (Physical Server located in Singapore)
    Asia - South Africa,Johannesburg (Physical Server located in Singapore)
    Asia - Taiwan (Physical Server located in Singapore)
    Europe - Egypt – Cairo (Physical Server located in Bucharest)
    Europe - Turkey – Istanbul (Physical Server located in Sofia)
    Europe – Russia (Physical Server located in Norway)
    USA - Brazil (Physical Server located in Miami)
    USA - Mexic (Physical Server located in Miami)

    Thanked by 4jtk titus xx00xx doghouch
  • Europe - Egypt – Cairo (Physical Server located in Bucharest)

    Neat, didn't know that Egypt has moved to Europe 😂

  • jackbjackb Member, Host Rep

    @t0ny0 said:

    Europe - Egypt – Cairo (Physical Server located in Bucharest)

    Neat, didn't know that Egypt has moved to Europe 😂

    Trump will be delighted to find out that Mexico is in fact in the USA. That's why he didn't build the wall.

  • LeviLevi Member

    OVH, IBM and now m247 practicing dirty marketing tricks. Shame! Shame!

    Thanked by 1xx00xx
  • 10301030 Member

    My VPS from HostUS is located in Amsterdam, NL (from Clouvider) and it displays location as: America/Chicago

  • NyrNyr Community Contributor, Veteran

    @xx00xx said: is this even possible?

    Very typical with many commercial VPN services. They require this kind of geolocation changes from their hosting providers to "offer" locations where they do not have physical servers.

    Thanked by 1bulbasaur
  • Maybe offtopic but, many VPN providers do fake their server locations. They claim they offer many exotic locations but it turns out that the server is actually located in US or EU. The whois country code is that exotic location tho.
    When you contact them, they say GeoIP databases are unrelieable. This seems to be a common practice now.

    Thanked by 1bulbasaur
  • Daniel15Daniel15 Veteran
    edited March 2021

    Yeah, this is trivial to prove through ping times.

    I think this is different to just fake geolocation. M247 are lying to AirVPN and saying that the servers are physically located in a Cogent data center in Phoenix, but I get ~0.4ms pings from one of my VPSes in Los Angeles to their "Phoenix" VPN servers, which is physically impossible.

    I'm "Daniel15" in that thread too... I'll just copy and paste my comment here:

    I noticed recently that the M247 "Phoenix" location seems to really be located in Los Angeles

    I'm pretty sure you're right, and it's fairly trivial to verify.

    I have a server physically located in Los Angeles, in Psychz Networks' data center. If I ping Indus from that server, I get pings as low as ~0.40ms:

    $ ping indus.airservers.org
    PING indus.airservers.org (193.37.254.26) 56(84) bytes of data.
    64 bytes from 193.37.254.26 (193.37.254.26): icmp_seq=1 ttl=59 time=0.421 ms
    64 bytes from 193.37.254.26 (193.37.254.26): icmp_seq=2 ttl=59 time=0.554 ms
    64 bytes from 193.37.254.26 (193.37.254.26): icmp_seq=3 ttl=59 time=0.450 ms
    64 bytes from 193.37.254.26 (193.37.254.26): icmp_seq=4 ttl=59 time=0.403 ms
    ^C
    --- indus.airservers.org ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 3004ms
    rtt min/avg/max/mdev = 0.403/0.457/0.554/0.058 ms
    

    I don't want to post any links because I'm afraid the forum system will mark this reply as spam, but you can verify this result by searching Google for "Psychz looking glass" and going to their Los Angeles looking glass. It'll let you send pings from their LA network.

    I can guarantee you that you will not get <0.5ms pings to a server that's physically in another location. I can't even get pings that low from one Los Angeles data center to othrer data centers in Los Angeles (ColoCrossing and QuadraNet)!
    Even the best networks are limited by the speed of light. Ping times are round-trip time, so a ping of 0.4ms means it takes 0.2ms to reach the server. Even if you assume a perfect network where data can flow at the speed of light with zero delays (which in reality is not possible), 0.2ms multiplied by the speed of light is only around 60 kilometers. That's less than 1/10 of the distance from Los Angeles to Phoenix!

    Fremont is around the same distance from Los Angeles as Phoenix. If I ping Aquila from the same server, the results are more what you'd expect for that distance:

    $ ping aquila.airservers.org
    PING aquila.airservers.org (199.249.223.129) 56(84) bytes of data.
    64 bytes from 199.249.223.129 (199.249.223.129): icmp_seq=1 ttl=57 time=10.5 ms
    64 bytes from 199.249.223.129 (199.249.223.129): icmp_seq=2 ttl=57 time=10.4 ms
    64 bytes from 199.249.223.129 (199.249.223.129): icmp_seq=3 ttl=57 time=9.98 ms
    64 bytes from 199.249.223.129 (199.249.223.129): icmp_seq=4 ttl=57 time=9.89 ms
    64 bytes from 199.249.223.129 (199.249.223.129): icmp_seq=5 ttl=57 time=10.5 ms
    ^C
    --- aquila.airservers.org ping statistics ---
    5 packets transmitted, 5 received, 0% packet loss, time 4005ms
    rtt min/avg/max/mdev = 9.885/10.258/10.544/0.270 ms
    

    M247 servers in Phoenix operated by us are located in Phoenix, in the following Cogent datacenter:

    From what I've seen so far, I can pretty much guarantee you that the servers are not in that data center. I've tried traceroutes from several providers using Cogent transit. If your VPN servers were actually on Cogent's network in Phoenix, I'd expect them to reach a Cogent router in Phoenix before seeing M247 in the traceroute, as Cogent will keep the traffic in their backbone network for as long as possible. However, in every single case I've seen, the traffic is only routed to Los Angeles on Cogent's network, before moving onto M247's network.

    Perhaps the most telling is doing a traceroute from somewhere east of Phoenix. Here's a traceroute I did from Chicago to Indus via Cogent's looking glass:

    traceroute to indus.airservers.org (193.37.254.26), 30 hops max, 60 byte packets
     1  gi0-0-0-15.99.agr21.ord01.atlas.cogentco.com (66.250.250.89)  0.733 ms  0.731 ms
     2  be2522.ccr42.ord01.atlas.cogentco.com (154.54.81.61)  1.145 ms  1.150 ms
     3  be2831.ccr21.mci01.atlas.cogentco.com (154.54.42.165)  12.541 ms be2832.ccr22.mci01.atlas.cogentco.com (154.54.44.169)  16.431 ms
     4  be3036.ccr22.den01.atlas.cogentco.com (154.54.31.89)  23.957 ms be3035.ccr21.den01.atlas.cogentco.com (154.54.5.89)  23.820 ms
     5  be3046.ccr21.elp01.atlas.cogentco.com (154.54.0.45)  36.725 ms be3047.ccr21.elp01.atlas.cogentco.com (154.54.1.125)  36.957 ms
     6  be2930.ccr32.phx01.atlas.cogentco.com (154.54.42.77)  44.976 ms be2929.ccr31.phx01.atlas.cogentco.com (154.54.42.65)  44.659 ms
     7  be2932.ccr42.lax01.atlas.cogentco.com (154.54.45.162)  56.892 ms  56.898 ms
     8  be3359.ccr41.lax05.atlas.cogentco.com (154.54.3.70)  56.621 ms be3243.ccr41.lax05.atlas.cogentco.com (154.54.27.118)  56.532 ms
     9  38.104.85.170 (38.104.85.170)  56.920 ms  56.904 ms
    10  * *
    11  vlan2909.as09.lax1.us.m247.com (193.9.115.169)  56.739 ms vlan2921.as09.lax1.us.m247.com (193.9.115.167)  56.890 ms
    12  * *
    13  * *
    14  * *
    

    Notice how hop 7 is going from Phoenix to Los Angeles? If the server was physically in Phoenix, there would be no reason to do that.

    All signs point to this server being physically located in Los Angeles. There's a possibility that they terminate the network in Los Angeles and then have private backhaul (like a GRE tunnel) from LA to Phoenix, but I wouldn't bet on it, especially with the 0.4ms pings from Los Angeles.

    As a side note, AirVPN are a very good VPN provider, and they allow port forwarding (up to 20 ports, and you can pick the port numbers) :smile:

    Thanked by 3sibaper _MS_ xx00xx
  • @Daniel15 said:
    Yeah, this is trivial to prove through ping times.

    I think this is different to just fake geolocation. M247 are lying to AirVPN and saying that the servers are physically located in a Cogent data center in Phoenix, but I get ~0.4ms pings from one of my VPSes in Los Angeles to their "Phoenix" VPN servers, which is physically impossible.

    Plot twist, your LA server is in Phoenix.

    Thanked by 1lentro
  • @TimboJones said:

    @Daniel15 said:
    Yeah, this is trivial to prove through ping times.

    I think this is different to just fake geolocation. M247 are lying to AirVPN and saying that the servers are physically located in a Cogent data center in Phoenix, but I get ~0.4ms pings from one of my VPSes in Los Angeles to their "Phoenix" VPN servers, which is physically impossible.

    Plot twist, your LA server is in Phoenix.

    Plot twist: All the Cogent lax routers are actually in Phoenix too

    Thanked by 3TimboJones lentro v3ng
  • @Daniel15 said:

    @TimboJones said:

    @Daniel15 said:
    Yeah, this is trivial to prove through ping times.

    I think this is different to just fake geolocation. M247 are lying to AirVPN and saying that the servers are physically located in a Cogent data center in Phoenix, but I get ~0.4ms pings from one of my VPSes in Los Angeles to their "Phoenix" VPN servers, which is physically impossible.

    Plot twist, your LA server is in Phoenix.

    Plot twist: All the Cogent lax routers are actually in Phoenix too

    Maybe that's what "co-location" meant all along.

    Thanked by 1lentro
  • VirMachVirMach Member, Patron Provider
    edited March 2021

    I believe this is mostly as a result of people going toward using the cheapest geolocation services that don't really update the geolocation often or make super ballpark guesses rather than attempt to do it logically. And then of course no one really asking these providers for "proof" to correct them.

    The only geolocation service provider I've seen that appears to geolocate properly is:
    https://db-ip.com/

    Yet they are relatively expensive, so not as many people use them. Instead, they go to Maxmind that basically, as far as I know sells people a database much cheaper, rather than even using live API calls. So it adds another degree of issues.

    @Kousaka said: Maybe offtopic but, many VPN providers do fake their server locations. They claim they offer many exotic locations but it turns out that the server is actually located in US or EU. The whois country code is that exotic location tho.

    When you contact them, they say GeoIP databases are unrelieable. This seems to be a common practice now.

    We've also had issues with them (Maxmind) in the past where in effort of blocking these companies from coming up with fake locations, they just denied our request to fix the geolocation. Then of course, customer gets upset with us because a third party is doing something wrong. So it goes both ways, even when we are trying to correct these locations they won't listen.

    Easiest solution that could be fairly accurate would be if the person's IP address is pinged/triangulated on top of the geolocation service but I guess no one wants to set that up.

    @1030 said: My VPS from HostUS is located in Amsterdam, NL (from Clouvider) and it displays location as: America/Chicago

    There's two mistakes Maxmind seems to make, the first is "averaging" an IP when they're unsure rather than saying they're unsure. So if they think it's somewhere in US, then it's in Kansas. The second, which is what you seem to be facing, is they usually go with the original company that was assigned the IP addresses and where they were located for the country, so it could just mean Clouvider is using an IP block that was at some point registered to a company in Chicago.

    Not sure if your geolocation is from them, but just a quick educated guess.

    @Daniel15 said: I think this is different to just fake geolocation. M247 are lying to AirVPN and saying that the servers are physically located in a Cogent data center in Phoenix, but I get ~0.4ms pings from one of my VPSes in Los Angeles to their "Phoenix" VPN servers, which is physically impossible.

    Unfortunately it seems like even db-ip doesn't catch this one. I've seen db-ip be fairly accurate but there might be a threshold they use for ping times and they see this one as close enough to Phoenix so I assume they just take their word for it and assume it is in fact Phoenix.

    I've seen db-ip report some of our IPs in Buffalo as somewhere in Pennsylvania maybe in the past when Maxmind marked it as "Kansas" because it was guessing it. So they're definitely using some kind of triangulation or something, but it's not perfect.

    @jackb said: Asia - Vietnam – Hanoi (Physical Server located in Singapore)
    Asia - Philippines – Manila (Physical Server located in Singapore)
    Asia - Cambodia - Phnom Penh (Physical Server located in Singapore)
    Asia - South Africa,Johannesburg (Physical Server located in Singapore)
    Asia - Taiwan (Physical Server located in Singapore)
    Europe - Egypt – Cairo (Physical Server located in Bucharest)
    Europe - Turkey – Istanbul (Physical Server located in Sofia)
    Europe – Russia (Physical Server located in Norway)
    USA - Brazil (Physical Server located in Miami)
    USA - Mexic (Physical Server located in Miami)

    Yeah, this makes me think they keep it just close enough to where the ping times are semi-believable and they slip through other methods of checking geolocation as well.

    It makes M247 pretty desirable for fraud, a lot of these that used to slip through our Maxmind anti-fraud system were M247. Our new anti-fraud system does luckily detect these better though but it also ends up hurting people that have a smaller ISP that incorrectly gets marked as being a VPN.

    Thanked by 1bulbasaur
  • BunnySpeedBunnySpeed Member, Host Rep
    edited March 2021

    They faked a couple locations when we worked with them, Phoenix being one of those. I called them out, they refused to admit that it’s true despite pretty obvious local traceroutes and later a tip from someone. Then I just wasn’t having any of it and we dropped everything we did with M247 (thankfully) :smile:

  • dragon2611dragon2611 Member
    edited March 2021

    @Kousaka said:

    When you contact them, they say GeoIP databases are unrelieable. This seems to be a common practice now.

    GeoIP databases are, I had an IP range Google kept geolocating the IP to somewhere in the UAE, it was rather annoying if I'd logged into gmail via an IP from that range it would often cause an alert.

    Given I'd physically visited the rack and installed some of the hardware I can confidently say it wasn't in the UAE unless someone had stolen the kit and shipped it half way round the world when I was sleeping and managed to pull it off without tripping a single monitoring alarm.

  • The first time I know Location can be fake... I mean, it should be contract stated, right?

  • @Daniel15 said:
    Yeah, this is trivial to prove through ping times.

    I think this is different to just fake geolocation. M247 are lying to AirVPN and saying that the servers are physically located in a Cogent data center in Phoenix, but I get ~0.4ms pings from one of my VPSes in Los Angeles to their "Phoenix" VPN servers, which is physically impossible.

    As a side note, AirVPN are a very good VPN provider, and they allow port forwarding (up to 20 ports, and you can pick the port numbers) :smile:

    i heard some crazy conspiracy theories on irc about m247, also some other vpn providers, but specially about airvpn and their relation ship to m247 and a guy who is hunted by polish intelligence agency xD

  • We have several dedicated servers from M247 and all of them are performing very well compare with other suppliers. As per our conversation with M247, the physical locations are connected with other locations via dedicated transports where they are assuring connectivity and specific IPs, and we can not complain about any issue with those locations. I think this makes the difference between them and other suppliers and their time to react to different issues that could occur in the network.

  • ShazanShazan Member, Host Rep

    @VirMach said:
    The only geolocation service provider I've seen that appears to geolocate properly is:
    https://db-ip.com/

    hmm not really. We are located in Catania while it says we are in Milan. Two completely opposite areas of Italy.

  • avelineaveline Member, Patron Provider

    @BunnySpeed said:
    They faked a couple locations when we worked with them, Phoenix being one of those. I called them out, they refused to admit that it’s true despite pretty obvious local traceroutes and later a tip from someone. Then I just wasn’t having any of it and we dropped everything we did with M247 (thankfully) :smile:

    That's weird. Our account manager is very helpful and did give us a full list of sites and Phoenix and some EU locations are marked as virtual location.

  • BunnySpeedBunnySpeed Member, Host Rep
    edited March 2021

    @aveline said:

    @BunnySpeed said:
    They faked a couple locations when we worked with them, Phoenix being one of those. I called them out, they refused to admit that it’s true despite pretty obvious local traceroutes and later a tip from someone. Then I just wasn’t having any of it and we dropped everything we did with M247 (thankfully) :smile:

    That's weird. Our account manager is very helpful and did give us a full list of sites and Phoenix and some EU locations are marked as virtual location.

    When was that? Our situation happened just as those "locations" opened. I assume people complained afterward, so maybe they gave in.

  • @xx00xx said:
    i heard some crazy conspiracy theories on irc about m247, also some other vpn providers, but specially about airvpn and their relation ship to m247 and a guy who is hunted by polish intelligence agency xD

    Please tell us. I love such stories!

  • avelineaveline Member, Patron Provider

    @BunnySpeed said:

    @aveline said:

    @BunnySpeed said:
    They faked a couple locations when we worked with them, Phoenix being one of those. I called them out, they refused to admit that it’s true despite pretty obvious local traceroutes and later a tip from someone. Then I just wasn’t having any of it and we dropped everything we did with M247 (thankfully) :smile:

    That's weird. Our account manager is very helpful and did give us a full list of sites and Phoenix and some EU locations are marked as virtual location.

    When was that? Our situation happened just as those "locations" opened. I assume people complained afterward, so maybe they gave in.

    Around Feb 2019.

  • @hosterix said: As per our conversation with M247, the physical locations are connected with other locations via dedicated transports where they are assuring connectivity and specific IPs

    The fact that I can ping their "Phoenix" servers from Los Angeles with a 0.4ms RTT means that the server isn't actually in Phoenix at all. If they did have some sort of dedicated backhaul to Phoenix, it should be reflected in the ping times. As far as I can tell, the Phoenix servers are physically in Los Angeles.

    Thanked by 1xx00xx
  • VirMachVirMach Member, Patron Provider

    @dragon2611 said: GeoIP databases are, I had an IP range Google kept geolocating the IP to somewhere in the UAE, it was rather annoying if I'd logged into gmail via an IP from that range it would often cause an alert.

    For Google, that's usually not geolocation, it's because Google tends to try to "remember" the last user for some reason and it goes off different data to try to identify the "real" location of someone. It's also kind of creepy.

    So if someone from the UAE last used the IP address, Google makes an assumption they're there based on whatever that user did on the IP. It's their "solution."

  • @that_guy said:
    Please tell us. I love such stories!

    in short:
    some "pr0grammer's" thought, that a guy is working for mossad, gchq or something like that. they collected data about him and gave this data and other stuff to one polish intelligence agency.

    Thanked by 1that_guy
Sign In or Register to comment.