Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: IP Geolocation and Threat Data API

ipdata.co

Post reply on HN
Print view View original

41–50 of 67 posts

Re: Show HN: IP Geolocation and Threat Data API

#41

Post by toomuchtodo »

always_good wrote: post #20
coderholic wrote: post #14

Jonathan's been doing a great job of ipdata.co! I'd like to also shout out to my own service https://ipinfo.io here though, where we've recently launched new plans that include company details, carrier details, and IP type - we have a custom classifier that labels each IP as isp, business, or hosting, which can be really useful for a bunch of use cases. Here's sample output from the pro plan: { "ip": "66.87.125.72",…

Do you think it's appropriate to shill your own service every time a competitor has a Show HN? You made the same post during OP's last Show HN: https://news.ycombinator.com/item?id=15881463 I also wonder how mature a project has to be before it seems sheepish to "Show HN".

I think it's always appropriate. May the best service win in any Show HN. Feature disparity quickly reaches equilibrium when missing features are highlighted, making all products better (in theory).

Everyone's just trying to do the best they can with what they have.

Re: Show HN: IP Geolocation and Threat Data API

#46

Post by jonathan-kosgei »

sphix0r wrote: post #43

Have you thought how(or if) GDPR will affect your product?

Hi sphix0r, yes. First off we only store logs from user requests for 24hrs and only for analytics. Otherwise our GDPR compliance is still something we're perfecting but something we believe we're already on the right side of.

Re: Show HN: IP Geolocation and Threat Data API

#48

Post by jonathan-kosgei »

colonelxc wrote: post #40
jonathan-kosgei wrote: post #39

Earlier quoted context omitted.

Hi f2n, thank you for raising this concern. is_tor and is_anonymous are true for any and all nodes on the Tor network. I'd love to hear more about your concerns, please send me an email at jonathan at ipdata dot co

For traffic to leave the tor network, it must go via an exit node. Many nodes are just 'relays' (they allow no exiting). A few years ago I ran a no-exit relay from home. Eventually Hulu blocked my IP, even though all traffic from my IP to hulu was from me, and not via tor. Hulu couldn't be bothered to differentiate, and just assumed that a tor node at my IP address meant that traffic coming from that IP must be somet…

Hi colonelxc, we'll probably only include Tor exit nodes in our lists and are working to fix this. Thanks for sharing this.

Re: Show HN: IP Geolocation and Threat Data API

#50

Post by jstarfish »

Looks neat, very clean.

What factors go into determining whether an IP is a threat, and how often is this reviewed?

One of the problems I have with most public intel (don't care if it's FireHOL, Crowdstrike, Alienvault or US-CERT) is that inevitably some GoDaddy (for example) site gets used by an APT and so a GoDaddy IP makes it onto a public blacklist, flagged as being abusive. But a billion other sites also share that IP on that host (or it gets reassigned, as in AWS) which leads to a deluge of false positives anytime anyone else happens across it by means of a legitimate site. Some of these IPs remain blacklisted for years despite any malicious infrastructure long being dismantled.

Do you add any value by mitigating this, or do you just suck down the same public blacklists every other product uses?

Post reply on HN