Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

API providing threat analysis of any given IP address

fraudguard.io

Post reply on HN
Print view View original

21–30 of 84 posts

Re: API providing threat analysis of any given IP address

#21

Post by fragfester »

0x0 wrote: post #18

Tried putting in quite a few IP addresses from /var/log/apache/access.log that have been trying to hit up "wp-config.php" and "phpmyadmin" and whatnot. All of them came back as risk_level 1.

There are a lot of IPs out there. Unlike Pokemon we can't catch them all. It varies but we run less than 50 honeypot nodes in 15 different countries (because I pay for them out of the kindness of my heart each month as we are not yet profitable) right now that would collect this kind of data. Our goal is if we get more people to signup we will add more nodes. Obviously more nodes = more data.

Re: API providing threat analysis of any given IP address

#22

Post by nexact »

fragfester wrote: post #19
nexact wrote: post #17

Earlier quoted context omitted.

I bet he is using maltrail and firehol.

We do use Maltrail along with a whole lot else. You don't have experience with it perhaps? Are you currently employed or angry at your employer?

:-) I built my own API and it is automatically updated every 2 hours. I'm using threatminer to do cross-validation on sampled values.

Re: API providing threat analysis of any given IP address

#23

Post by AnkhMorporkian »

I like this, but I have to tell you what I've been looking for in one of these services for forever.

I help develop a fairly popular webgame. One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance), I've never seen a good service that identifies those specific blocks. Sometimes I go manually digging in the case of serious ban evaders, looking up the owners of specific IP blocks, but boy it'd be convenient if there was a service out there that did that.

Re: API providing threat analysis of any given IP address

#24

Post by fragfester »

icelancer wrote: post #13
finnn wrote: post #12

I operate two non-exit tor relays. They have both return risk_level: 4 with the "threat" being "tor_tracker". What threat is posed by a non-exit tor relay? What does the "tracker" part of "tor_tracker" mean?

Not sure, but I've been put on an IP banlist for simply operating a non-exit relay in the past. Had to switch my home IP. The myth that is perpetuated that if you run a non-exit relay that you'll have no problems with IP bans is definitely wrong.

It's my fault. I'll try to find a way to get this data and eventually adjust my code to not include non-exit relays or at least recategorize them as a lower severity.

Re: API providing threat analysis of any given IP address

#25

Post by hieving »

finnn wrote: post #12

I operate two non-exit tor relays. They have both return risk_level: 4 with the "threat" being "tor_tracker". What threat is posed by a non-exit tor relay? What does the "tracker" part of "tor_tracker" mean?

Exit node: https://atlas.torproject.org/#details/463DC28452F676B7A6597A... https://fraudguard.io/?ip=5.196.143.10

Non-exit node: https://atlas.torproject.org/#details/EF4BD6E8E5817690B79C67... https://fraudguard.io/?ip=108.61.199.202

It does not seem to make a distinction between exit and relay nodes, they are both deemed "tor_tracker".

Re: API providing threat analysis of any given IP address

#26

Post by ThePhysicist »

AnkhMorporkian wrote: post #23

I like this, but I have to tell you what I've been looking for in one of these services for forever. I help develop a fairly popular webgame. One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance), I've never seen a good service that identifies those specific blocks. Sometimes I go manually dig…

Should be possible using the ASN id of the IP address, and I think Domaintools provides this information and some other fields as well, although their API is not free. That won't help with most VPNs though as they just rent servers from various providers, so you need some kind of active monitoring, which might be tricky to implement from a technical and legal point of view.

Re: API providing threat analysis of any given IP address

#27

Post by fragfester »

edoceo wrote: post #20
kolanos wrote: post #7

If the creators are on HN, curious to know what sets this apart from other threat intel services like IBM X-Force, ThreatConnect, VirusTotal, Carbon Black, etc.

And AbuseIPDB

So in the past we talked about this kind of integration. Our only concern would be user generated content. Our users can 100% trust that if an IP is in our system and logged as a level 5 risk level, that that the originating IP hacked one of our nodes and was caught in the process.

Obviously we are concerned that a user that doesn't like (example IP) 4.2.2.1 for whatever reason might create 10 accounts and log this IP as malicious so we would need to tag it as user-generated before we turn it on. But we are considering it

Re: API providing threat analysis of any given IP address

#30

Post by dylz »

AnkhMorporkian wrote: post #23

I like this, but I have to tell you what I've been looking for in one of these services for forever. I help develop a fairly popular webgame. One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance), I've never seen a good service that identifies those specific blocks. Sometimes I go manually dig…

The major providers do this:

https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.... https://www.microsoft.com/en-us/download/details.aspx?id=416...

Post reply on HN