API providing threat analysis of any given IP address • Hacker News Board

Re: API providing threat analysis of any given IP address

#41

Post by MichaelGG » Sat, Aug 06, 2016, 8:31 PM UTC

AnkhMorporkian wrote: post #32

dylz wrote: post #30

Earlier quoted context omitted.

The major providers do this: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.... https://www.microsoft.com/en-us/download/details.aspx?id=416...

Yup, and I seriously appreciate those that do that, but it's the small providers which inevitably end up screwing us over. Some small VPS company has a vulnerable server that someone makes a VPN on, and suddenly we get a wave of ban evaders. It ends up being a constant headache.

Isn't this a lost battle? Only remotely possible due to IPv4 being so limited?

Do you allow normal users to get around banned IPs by buying a pass or something? (Then you can ban the pass, like 4chan.)

Re: API providing threat analysis of any given IP address

#42

Post by cmdrfred » Sat, Aug 06, 2016, 8:34 PM UTC

dylz wrote: post #34

AnkhMorporkian wrote: post #32

Earlier quoted context omitted.

Yup, and I seriously appreciate those that do that, but it's the small providers which inevitably end up screwing us over. Some small VPS company has a vulnerable server that someone makes a VPN on, and suddenly we get a wave of ban evaders. It ends up being a constant headache.

If it's default ports, you can just probe on login and deny it. We do this for a game I've admined for, and it's in the terms of service. Common L2TP, PPTP, etc.

Interesting. So if I put a terms of service discussing it on my blog can I nmap all my visitors?

Re: API providing threat analysis of any given IP address

#43

Post by DanielDent » Sat, Aug 06, 2016, 8:34 PM UTC

AnkhMorporkian wrote: post #23

I like this, but I have to tell you what I've been looking for in one of these services for forever. I help develop a fairly popular webgame. One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance), I've never seen a good service that identifies those specific blocks. Sometimes I go manually dig…

While I don't believe this type of thinking about IP addresses represents a sustainable approach to an open internet, https://www.maxmind.com/en/geoip2-anonymous-ip-database and/or https://www.maxmind.com/en/proxy-detection-service may be what you are looking for.

Re: API providing threat analysis of any given IP address

#44

Post by feross » Sat, Aug 06, 2016, 8:39 PM UTC

Most of this data is available for free download via an organization called FireHOL. See http://iplists.firehol.org

It's not clear what this adds on top of FireHOL.

Re: API providing threat analysis of any given IP address

#45

Post by MichaelGG » Sat, Aug 06, 2016, 8:43 PM UTC

fragfester wrote: post #39

mkagenius wrote: post #36

Earlier quoted context omitted.

Why not price a little higher, lower it when you get profits?

We never considered it I guess. Like someone else already mentioned there are other options out there but their prices are insanely ridiculous. Starting at $10 /month the three of us devs/creators feel like a competitive price will keep big and small customers happy hopefully long-term.

Look up articles on pricing plans. $10 is really low and makes your product seem less valuable (if it's so good why are you almost giving it away?). Cheap and free customers are often not worth the headache. You probably want the entry-level plan to be at least $39, $49 or so. Maybe more. Offer a free trial, and let that be enough for the cheap customers.

I don't think there are 100s, let alone 1000s, of low-maint customers that are thinking "hmm, this abuse issue is really a problem on my site, consuming at least an hour a month of my time, but I can't afford $49 to fix it".

Think about it, you're asking for $25 for a million checks. Typically that'll be sign-ups or some sort of interaction. So their volume is probably what, 10-50x times that. Even if they used your API for checking before anon comments, that means they're getting millions of pageviews/visits per month. If such a site can't afford a, I dunno, $199 plan, maybe they aren't worth dealing with.

If you really think you need a charity-level plan, perhaps include a contact link for "open source and educational projects".

Someone will probably point out some wildly successful freemium model. Suppose that's possible too. But even then you'll want to make a large gap between free and premium. No one wants to deal with $10/month business customers.

Re: API providing threat analysis of any given IP address

#46

Post by fragfester » Sat, Aug 06, 2016, 8:49 PM UTC

MichaelGG wrote: post #45

fragfester wrote: post #39

Earlier quoted context omitted.

We never considered it I guess. Like someone else already mentioned there are other options out there but their prices are insanely ridiculous. Starting at $10 /month the three of us devs/creators feel like a competitive price will keep big and small customers happy hopefully long-term.

Look up articles on pricing plans. $10 is really low and makes your product seem less valuable (if it's so good why are you almost giving it away?). Cheap and free customers are often not worth the headache. You probably want the entry-level plan to be at least $39, $49 or so. Maybe more. Offer a free trial, and let that be enough for the cheap customers. I don't think there are 100s, let alone 1000s, of low-maint cu…

Thats really great advice, we're talking about it on Slack now.

Thanks

Re: API providing threat analysis of any given IP address

#47

Post by wtbob » Sat, Aug 06, 2016, 9:21 PM UTC

AnkhMorporkian wrote: post #23

I like this, but I have to tell you what I've been looking for in one of these services for forever. I help develop a fairly popular webgame. One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance), I've never seen a good service that identifies those specific blocks. Sometimes I go manually dig…

> One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance)

Please don't do this. It's perfectly legitimate to route one's traffic through other nodes one owns.

Please consider other ways of dealing with banned players — perhaps make creating an account slow and/or costly.

Re: API providing threat analysis of any given IP address

#48

Post by achillean » Sat, Aug 06, 2016, 9:26 PM UTC

AnkhMorporkian wrote: post #23

I like this, but I have to tell you what I've been looking for in one of these services for forever. I help develop a fairly popular webgame. One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance), I've never seen a good service that identifies those specific blocks. Sometimes I go manually dig…

With Shodan you could export a list of IPs that are currently operating a VPN service:

https://www.shodan.io/search?query=port%3A500%2C4500+vpn

Or you could lookup the IP of the user on Shodan and check whether that IP is running a VPN service. Per IP lookups are free on Shodan and it's fairly simple. For example, this is how you'd do it in Python:

    def is_vpn(user_ip):

        import shodan

        api = shodan.Shodan("API key")

        host = api.host(user_ip)

        for banner in host['data']:

            if banner['port'] in [500, 4500]:

                return True

        return False

Here's an overview of the VPN services that are currently on Shodan:

https://www.shodan.io/report/2aLrR79C

Re: API providing threat analysis of any given IP address

#49

Post by sah2ed » Sat, Aug 06, 2016, 9:37 PM UTC

dylz wrote: post #34

AnkhMorporkian wrote: post #32

Earlier quoted context omitted.

Yup, and I seriously appreciate those that do that, but it's the small providers which inevitably end up screwing us over. Some small VPS company has a vulnerable server that someone makes a VPN on, and suddenly we get a wave of ban evaders. It ends up being a constant headache.

If it's default ports, you can just probe on login and deny it. We do this for a game I've admined for, and it's in the terms of service. Common L2TP, PPTP, etc.

Since the OP said:

> I help develop a fairly popular webgame.

... unless the web-based game relies on a plugin that can skirt the browser's sandbox, there's no way to probe for active ports.

Re: API providing threat analysis of any given IP address

#50

Post by icelancer » Sat, Aug 06, 2016, 9:57 PM UTC

fragfester wrote: post #24

icelancer wrote: post #13

Earlier quoted context omitted.

Not sure, but I've been put on an IP banlist for simply operating a non-exit relay in the past. Had to switch my home IP. The myth that is perpetuated that if you run a non-exit relay that you'll have no problems with IP bans is definitely wrong.

It's my fault. I'll try to find a way to get this data and eventually adjust my code to not include non-exit relays or at least recategorize them as a lower severity.

Not your fault - not talking about your service specifically! My IP was banned by several other companies (I assume from a list that was purchased from a third party) like Hulu/Netflix because I was simply relaying non-exit traffic.

TOR and people who speak for the service often say that it's safe to run a non-exit relay. It isn't. It's tracked and punished. I know from first-hand experience.