Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

API providing threat analysis of any given IP address

fraudguard.io

Post reply on HN
Print view View original

71–80 of 84 posts

Re: API providing threat analysis of any given IP address

#71

Post by aianus »

javajosh wrote: post #70
icelancer wrote: post #50

Earlier quoted context omitted.

Not your fault - not talking about your service specifically! My IP was banned by several other companies (I assume from a list that was purchased from a third party) like Hulu/Netflix because I was simply relaying non-exit traffic. TOR and people who speak for the service often say that it's safe to run a non-exit relay. It isn't. It's tracked and punished. I know from first-hand experience.

Does Tor use it's own port? If so, how hard would it be to switch it to use something like 80, 23, or even 8080?

The IP of a Tor relay is publicly distributed, that's how other nodes know to connect to it.

You can see for yourself: https://atlas.torproject.org

Re: API providing threat analysis of any given IP address

#72

Post by driverdan »

icelancer wrote: post #50
fragfester wrote: post #24

Earlier quoted context omitted.

It's my fault. I'll try to find a way to get this data and eventually adjust my code to not include non-exit relays or at least recategorize them as a lower severity.

Not your fault - not talking about your service specifically! My IP was banned by several other companies (I assume from a list that was purchased from a third party) like Hulu/Netflix because I was simply relaying non-exit traffic. TOR and people who speak for the service often say that it's safe to run a non-exit relay. It isn't. It's tracked and punished. I know from first-hand experience.

I've been running Tor relays from home for about a year. Only sites I've found to block me are Monoprice and Apple's support forums. Hulu and Netflix are fine.

Re: API providing threat analysis of any given IP address

#73

Post by cagey_vet »

finnn wrote: post #12

I operate two non-exit tor relays. They have both return risk_level: 4 with the "threat" being "tor_tracker". What threat is posed by a non-exit tor relay? What does the "tracker" part of "tor_tracker" mean?

i worked in fraud analytics and the consensus was that fraudulent activity weighted higher from certain networks than from others. i wasn't in the position to question the decision regarding threats where i was, i just implemented the risk level rating in software.

Re: API providing threat analysis of any given IP address

#74

Post by toast0 »

ThePhysicist wrote: post #26
AnkhMorporkian wrote: post #23

I like this, but I have to tell you what I've been looking for in one of these services for forever. I help develop a fairly popular webgame. One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance), I've never seen a good service that identifies those specific blocks. Sometimes I go manually dig…

Should be possible using the ASN id of the IP address, and I think Domaintools provides this information and some other fields as well, although their API is not free. That won't help with most VPNs though as they just rent servers from various providers, so you need some kind of active monitoring, which might be tricky to implement from a technical and legal point of view.

If you have a BGP feed, you can use that to go from IP -> ASN, otherwise, there are public bgp dumps [1]. Many networks renting servers are pretty simple to flag this way.

[1] One source is http://www.routeviews.org/

Re: API providing threat analysis of any given IP address

#75

Post by dimino »

phyzome wrote: post #65
fragfester wrote: post #40

Earlier quoted context omitted.

Agreed it was a mistake on my part, I'll fix it up shortly to include only exit nodes.

Thanks, I really appreciate it. Due to a similar IP reputation service, I couldn't pay my taxes from home this year, just because I had run a non-exit Tor relay recently . It's a big problem. ETA: I'd also strongly recommend not marking an IP address specially in any way just for having a non-exit relay -- from what I've seen, the clients of IP reputation vendors also don't understand the distinction, so they block b…

> Due to a similar IP reputation service, I couldn't pay my taxes from home this year, just because I had run a non-exit Tor relay recently. It's a big problem.

Something doesn't seem correct to me about this...

Re: API providing threat analysis of any given IP address

#76

Post by kevincox »

I have a couple of questions:

- Why can there be only one risk type per IP? What if an IP is a honeypot and botnet. It would make sense to me to have a list of threats or a different value for each.

- Why is the threat level a string? Is it meant to be compared for equality only?

Also your docs need a lot of work. I would like to know specifically what threat types there are currently, what their slug is and what specifically they mean.

Re: API providing threat analysis of any given IP address

#77

Post by IshKebab »

AnkhMorporkian wrote: post #53
wtbob wrote: post #47

Earlier quoted context omitted.

> One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance) Please don't do this. It's perfectly legitimate to route one's traffic through other nodes one owns. Please consider other ways of dealing with banned players — perhaps make creating an account slow and/or costly.

We've examined all the options. We already use browser fingerprinting, and that takes care of a good percentage of it, but for the truly committed there are really only two options: Blocking all VPNs, or using supercookies. I'm actually a bigger fan of the supercookie solution, but one of the other developers is staunchly against that. It's an ongoing battle. The problem with the slow/costly account thing is that one…

What do the evil Some Balls do that you want to avoid? I've never noticed an bad behaviour tbh (other than just being not very good).

Tagpro is awesome btw.

Re: API providing threat analysis of any given IP address

#78

Post by ThePhysicist »

toast0 wrote: post #74
ThePhysicist wrote: post #26

Earlier quoted context omitted.

Should be possible using the ASN id of the IP address, and I think Domaintools provides this information and some other fields as well, although their API is not free. That won't help with most VPNs though as they just rent servers from various providers, so you need some kind of active monitoring, which might be tricky to implement from a technical and legal point of view.

If you have a BGP feed, you can use that to go from IP -> ASN, otherwise, there are public bgp dumps [1]. Many networks renting servers are pretty simple to flag this way. [1] One source is http://www.routeviews.org/

Thanks for pointing this out, I couldn't find a way to get the ASN for free, so this is a great resource!

Re: API providing threat analysis of any given IP address

#79

Post by phaedrix »

aianus wrote: post #71
javajosh wrote: post #70

Earlier quoted context omitted.

Does Tor use it's own port? If so, how hard would it be to switch it to use something like 80, 23, or even 8080?

The IP of a Tor relay is publicly distributed, that's how other nodes know to connect to it. You can see for yourself: https://atlas.torproject.org

Although at a guess, most of these services probably do the simplest thing possible and go by an open port.

Re: API providing threat analysis of any given IP address

#80

Post by AnkhMorporkian »

IshKebab wrote: post #77
AnkhMorporkian wrote: post #53

Earlier quoted context omitted.

We've examined all the options. We already use browser fingerprinting, and that takes care of a good percentage of it, but for the truly committed there are really only two options: Blocking all VPNs, or using supercookies. I'm actually a bigger fan of the supercookie solution, but one of the other developers is staunchly against that. It's an ongoing battle. The problem with the slow/costly account thing is that one…

What do the evil Some Balls do that you want to avoid? I've never noticed an bad behaviour tbh (other than just being not very good). Tagpro is awesome btw.

Mostly really nasty chat and working against own team. You don't see too much of it nowadays as we're very proactive about that, and have blocked all the major slurs from being typable.

Always glad to find a player in the wild! We're working hard on Next and hope to have the beta open soon.

Post reply on HN