API providing threat analysis of any given IP address • Hacker News Board

Re: API providing threat analysis of any given IP address

#81

Post by AnkhMorporkian » Sun, Aug 07, 2016, 7:52 PM UTC

achillean wrote: post #48

AnkhMorporkian wrote: post #23

I like this, but I have to tell you what I've been looking for in one of these services for forever. I help develop a fairly popular webgame. One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance), I've never seen a good service that identifies those specific blocks. Sometimes I go manually dig…

With Shodan you could export a list of IPs that are currently operating a VPN service: https://www.shodan.io/search?query=port%3A500%2C4500+vpn Or you could lookup the IP of the user on Shodan and check whether that IP is running a VPN service. Per IP lookups are free on Shodan and it's fairly simple. For example, this is how you'd do it in Python: def is_vpn(user_ip): import shodan api = shodan.Shodan("API key") hos…

This is brilliant. Thank you so much!

Edit: I made a modification for conciseness' sake, and to include SSH in the mix as that can be used as a poor man's VPN.

    def is_vpn(self, ip):
        api = shodan.Shodan(self.config['keys']['shodan'])
        host = api.host(ip)
        return any(banner['port'] in [22, 80, 500, 4500] for banner in host['data'])

Re: API providing threat analysis of any given IP address

#82

Post by achillean » Sun, Aug 07, 2016, 8:56 PM UTC

AnkhMorporkian wrote: post #81

achillean wrote: post #48

Earlier quoted context omitted.

With Shodan you could export a list of IPs that are currently operating a VPN service: https://www.shodan.io/search?query=port%3A500%2C4500+vpn Or you could lookup the IP of the user on Shodan and check whether that IP is running a VPN service. Per IP lookups are free on Shodan and it's fairly simple. For example, this is how you'd do it in Python: def is_vpn(user_ip): import shodan api = shodan.Shodan("API key") hos…

This is brilliant. Thank you so much! Edit: I made a modification for conciseness' sake, and to include SSH in the mix as that can be used as a poor man's VPN. def is_vpn(self, ip): api = shodan.Shodan(self.config['keys']['shodan']) host = api.host(ip) return any(banner['port'] in [22, 80, 500, 4500] for banner in host['data'])

I realized it only afterwards but you can actually just look at the host['ports'] property which contains a list of ports that were found open. And you might also want to include PPTP on port 1723.

Re: API providing threat analysis of any given IP address

#83

Post by fragfester » Mon, Aug 08, 2016, 12:23 AM UTC

kevincox wrote: post #76

I have a couple of questions: - Why can there be only one risk type per IP? What if an IP is a honeypot and botnet. It would make sense to me to have a list of threats or a different value for each. - Why is the threat level a string? Is it meant to be compared for equality only? Also your docs need a lot of work. I would like to know specifically what threat types there are currently, what their slug is and what spe…

Thanks for the feedback, completely agreed. We are redoing the entire docs page to give more info on all responses plus some other generic stuff/updates.

Regarding only one risk type per IP. We set the severity to the max level logged in our system. If it's a 3, 4 and 5 based of attack type, frequency of attack, method of collection, etc it'll be the highest severity logged. We might look at integrating this differently in v2.

Re: API providing threat analysis of any given IP address

#84

Post by true_religion » Mon, Aug 08, 2016, 4:08 AM UTC

MichaelGG wrote: post #58

true_religion wrote: post #56

Earlier quoted context omitted.

As a converse to this.... If you raise your price, you will only end up dealing with businesses that have identified a need for your product, and know exactly how much fraud and other issues cost them. With your price as is anyone can use it for any purpose, including those that don't involve losing money because of a fraud transaction. I considered using you for my site just to get GEO-IP. Sure, I could setup a geoi…

Look at the numbers again. 1,000,000 checks a month for $25? Even for an ad-supported site (using the checks for commenting) will get vastly more revenue and be able to afford it. Remember, at $10 for $100, he has to convert 10x the number of accounts. People that are considering setting up their own DB usually don't fall into the category of "good SaaS customers".

True, but if i weren't a technically enabled client then I would want real fraud scrubbing, not this simplistic stuff based solely on someones IP address.

This is something you can add to your own heuristic, but not really use as-is.