This looks great! I'll give it a shot for my web game (it's a neverending battle dealing with troll accounts). I've been using Cloudflare to detect TOR, but couldn't find a good way to detect proxies/etc.
You'll love our data :)
Show HN: IP Geolocation and Threat Data API
31–40 of 67 posts
Re: Show HN: IP Geolocation and Threat Data API
#32How often is the threat data updated? Any way to truncate the response to just what we want?
The data is updated as often as every 15 minutes, though we aggregate all those changes over the course of an hour. Are you interested in only the threat data? We have been considering making it possible to query for individual fields
We'd be only interested in threat data for our usecase.
Re: Show HN: IP Geolocation and Threat Data API
#33Do you provide local database? Making a web service call for every request seems like a performance bottle neck.
I've always had good luck with Maxmind's local database [1] offering. It bewilders me how many companies today create SaaS offerings and refuse to offer on-prem versions. It's like they intentionally want to avoid customers with serious needs (speed and security being the most common need for on-prem) who are willing to pay serious amounts of money. [1] https://www.maxmind.com/en/geoip2-databases
Let's say it like this:
- https://api.ipdata.co/1.1.1.1
City name: Research
- https://www.maxmind.com/en/geoip2-precision-demo?ip=1.1.1.1
City name: Research
Oh, that must be a very coincidence.
Nuh nuh nuh, nobody would ever want to launch a SaaS with a database they have stolen.
Re: Show HN: IP Geolocation and Threat Data API
#34Earlier quoted context omitted.
The data is updated as often as every 15 minutes, though we aggregate all those changes over the course of an hour. Are you interested in only the threat data? We have been considering making it possible to query for individual fields
We'd be only interested in threat data for our usecase.
Please send me an email at jonathan at ipdata dot co.
We'll work on exposing the individual fields and I can let you know once that is live.
Re: Show HN: IP Geolocation and Threat Data API
#35Earlier quoted context omitted.
I've always had good luck with Maxmind's local database [1] offering. It bewilders me how many companies today create SaaS offerings and refuse to offer on-prem versions. It's like they intentionally want to avoid customers with serious needs (speed and security being the most common need for on-prem) who are willing to pay serious amounts of money. [1] https://www.maxmind.com/en/geoip2-databases
Let's say it like this: - https://api.ipdata.co/1.1.1.1 City name: Research - https://www.maxmind.com/en/geoip2-precision-demo?ip=1.1.1.1 City name: Research Oh, that must be a very coincidence. Nuh nuh nuh, nobody would ever want to launch a SaaS with a database they have stolen.
They aren't using a copy of Maxminds DB, see:
https://www.maxmind.com/en/geoip2-precision-demo?ip=185.10.6... (No data)
https://api.ipdata.co/185.10.68.114 (lots of data)
Re: Show HN: IP Geolocation and Threat Data API
#36Earlier quoted context omitted.
I've always had good luck with Maxmind's local database [1] offering. It bewilders me how many companies today create SaaS offerings and refuse to offer on-prem versions. It's like they intentionally want to avoid customers with serious needs (speed and security being the most common need for on-prem) who are willing to pay serious amounts of money. [1] https://www.maxmind.com/en/geoip2-databases
Let's say it like this: - https://api.ipdata.co/1.1.1.1 City name: Research - https://www.maxmind.com/en/geoip2-precision-demo?ip=1.1.1.1 City name: Research Oh, that must be a very coincidence. Nuh nuh nuh, nobody would ever want to launch a SaaS with a database they have stolen.
I wonder if Maxmind have put in some "Trap Streets" in their dataset. https://en.wikipedia.org/wiki/Trap_street
Re: Show HN: IP Geolocation and Threat Data API
#37This is definitely really cool and something I imagine myself using for future projects. The price points are very reasonable and the website is very usable. One question I have though is what best practices do you recommend for how one can protect against IP address spoofing.
I don't have a resource to point you to, but feel free to reach out via email jonathan at ipdata dot co. Would love to discuss this
Re: Show HN: IP Geolocation and Threat Data API
#38Why is is_anonymous = true for a tor relay? Why are relays and exit nodes given the same flag? As a tor relay operator, I anticipate this being misused, like so many before it, to arbitrarily block all tor relays by people who don't know or care how tor works.
Re: Show HN: IP Geolocation and Threat Data API
#39Why is is_anonymous = true for a tor relay? Why are relays and exit nodes given the same flag? As a tor relay operator, I anticipate this being misused, like so many before it, to arbitrarily block all tor relays by people who don't know or care how tor works.
Hi f2n, thank you for raising this concern. is_tor and is_anonymous are true for any and all nodes on the Tor network. I'd love to hear more about your concerns, please send me an email at jonathan at ipdata dot co
Re: Show HN: IP Geolocation and Threat Data API
#40Why is is_anonymous = true for a tor relay? Why are relays and exit nodes given the same flag? As a tor relay operator, I anticipate this being misused, like so many before it, to arbitrarily block all tor relays by people who don't know or care how tor works.
Hi f2n, thank you for raising this concern. is_tor and is_anonymous are true for any and all nodes on the Tor network. I'd love to hear more about your concerns, please send me an email at jonathan at ipdata dot co
For traffic to leave the tor network, it must go via an exit node. Many nodes are just 'relays' (they allow no exiting).
A few years ago I ran a no-exit relay from home. Eventually Hulu blocked my IP, even though all traffic from my IP to hulu was from me, and not via tor. Hulu couldn't be bothered to differentiate, and just assumed that a tor node at my IP address meant that traffic coming from that IP must be something routed via Tor.
By not differentiating, you are making the same mistake, and will punish people for no reason.
Edit: Assuming you are pulling the 'exit node list' you link below, I don't see how that is happening, as it does at least claim to verify that you can actually exit through the node.