Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Check Your IP Reputation Score

ipdata.co

Post reply on HN
Print view View original

41–50 of 78 posts

Re: Check Your IP Reputation Score

#41

Post by data_maan »

SyneRyder wrote: post #23
tuatoru wrote: post #3

Why are "tor", "vpn", "iCloud relay", and "datacenter" considered threats?

I've just been running through my own website logs for the week, and the majority of hacking attacks (mostly attempts at stealing AWS & Git credentials, but also outright hacking, vulnerability scans, exploit attempts & brute forcing attempts) have all been via VPN, Tor exit nodes, and relays. Legit website users just never use VPN or Tor for anything. Datacenter is not necessarily a "threat", but if a datacenter is…

> Legit website users just never use VPN or Tor for anything.

You are wrong. I use that and a minority of legit people also do.

The problem with your type of thinking is that you are only thinking in terms of what the population majority is doing and how they are behaving - lumping the minority of privacy conscious user in with all kinds if malicious actors. Basically the type of thinking that leads to all kinds of discrimination, unfortunately.

Re: Check Your IP Reputation Score

#42

Post by data_maan »

anyfactor wrote: post #15
a-r-t wrote: post #7

Is this ipinfo [0] repackaging their product? [0] https://ipinfo.io/

no. Source: I work for IPinfo. We don't do "IP Reputation Score". We provide the attributes/insights related to an IP address, the user makes the decision of how to use that information.

Seems a slightly better business model than the one from the OP.

But it still comes somewhat close to a China-social-credit system for the internet.

Re: Check Your IP Reputation Score

#43

Post by brushfoot »

jonathan-kosgei wrote: post #36
brushfoot wrote: post #34

This is what I get for a public IP used for some of my websites: Threats: 0 Trust score: 0 - High risk I'm confused why it's considered high risk if no threats were detected. Maybe unknown IPs are considered high risk until proven otherwise?

"Threats" is based on static blocklists. "Trust Score" is generated by a model. So what this means is, "even though this IP hasn't been reported anywhere we still think it's high risk".

> "Trust Score" is generated by a model.

Does a consumer have any insight into what the model does/doesn't like about an IP, or is it a black box?

I'm wondering how they could contextualize a score for their use case, or how I as the IP owner know what to fix to raise the score.

Re: Check Your IP Reputation Score

#44

Post by data_maan »

brushfoot wrote: post #43
jonathan-kosgei wrote: post #36

Earlier quoted context omitted.

"Threats" is based on static blocklists. "Trust Score" is generated by a model. So what this means is, "even though this IP hasn't been reported anywhere we still think it's high risk".

> "Trust Score" is generated by a model. Does a consumer have any insight into what the model does/doesn't like about an IP, or is it a black box? I'm wondering how they could contextualize a score for their use case, or how I as the IP owner know what to fix to raise the score.

In all likelyhood it will be an (neural net?) AI, and then it's hard to get insight into why decisions were made.

And even if they could explain it you, it might be spurious correlations that were picked up.

There is a huge field of interpretable/fair AI and these types of questions arise in much more serious instances (e.g. where people in prison aren't given parole due an AI "assisted" decision). The state of the art seems to be that there are no easy answers as soon as you start questioning a decision by a modern AI system (or want introspection). You can only hope to not be part of the 5% of the cases where the decision is bad.

Re: Check Your IP Reputation Score

#45

Post by SyneRyder »

data_maan wrote: post #41
SyneRyder wrote: post #23

Earlier quoted context omitted.

I've just been running through my own website logs for the week, and the majority of hacking attacks (mostly attempts at stealing AWS & Git credentials, but also outright hacking, vulnerability scans, exploit attempts & brute forcing attempts) have all been via VPN, Tor exit nodes, and relays. Legit website users just never use VPN or Tor for anything. Datacenter is not necessarily a "threat", but if a datacenter is…

> Legit website users just never use VPN or Tor for anything. You are wrong. I use that and a minority of legit people also do. The problem with your type of thinking is that you are only thinking in terms of what the population majority is doing and how they are behaving - lumping the minority of privacy conscious user in with all kinds if malicious actors. Basically the type of thinking that leads to all kinds of d…

No, it is based on my web logs across my websites. I have never had a single purchase come through a VPN or Tor node. I have never had a legitimate customer or personal enquiry come through a VPN or Tor node.

100% of VPN and Tor access to my websites have all been hacking and spam attempts.

I have spent the last few months fighting spam & hacking attempts in detail - primarily from a Russian & Chinese exploit botnet that seems to have spun up around Feb 2021. This is why I am so confident in my statement, because I have been logging and collecting data on the spam & hacking attacks, and analyzing my data daily.

I've detected attacks via AVAST's VPN, Nord VPN, Fiber Grid, Tor exit nodes on Frantech, GleSys AB, Hidehost, Performive VPN, HideMyAss, PureVPN, and I just spent this afternoon tracing a particularly dumb bot that tried sending thousands of requests through StrongVPN, just alternating between 2 IP addresses. And that's just a subset of what I've been fighting against. For what it's worth, I only see the Tor exit nodes occasionally, VPNs are much more common.

I used to think VPNs and Tor were a good thing (about a decade ago). My mind has been changed by looking at the quantitative data I have collected.

Re: Check Your IP Reputation Score

#47

Post by jonathan-kosgei »

data_maan wrote: post #35
MatthiasPortzel wrote: post #30

Earlier quoted context omitted.

It’s correctly distinguished between your home internet and a server. That’s the intention here, to discriminate against VPN users and bots.

What's your problem with VPN users? Are you some kind of voyeur that likes to snoop in other people's private business? Where I go in the internet is my business alone, just like were I go outside my house. And having an online version of China's social credit tracking me online to see if I behave is not a good thing. You are providing a service that is actively diminishing (already brittle) internet privacy and I ha…

IMO VPN services that don't defeat geolocation like Apple's Private Relay, the Google One VPN service and Cloudflare Warp are a good compromise for privacy.

This is because they allow businesses to provide their services without breaking the law eg. gambling is legal in some states and illegal in others, betting services need to distinguish/target users accordingly.

Insurance providers might only be licensed in certain states and not in others and also therefore need to correctly distinguish/target users correctly.

US companies are also restricted from doing business with certain embargoed and sanctioned countries and they are expected to use technological tools like IP geolocation to be compliant.

"OFAC makes clear its expectation that companies consider Internet Protocol ("IP") address geolocation data when assessing whether online customers are located in sanctioned jurisdictions." [0]

These and other legitimate usecases are defeated by VPNs.

[0] https://www.mondaq.com/unitedstates/export-controls-trade-in...

Re: Check Your IP Reputation Score

#49

Post by pfd1986 »

jonathan-kosgei wrote: post #26
lostlogin wrote: post #17

For me it says “error, not connected to internet”. Or just doesn’t run.

Could you try now and let me know if this persists?

Get the same error whenever I try a plus server on proton VPN.

It works (and i get a score of 0, from 80 previously) if I use a standard proton VPN server.

Scary.

Re: Check Your IP Reputation Score

#50

Post by jonathan-kosgei »

data_maan wrote: post #37
jonathan-kosgei wrote: post #32

Earlier quoted context omitted.

No, if your reputation is really bad you'll probably just be shown a captcha.

No, Cloudfare often just blocks you. And if it doesn't, do you think that is a better solution, solving a captcha every 5 minutes? Just try using Google from behind a serious VPN provider, see how that works for you. Also, what is your opinion on geoblock, do you think that is a good thing? It seems you are one of the company's representatives that has never in his life consistently used a VPN or Tor, so you don't ev…

To clarify, showing captchas is what a number of our customers do and I doubt they do it as aggressively as google.

Geoblocks are unfortunately often necessary to comply with the law or contractual obligations eg. media streaming.

Post reply on HN