reincoder

I work for IPinfo. We working on this issue. My apologies for the inconvenience.

I work for IPinfo. If you need IP Address CIDR blocks for any country or ASN, let me know. I have our data in front of me and can send it over via Github Gist. Thank you.

Apologies for the late response. It's awesome to see they're using our data. I did not know that.

> wouldn't it be possible to just let users download the IPinfo data and use it locally? Does IPinfo offer database downloads?

Of course, you can download our free IP database right now: IPinfo Lite

https://ipinfo.io/lite

> Also asking for potential personal use: How does the quality of IPinfo data compare to MaxMind, DB-IP, etc?

We are miles ahead of everyone in terms of accuracy. Currently, we have 1,100+ PoPs across the world running active measurements. While traditional IP geolocation services are no much more than ASN/ISP reported data aggregation and parsing services. Our priority above all is accuracy and at this moment we are likely the industry leader for that.

If you have the time, go through some of our posts in our community and you will be surprised how good our data is right now. I will share my recent favorite one:

https://community.ipinfo.io/t/the-north-korean-gamers-on-ste...

Thank you for sharing the info.

In both cases, they could opt to download our database locally and use it through their own API system.

We sponsor the AlmaLinux Foundation through a data sponsorship for their mirroring system: https://almalinux.org/blog/2024-08-07-mirrors-1-to-400/

But since privacy is a major concern for them, they should just use our IP-to-country database and host an API themselves on top of it: https://ipinfo.io/lite

We are happy to support and be part of any software that want to use our data.

I work for IPinfo. What is the context mentioning us here? I'm unsure if graphene uses our data. We process trillions of requests at the moment. I have no clue which services or software even use our data, let alone identifying individual IP addresses.

Is making a connection to our API a cause for concern? If that is the case, we welcome OSS projects to user our local IP databases, which includes our free IPinfo Lite database that we primarily designed for firewall and privacy applications.

Thank you very much. I wish I could invest more time in this. Just having a dedicated API or backend would mean better selection of IPs, faster gameplay, leaderboards and challenges such as having IP addresses only from a single region or country.

The intention is to go through a creative motion and develop tools and games around IP data without doubling down on any single idea. A form of confined creativity, I suppose.

I made this as meme to guess where a random IP address is geolocated just by looking at the numbers. Then I incorporated ASN and hostname information to introduce a significant winning chance in guessing.

This was coded entirely through ChatGPT/Github Copilot, and the entire functionality is based on the front end.

The selection of IP addresses is randomly generated through a simple function. Valid IP (non-bogon) selection and excluding popular ASNs is done through making an API call to IPinfo Lite. Geolocation information is gathered using the free IPinfo API.

There is a number of things that should improved and PRs are welcome: https://github.com/abdullahdevrel/abdullahdevrel.github.io/t...

I work for IPinfo. If the OP sends me a list of problematic IP addresses, we would be happy to look into them and send back the parent IP ranges. This way, they can block them on the firewall or through a simple IP-based blocklist.

IPv4 addresses change about 0.03% each day.

https://ipinfo.io/blog/how-many-ips-change-geolocation-over-...

Hey Tarik,

Nice to meet you. I love the work you have done so far for IPlocate.io. Keep up the good work. The point you have raised is interesting. However, I am not sure about the "Marketing plays a big role" point you made.

We are a developer-first company.

- Developers need a good product, so we are always committed to providing one, whether it is free or not. The best-in-class product we offer is a result of our obsession with meeting the expectations of our developer community. Our relationship with our developers largely (but not entirely) relies on the quality of our product. And that is not just data (which is again just miles ahead of everyone else). It is integrations, infrastructure, site reliability, uptime, dashboards, tools, CLI, and much more.

- For developers, if they cannot get the best product, you have to tell them why you are not the best. So, we write long community posts and have deep technical discussions. We built the community forum, just for our developers to have conversations directly with us.

- For developers, they need someone to be present and respond, and we are always there. In our community someone from our technical team is available seven days a week.

- For developers, they enjoy a product outside of work, so we will hold huntathon, online games, technical articles and events for them.

Being developer-first comes with revenue perks, sure. Our founder started the company 12 years ago, and it has been slow and stable growth. We have built trust in the community, and today it is impossible for us to find any developers who haven't heard of us. That is not because we have a billboard or spent X amount on paid marketing. They heard of us because they used our product, they like our product, and they know our team.

It is not marketing; it is just general goodwill.

Thank you very much, Nyr. We really appreciate the trust you have placed in us.

We are constantly expanding our probe network, and my colleagues are also working on stabilizing and improving the network.

From 2025 and beyond, we will be putting a lot of effort into our R&D program. Our probe network provides the data that helps our data and research team to create better models.

Currently, a good portion of the data is available to all with no compromise. When we do make mistakes, we hope our community of users will point them out to us. Each ASN or IP address mistake generates a new ticket, our CEO/Founder is tagged there, our data team investigates it, pushes fixes, and provides explanations.

I would not say we have a super strong marketing effort, but we genuinely care about developers. That is how the company started, and that is how the company is operating after 12 years.

We are super obsessed about any points of friction any IPinfo user has, but to be honest, that is just what any developer-first business should do. We are obsessed about developer sentiment and perception, but that is what the industry should be. Our users consist of the smartest people I know, and because we go above and beyond to be helpful to them, they do not point out mistakes we make, they actually try to help us.

Consider our probe network server finding. We genuinely hit a wall after 750 servers. Then we reached out to our community of users, who found 150 more servers. There are even developers who will talk to their local hosting providers in their local language just to get us a server.

Then writing code to integrate our data into different places. Our team is extremely small, so we cannot actively contribute engineering contributions to open source projects. Our users usually help us a lot in writing high-quality code for open source projects they already use.

We are humbled because of the help our user share, and that is why we are obsessed with them and trying our best to go above and beyond to help them.

I work for IPinfo. Thank you for raising a great point.

Integrations and maintenance were major issues when it came to users using the IP database. Usage of our IP database in software and platforms where data download facilities, maintainability (updating the database at regular intervals), and using an MMDB reader library were issues that were stopping us from universal adoption. For example, search/SIEM/threat intel platforms, distributed systems, firewall applications etc.

So, we just decided to launch an API to complement our data downloads. It is easier to use, and the unlimited requests make it a strong candidate.

We are rebuilding our backend in Rust and also developing a bulk enrichment API endpoint. The intention of the API system is to replicate the performance and features you get from a local database, with ease of use and minimal friction. Of course, the API is competing against the local database and will never be perfect, but I have to admit that using the IP database, particularly the binary database, and maintaining it is not as easy as using an API service.

I posted this post answering common questions that I think HN might have: https://news.ycombinator.com/item?id=43928949

Awesome, thank you very much for posting the announcement on HN. We really appreciate it!

I work for IPinfo — I described my process of how I made the game in the other comment.

Using a dataset-based implementation would require me to have a backend, which is out of the scope of this project. Right now, I'm generating random IPv4 addresses, but if I were generating random IPv6 addresses, I would have to go the database route. For that, I would use our free IPinfo Lite dataset: https://ipinfo.io/lite

My colleagues actually developed an extremely fast algorithm to select truly random IPv6 IPs from a series of CIDRs, which is what you see reflected in our dataset.

Let me know if you have any feedback or suggestions for me, please.

I appreciate you enjoying the game! I work for IPinfo but initially made it as a sort of meme for our users.

I'm generating random IP addresses on the frontend, then making an call to our free API to validate the "realness" of the IP addresses — mainly to remove bogon IP addresses, non-routable IPs, and IPs from large ASNs (national ISPs, the DoD, car companies, etc.).

Our free API supports 1,000 requests per day from unique IP addresses, so there shouldn't be any issues for low usage. However, if we get more power users who enjoy the game, I’ll switch to our Lite API service (which is also free, https://ipinfo.io/lite) to validate IP addresses, as it supports unlimited requests.

Let me know if you have any feedback for me :) I made it mostly by "vibe coding", I will write a post about the whole process of it.

Building an IP Geolocation guessing game: https://abdullahdevrel.github.io/ipguessr/

Let me know if you have any feedback or feature requests.

The kind of blocking I'm referring to is IP metadata-based, not blanket country bans. I specifically mentioned that a single `/24` subnet was responsible for ~10% of brute-force attempts in my honeypot. That doesn’t mean I’d block all of Romania — obviously, the Romanian IP space is vastly larger — but it does raise questions about specific ASNs and IP ranges. In this case, Romanian IPs accounted for 16.8% of total attacks. That’s statistically significant and calls for deeper analysis, not assumptions.

Cybersecurity is a probabilistic game. You build a threat model based on your business, audience, and tolerance for risk. Blocking combinations of metadata — such as ASN, country, usage type, and VPN/proxy status — is one way to make informed short-term mitigations while preserving long-term accessibility. For example:

If an ASN is a niche hosting provider in Indonesia, ask: “Do I expect real users from here?”

If a /24 from a single provider accounts for 10% of your attacks, ask: “Do I throttle it or add a CAPTCHA?”

The point isn’t to permanently ban regions or people. It’s to reduce noise and protect services while staying responsive to legitimate usage patterns.

As for IP enrichment — yes, it's still extremely relevant in 2025. Just like JA3, TLS fingerprinting, or behavioral patterns — it's one more layer of insight. But unlike opaque “fraud scores” or black-box models, our approach is fully transparent: we give you raw data, and you build your own model.

We intentionally don’t offer fraud scoring or IP quality scores. Why? Because we believe it reduces agency and transparency. It also risks penalizing privacy-conscious users just for using VPNs. Instead, we let you decide what “risky” means in your own context.

We’re deeply committed to accuracy and evidence-based data. Most IP geolocation providers historically relied on third-party geofeeds or manual submissions — essentially repackaging what networks told them. We took a different route: building a globally distributed network of nearly 1,000 probe servers to generate independent, verifiable measurements for latency-based geolocation. That’s a level of infrastructure investment most providers haven’t attempted, but we believe it's necessary for reliability and precision.

Regarding residential proxies: we’ve built our own residential proxy detection system (https://ipinfo.io/products/residential-proxy) from scratch, and it’s maturing fast. One provider may claim 150M+ exit nodes, but across a 90-day rolling window, we’ve already observed 40,631,473 unique residential proxy IPs — and counting. The space is noisy, but we’re investing heavily in research-first approaches to bring clarity to it.

IP addresses aren’t perfect but nothing is! But with the right context, they’re still one of the most powerful tools available for defending services at the network layer. We provide the context and you build the solution.

Oh, absolutely not — I have to respectfully but strongly disagree with that sentiment.

In cybersecurity, decisions must be guided by objective data, not assumptions or biases. When you’re facing abuse, you analyze the IPs involved and enrich them with context — ASN, country, city, whether it’s VPN, hosting, residential, etc. That gives you the information you need to make calculated decisions: Should you block a subnet? Rate-limit it? CAPTCHA-challenge it?

Here’s a small snapshot from my own SSH honeypot:

Summary of 1,413 attempts

  - Hosting IPs: 981 (69%)
  - VPNs: 35
  - Top ASNs:
    - AS204428 (SS-Net): 152
    - AS136052 (PT Cloud Hosting Indonesia): 83
    - AS14061 (DigitalOcean): 76
  - Top Countries:
    - Romania: 238 (16.8%)
    - United States: 150 (10.6%)
    - China: 134 (9.5%)
    - Indonesia: 115 (8.1%)

One single /24 from Romania accounts for over 10% of the attacks. That’s not about nationality or ethnicity — it's about IP space abuse from a specific network. If a network or country consistently shows high levels of hostile traffic and your risk tolerance justifies it, blocking or throttling it may be entirely reasonable.

Security teams don’t block based on "where people come from" — they block based on where the attacks are coming from.

We even offer tools to help people explore and understand these patterns better. But if someone doesn’t have the time or resources to do that, I'm more than happy to assist by analyzing logs and suggesting reasonable mitigations.

I work for IPinfo (a commercial service). We offer a residential proxy detection service, but it costs money.

If you are being bombarded by suspicious IP addresses, please consider using our free service and blocking IP addresses by ASN or Country. I think ASN is a common parameter for malicious IP addresses. If you do not have time to explore our services/tools (it is mostly just our CLI: https://github.com/ipinfo/cli), simply paste the IP addresses (or logs) in plain text, send it to me and I will let you know the ASNs and corresponding ranges to block.

"Surprisingly relaxed," you say. Let me tell you about the time our users reverse-engineered our apps, submitted 2.2 million IPs, and broke our systems for our hackathon.

https://ipinfo.io/blog/ipinfos-ip-hunt-2-2-million-ips-submi...

This is just our user base, to be honest and we like them for their mindset. We are happy to see users try our service in different ways and we learn a ton from them in that process. I certainly learned from you :)

Thank you very much! I appreciate talking with you in the other thread! I told the repo owner not to worry about "spamming" our service. We are happy to support as many requests as people can throw at us.

Internally, when it comes to API requests, we are doing our best to reach an "unlimited" level of API requests. On the operational side, we are just getting started. The distributed network of a thousand servers we operate only runs a handful of diagnostic tests (ping, traceroute, etc.).

We have a lot of plans, and I hope you will find us providing more fun stuff as we continue to grow!

My apologies if it seems like I'm speaking like a corporate bot. I always try to be as respectful as possible. To be completely honest, the decision to make changes to the homepage was quite difficult for us, but we are trying to figure out what we can do to improve adoption as we evolve.

I largely own the free product/service side of IPinfo, and it’s common for me to hear from developers that they didn’t know we have a free database they can download or we literally have this database for free on GCP and Snowflake. This happens with a lot of our products. For example, many of our users may even do not know we have a residential proxy detection database that we worked really hard to launch.

How can we improve the adoption of our service here? We would like users to explore the site and, at the same time, give us feedback on the areas where they’re facing friction.

Yes, but we also operate 1,000 servers across 400 cities in 130 countries to generate one of the most comprehensive internet measurement datasets possible and process more than 2 trillion yearly API requests.

Still, we really appreciate users and software that only use our service to get their public IP address.

Our priority is always the developer experience and I apologize for the friction you are seeing here.

The issue is that we are truly in a unique space when it comes to internet data. We have gone through several iterations on how to present the full extent of data and not just your public IP address.

If you are a regular user of our service, you know that we have a very open access approach to our data. We provide most of our data for free through our website, we have a generous API, and we have a fully accurate open access licensed database. We also have more free services to be released!

Due to the open data approach, developers appreciate us. We are not trying to create any barriers or friction here, but we are trying to find a balance. If you have any suggestions that can encourage users to explore our data while simultaneously providing everyone with a frictionless experience with our data, please let me know.

We are experimenting with some design choices as we try to highlight all the IP metadata we have and move towards being an "internet data" company instead of just an IP location company.

I highly recommend you check out the page: https://ipinfo.io/myip

I understand the data we have for your IP address is not front and center anymore. We have gone through several iterations of designs for our homepage, so if you have any suggestions, I will relay them to our team.

Instead of jq .ip, please use https://ipinfo.io/ip

This API endpoint has its dedicated stack and infrastructure to support unlimited lookups.

Also, for IPv6 connection use: https://v6.ipinfo.io/ip

PS: I am the DevRel of IPinfo.

When it comes to mirror sponsorships, we (IPinfo) offer IP location data sponsorship. We spoke with Alma Linux and they used our IP location data to route traffic for their mirror system: https://almalinux.org/blog/2024-08-07-mirrors-1-to-400/

At the moment, we operate 900 servers. We evaluated the idea of hosting mirrors on some of our servers, but our servers are not super powerful, and we have to pay for bandwidth. We use these servers in our production pipeline. Maintenance alone is a massive task, and hosting distro mirrors could be incredibly challenging. We are not at that scale yet.

We could provide IP location data sponsorship to popular distro mirror systems, which would make traffic routing and load distributions more effective.

We operate nearly 900 servers, and I believe the capital of cloud infrastructure is Amsterdam, NL. The concentration of ASNs in Amsterdam is incredible. In contrast, Ashburn, Dallas, and LA seem to lack ASN diversity, primarily being dominated by singular big tech companies. Cities like Amsterdam, Singapore, Hong Kong, Frankfurt, Istanbul, and New York, however, have a greater concentration of smaller cloud hosting businesses, offering more diversity.