HNHacker News
TopNewBestAskShowJobs

reincoder

388 karma · joined October 27, 2022

Abdullah, the DevRel at IPinfo.

Things I am responsible for at IPinfo:

- https://is.gd/devrel - https://ipinfo.io/community - https://ipinfo.io/probe-network - https://ipinfo.io/developers - https://ipinfo.io/lite

I am available on LinkedIn more than on my inbox.

submissionscomments
reincoder··on Proof of location for online polls
I work for IPinfo, and we run active measurements through hundreds of servers. Allow me to highlight the fantastic points you made.

> Not all traffic goes through fiber - there are microwave links operating closer to the speed of light, though these are mostly reserved for high-speed trading. There's also satellite connections, but as long as they don't do satellite-staellite, they're slower.

That is a valid point. In that case, we have to fall back on the geofeed, WHOIS, or other methods of geolocation information. We are actively researching this area, though.

> There are middleboxes messing with traffic, especially TCP, which add delay.

This accounts for some problems but not all of them, as we have multiple servers running active measurements on individual IP addresses.

> If you rent servers in datacenters, you might not really know where they are. We had VMs relocated without our knowledge.

That is normal. At the scale at which we operate, server location validity is extremely important. We run daily checks and actively flag these issues. If things don't add up, we communicate with our vendors and try to understand whether it is a network-related issue or something else.

> Anycast prefixes have IPs in multiple locations.

Yes. With anycast IPs, we have hints of all their available locations, but when it comes to picking one, we default to the ASN-reported location.

> My experience was that with a lot of observation points, you could get within 10ms, 1000km in most places.

We have been significantly reducing the number of ASNs where we have high RTT by getting a server "networkly" close to them.

---

I understand that this is not the absolute best location system possible, but within the scope of our industry, we are miles ahead of everyone else. We are continuously investing in research and infrastructure to improve our data even further.

reincoder··on Proof of location for online polls
We (IPinfo) run active measurements through our 900 servers and produce a standard IP geolocation data product. However, to my knowledge, we haven’t partnered with any organizations or institutes to support a project like this, although we certainly have the potential capacity to do so.
reincoder··on Proof of location for online polls
Well, it is not just "can" be done, but we at IPinfo actively measure the internet and produce IP geolocation data. Sure, there are some limitations with satellite, microwave, and certain WAN-based connections, but it is the best solution for IP geolocation available right now, and we are seriously committed to it. Currently, we operate nearly 900 servers running ping, traceroute, and network measurement activity. Literally yesterday, we hit a milestone of having a server across 300 ASNs. We base our servers across diverse locations and networks. I think at this moment we have very few ASN where we do not have sub 10MS ping times.

If you have a question let me know.

reincoder··on Schrödinger's IPv6 Cat
Aside from comparing assigned public IP addresses regularly, I think we (ipinfo) probably have this data internally, or at least we can figure it out. We are pinging and running traceroutes on every IP out there to figure out IP geolocation, so I think we should be able to tag ASNs/ISPs that use CGNAT. So, on CGNAT connections the RTT on the same IP address will be different from time to time and traceroute paths and times will be different as well.

But I'm not sure who will and how they will find this information useful. If anyone can think of a reason why CGNAT detection can be useful generally, I can pitch this to the engineers.

reincoder··on Review of Mullvad VPN
I work for IPinfo and am trying to find out if any open-source projects would implement this feature, particularly in a status bar configuration.

The implementation will be super simple. Set up your local IP address or IP address range (if you are on a dynamic IP address connection). Consistently call 'ipinfo.io/ip' every 5 seconds to check if the IP address is changing from your home IP address. You will get an alert if the IP address changes. So, when you turn on your VPN, this notification should alert you that your IP address has changed.

I would recommend using the 'ipinfo.io/ip' with a public IP address-based implementation as you can get a virtually infinite amount of queries. With just an 'ipinfo.io' query which gets you the location information as well, you get 1,000 queries without a token. This could work if you reduce the API call rate to a higher interval (not at a second level but only at a minute-level interval). But you do get the location information, which validates the VPN's location information.

reincoder··on Show HN: Vince – A self hosted alternative to Google Analytics
> How do you deal with location data, do you purchase maxmind db license or use their free versions.

> Both maxmind and db-ip free versions of city data miss city geo id values, rendering city data useless for many cases.

I work for IPinfo.

I think you might find my conversation with Goatcounter's dev interesting: https://github.com/arp242/goatcounter/issues/765

I pitched him to use our free country database because of MaxMind's EULA issues. MaxMind does not permit distribution of the database and requires end users to use their own token. Moreover, they actually charge thousands of dollars when you distribute the "free" database with a commercial intent.

Now, we have a free IP to Country database that we offer under a straight CC-BY-SA 4.0 license without an EULA. It is free, comes with daily updates, has full accuracy, and you can even commercially redistribute the database (via providing us an attribution).

I understand we do not have a free city database to offer, nor is our database lightweight because we have full accuracy. But you can check it out if you are interested. We do have a version with ASN (ISP) information as well.

reincoder··on How does ChatGPT know my location?
In the context of public information, our API service is used in some OSS LLM projects. I believe the intention behind using our data to contextualize interaction and the user's location background.
reincoder··on Using less memory to look up IP addresses in Mess With DNS
Awesome. We’ve integrated with platforms like GCP BQ, Snowflake, Clickhouse, and Postgres etc. and still, MMDB stands out as the most performant, especially for enriching millions of IPv6 addresses.

The best approach might be to enrich IP addresses via an MMDB database, then dump the results in temp table and query the results as you would any table. If you haven't tried the free db, you should as this illustrate this point pretty well: https://ipinfo.io/products/free-ip-database

It’s great to hear that you’re using our service! Please feel free to reach out anytime if you have any queries/feedback. This thread alone contains comments from 2 IPinfo engineers and me!

reincoder··on Using less memory to look up IP addresses in Mess With DNS
Tried it. I think it is marginally better than SQLite, but it is not the best solution.

I work for IPinfo and was quite excited when they added support for the IP address data type. However, at the end of the day, the most efficient lookup mechanism has to be the MMDB database. Rather doing the enrichment of IP addresses inside of DuckDB, the better solution was doing an enrichment outside of DuckDB using the MMDB database, dump it on a csv and inserting the CSV in DuckDB as a table.

See the top comment of the thread for more context around MMDB.

reincoder··on AWS data center latencies, visualized
As we operate 720+ servers running ping and traceroute continously, I will try to see if we can publish intra provider or intra asn latency data like this but on a massive scale. We have a ton measurement internally but to publish them as a product or even as a web dashboard is tricky as it is hard to measure what the interest could be.
reincoder··on Ping Storms at GreyNoise
Accuracy is difficult to measure, but ours is the best in the industry because we use active measurement. We verify our IP geolocation data with voluntary device location data backed by GPS coordinates, but putting a universal figure on the accuracy is quite difficult.

Based on the RTT to each IP address from a server, we essentially draw radii on the world map. Now, as we ping that IP address from other servers, we can draw more of these radii. From the overlapping areas between these server RTT radii, we can now estimate where the IP address could be. So, in general, areas where we have a high density of servers usually have the highest location granularity.

Now, with 720 servers, these overlapping areas get quite small and reach zip code level accuracy for wired IPv4 addresses. For data centers and larger offices, it goes to geographic coordinate levels sometimes. But for carrier IP IPv6 addresses, consistent city-level accuracy is what we usually aim for.

The data is continuously getting better as we add more probe servers. Currently, from public information, in terms of location diversity, our server network infrastructure is larger than Cloudflare's and any commercial VPN service out there. And we are looking for more servers to add (https://forms.gle/kNYr2MBL8zRPgNrJ8).

reincoder··on Ping Storms at GreyNoise
Well, we do have more than 700 servers pinging everything we can, but in a very respectful manner (https://ipinfo.io/blog/probe-network-how-we-make-sure-our-da...). There is no special packet type or anything; it is just pings. Our volume is much much lower. We avoid doing anything that could annoy anyone. We just take the RTT and triangulate the IP location.
reincoder··on Cloudflare misidentifies Hetzner IPs as being located in Iran
I will describe what we do at IPinfo to avoid such a messup. First of all because we do active measurements and our data is usually less prone to errors like this and when it comes to IP location it is as good as it gets.

We have a support team active 247. Then is the issue of update rollout, when things goes wrong (rarely if ever) we can push data updates immediately. We work with our customers and users and try to push immediate fixes.

But the most important thing in my opinion we do is this comment itself. If things go wrong we will address it before you come to our support team.

reincoder··on Show HN: Doggo – A powerful, human-friendly DNS client for the command line
We have a CLI as well: https://github.com/ipinfo/cli

It has a ton of bells and whistles, including summarize IPs, bulk enrichment, grepip, and a ton of network-related tools. I was writing a series of blog posts on the CLI, but I think the series got too long and left users to discover the features of the CLI on their own.

reincoder··on What You Get After Running an SSH Honeypot for 30 Days
If anyone is looking to run IP metadata based reports on their honeypot, I can suggest IPinfo's CLI (https://github.com/ipinfo/cli). Here is my summary report from Fail2Ban:

``` Summary - Total 1490 - Unique 153 - Anycast 0 - Bogon 0 - Mobile 52 - VPN 91 - Proxy 12 - Hosting 1003 - Tor 0 - Relay 0

Top ASNs - AS132203 Tencent Building, Kejizhongyi Avenue 409 (27.4%) - AS14061 DigitalOcean, LLC 148 (9.9%) - AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 72 (4.8%) - AS16276 OVH SAS 72 (4.8%) - AS206264 Amarutu Technology Ltd 44 (3.0%)

Top Usage Types - Hosting 955 (64.1%) - ISP 418 (28.1%) - Business 49 (3.3%)

Top Routes - 43.134.64.0/18 (AS132203) 48 (3.2%) - 183.81.169.0/24 (AS206264) 44 (3.0%) - 43.156.192.0/18 (AS132203) 36 (2.4%) - 43.130.0.0/18 (AS132203) 36 (2.4%) - 43.134.0.0/18 (AS132203) 36 (2.4%)

Top Countries - United States 276 (18.5%) - Singapore 221 (14.8%) - China 141 (9.5%) - France 88 (5.9%) - Japan 86 (5.8%)

Top Cities - Singapore, Singapore, SG 221 (14.8%) - Santa Clara, California, US 100 (6.7%) - Hong Kong, Hong Kong, HK 80 (5.4%) - Tokyo, Tokyo, JP 61 (4.1%) - Amsterdam, North Holland, NL 50 (3.4%)

Top Regions - Singapore, SG 221 (14.8%) - California, US 134 (9.0%) - Tokyo, JP 86 (5.8%) - Hong Kong, HK 80 (5.4%) - New Jersey, US 70 (4.7%)

Top Carriers - Africell 12 (0.8%) - Claro 12 (0.8%) - Vivo 12 (0.8%) - WINDTRE 12 (0.8%) - Telekom 4 (0.3%)

Top Privacy Services - TunnelBear 36 (2.4%) - Best Proxy Switcher 12 (0.8%)

Top Domains - ovh.net 60 (4.0%) - googleusercontent.com 24 (1.6%) - prod-infinitum.com.mx 16 (1.1%) - poneytelecom.eu 12 (0.8%) ```

Here is the command I used:

``` cat /var/log/fail2ban.log | ipinfo grepip -o | ipinfo summarize ```

The CLI is free to use. You can also do `bulk` enrichment.

``` cat /var/log/fail2ban.log | ipinfo grepip -o | ipinfo bulk -c > fail2ban_ips.csv ```

Disclaimer: I work for IPinfo. However, the CLI is free to use, and the bulk feature will usually work within your free tier limits. Ping me if you have any questions

reincoder··on What You Get After Running an SSH Honeypot for 30 Days
I (DevRel of IPinfo) run Fail2Ban on a VM as well. Protip use the CLI.

- The CLI has the `grepip` command that extracts all the IP addresses from a text. You do not have to parse your logs.

- Analyze your data. After you have extracted your IP addresses from your logs, pipe them to the `summarize`, `map`, and `bulk` commands on the CLI.

- If you are doing bulk enrichment with the `bulk` command, you can use some kind of CSV query tool like CSVtoolkit, DuckDB, or Python-Pandas.

- Look into the ASN data. ASN data is always going to be the more interesting IP metadata for honeypots IPs. Summarize the IP addresses with the `summarize` command; it will give you a high-level report. If you want a web-shareable report, make a POST call to that endpoint. Docs: https://ipinfo.io/tools/summarize-ips

https://github.com/ipinfo/cli

You can always send your logs to me and ask what I think of them, and if I can find common patterns based on IP metadata. I am running our API and database services 24/7 and enjoy looking at logs. I can suggest firewall configurations based on country and ASN information provided by our free data.

reincoder··on Show HN: Every mountain, building and tree shadow mapped for any date and time
200 KM means there is room for improvement. If you reach out to support and provide a correction, that will be quite helpful. If you mention that you came from HN, I can report back on why we had such a deviation.
reincoder··on Show HN: Every mountain, building and tree shadow mapped for any date and time
If you reach out to support and drop a correction with us, that will be quite helpful. This is an unusually high deviation, so we would like to investigate it.
reincoder··on Show HN: Every mountain, building and tree shadow mapped for any date and time
That is very unfortunate. If you reach out to support and drop a correction with us, that will be quite helpful.
reincoder··on Show HN: Every mountain, building and tree shadow mapped for any date and time
I work for IPinfo.io (feel free to check your location data with us to see if we are correct as well). It is most likely that your ISP is sharing your zip code via a WHOIS/geofeed record.
reincoder··on Show HN: Every mountain, building and tree shadow mapped for any date and time
Where do we locate you? https://ipinfo.io/

If the location data is incorrect, you can always submit a correction with us: https://ipinfo.io/corrections

reincoder··on Show HN: Written in Rust – Self hosted and fast GeoIP service with auto updates
That is why our (IPinfo) data downloads just point to a storage URI. The download command is essentially:

curl -L https://ipinfo.io/data/free/country.mmdb?token=token -o country.mmdb

reincoder··on DNS traffic can leak outside the VPN tunnel on Android
Our detection model at ipinfo is largely based on behavior models of IP addresses. We have 700 servers around the world from which we run internet measurement, allowing us to reliably determine which IP addresses are VPNs or proxies. These measurements are largely ping/traceroute data, which enable us to estimate a number of different things most importantly IP location data.

If you are interested in what kind of other information we can discover from our internet measurements, check out our tags page: https://ipinfo.io/tags

reincoder··on DNS traffic can leak outside the VPN tunnel on Android
We have 700 servers around the world and we run measurements over all of the usable internet space, including assigned IPv6 addresses.

I highly recommend reading some of our blog posts and community posts.

You can also checkout our IP data tags page: https://ipinfo.io/tags

reincoder··on Show HN: I made an app that helps you find where to stream movies and TV shows
Feel free to check the IPinfo IP to Country database: https://ipinfo.io/products/free-ip-database

It is pretty easy to use, and comes with full accuracy (daily updates).

reincoder··on So you want to scrape like the big boys (2021)
Excuse my bias, as I work for IPinfo. Rolling your own bot detection service is something you should explore if you want near-absolute coverage.

We intentionally do not provide an IP reputation service as many sophisticated bots mimic the "good reputational" aspect of IP addresses. Usage of residential connections or essentially being vetted by CDN/cloud services makes making bot detection ambiguous.

That is why we provide accurate IP metadata information. Whenever you detect patterns of bot-like behavior, look up the metadata such as privacy service usage, ASN, or assigned company, and then start blocking them via the firewall.

reincoder··on Visualizing malicious IP addresses
I hope you are not being limited by our (IPinfo) free tier request limit in any way.

If you own a public website, you can take advantage of IPinfo's creditlink system and get up to 100K requests per month: https://ipinfo.io/contact/creditlink.

Also, our summary tool and map tool are free and do not require you to sign up. You can take advantage of them as well. They support up to 500k IP submissions.

Additionally, the free country ASN database provides unlimited requests, as it is just a database. Use the MMDB version of the database and the IPinfo CLI.

I understand you probably have a system in place, but please ping me if you need any assistance, especially with using our free IP database.

reincoder··on Visualizing malicious IP addresses
Feel free to check out the IPinfo CLI: https://github.com/ipinfo/cli

I highly recommend the following commands:

  - grepip: extract IP addresses from text.
  - summarize: The command summarizes the IP addresses and provides output in text. It is different than the summary tool I mentioned.
  - bulk: Bulk/batch enrich IP address. Output can be CSV or JSON.
If you need any help or want me to take a look at those IP addresses (or ASNs and organizations), please create a post on the IPinfo community. I can share the code and instructions with you.
reincoder··on Visualizing malicious IP addresses
You can use IPinfo's IP map (https://ipinfo.io/tools/map) or IP summary tool (https://ipinfo.io/tools/summarize-ips).

Both of these services support sending IP addresses via an API endpoint and can handle up to 500k IP addresses. You can also share the report via URL.

reincoder··on Scammers are targeting teenage boys on social media and driving some to suicide
I work for IPinfo, where we provide a VPN detection service. Some people think that our VPN detection service restricts access to various services through a VPN. However, if someone is paying for their internet and then chooses to pay an additional $15-$20 a month for a VPN service, it is likely to be a source of good traffic.

From the point of Facebook, I think they use SMS verification and their app also requires location permission. Facebook is pretty good at preventing bad signups. What they need to do is invest that effort in keeping their user base safe.

← PreviousPage 5 of 7Next →