Show HN: IP Geolocation and Threat Data API

Looks neat, very clean.<p>What factors go into determining whether an IP is a threat, and how often is this reviewed?<p>One of the problems I have with most public intel (don&#x27;t care if it&#x27;s FireHOL, Crowdstrike, Alienvault or US-CERT) is that inevitably some GoDaddy (for example) site gets used by an APT and so a GoDaddy IP makes it onto a public blacklist, flagged as being abusive. But a billion other sites also share that IP on that host (or it gets reassigned, as in AWS) which leads to a deluge of false positives anytime anyone else happens across it by means of a legitimate site. Some of these IPs remain blacklisted for <i>years</i> despite any malicious infrastructure long being dismantled.<p>Do you add any value by mitigating this, or do you just suck down the same public blacklists every other product uses?

Why is is_anonymous = true for a tor relay? Why are relays and exit nodes given the same flag? As a tor relay operator, I anticipate this being misused, like so many before it, to arbitrarily block all tor relays by people who don&#x27;t know or care how tor works.

This looks great! I&#x27;ll give it a shot for my web game (it&#x27;s a neverending battle dealing with troll accounts).<p>I&#x27;ve been using Cloudflare to detect TOR, but couldn&#x27;t find a good way to detect proxies&#x2F;etc.

Hey all! An interesting way to test our API would be to pick a random IP address at <a href="http:&#x2F;&#x2F;check.torproject.org&#x2F;cgi-bin&#x2F;TorBulkExitList.py?ip=1.1.1.1" rel="nofollow">http:&#x2F;&#x2F;check.torproject.org&#x2F;cgi-bin&#x2F;TorBulkExitList.py?ip=1....</a><p>And append it to <a href="https:&#x2F;&#x2F;api.ipdata.co" rel="nofollow">https:&#x2F;&#x2F;api.ipdata.co</a>. For example; <a href="https:&#x2F;&#x2F;api.ipdata.co&#x2F;185.10.68.114" rel="nofollow">https:&#x2F;&#x2F;api.ipdata.co&#x2F;185.10.68.114</a>

Do you provide local database? Making a web service call for every request seems like a performance bottle neck.

This is definitely really cool and something I imagine myself using for future projects. The price points are very reasonable and the website is very usable. One question I have though is what best practices do you recommend for how one can protect against IP address spoofing.

How often is the threat data updated? Any way to truncate the response to just what we want?

One of the few services that geoip&#x27;s my VPN correctly to germany. Too many of them pick it on France and I get shown lots of ads I don&#x27;t understand. And no threat either (some blacklist me for sitting on an OVH network).<p>Good work!

I tried sharing your page on FB messenger to a friend who is interested in this kind of APIs, but Messenger blocked it...man I hate this blacklisting crap...back to IRC it is.

What tool do they use for <a href="https:&#x2F;&#x2F;status.ipdata.co" rel="nofollow">https:&#x2F;&#x2F;status.ipdata.co</a> ?

Seems nice.<p>Small suggestion : 1500 api request for free and 2500 api requests for 10€.<p>I think it&#x27;s a huge leap for pricing, either reduce the requests for free user or reduce de price &#x2F; increase the requests for the first payed plan.

Great job, we have similar service <a href="https:&#x2F;&#x2F;ip-api.io" rel="nofollow">https:&#x2F;&#x2F;ip-api.io</a> - ip geolocation and ip intelligence &#x2F; abuse prevention

Lots of 404 for the images, such as <a href="https:&#x2F;&#x2F;ipdata.co&#x2F;img&#x2F;seworks.svg" rel="nofollow">https:&#x2F;&#x2F;ipdata.co&#x2F;img&#x2F;seworks.svg</a>

Have you thought how(or if) GDPR will affect your product?

getting a 403 on <a href="https:&#x2F;&#x2F;ipdata.co&#x2F;docs.html" rel="nofollow">https:&#x2F;&#x2F;ipdata.co&#x2F;docs.html</a>

How are you identifying Tor?

Jonathan&#x27;s been doing a great job of ipdata.co! I&#x27;d like to also shout out to my own service <a href="https:&#x2F;&#x2F;ipinfo.io" rel="nofollow">https:&#x2F;&#x2F;ipinfo.io</a> here though, where we&#x27;ve recently launched new plans that include company details, carrier details, and IP type - we have a custom classifier that labels each IP as isp, business, or hosting, which can be really useful for a bunch of use cases. Here&#x27;s sample output from the pro plan:<p><pre><code> { &quot;ip&quot;: &quot;66.87.125.72&quot;, &quot;hostname&quot;: &quot;66-87-125-72.pools.spcsdns.net&quot;, &quot;city&quot;: &quot;Southbridge&quot;, &quot;region&quot;: &quot;Massachusetts&quot;, &quot;country&quot;: &quot;US&quot;, &quot;loc&quot;: &quot;42.0707,-72.0440&quot;, &quot;postal&quot;: &quot;01550&quot;, &quot;asn&quot;: { &quot;asn&quot;: &quot;AS10507&quot;, &quot;name&quot;: &quot;Sprint Personal Communications Systems&quot;, &quot;domain&quot;: &quot;spcsdns.net&quot;, &quot;route&quot;: &quot;66.87.125.0&#x2F;24&quot;, &quot;type&quot;: &quot;isp&quot; }, &quot;company&quot;: { &quot;name&quot;: &quot;Sprint&quot;, &quot;domain&quot;: &quot;sprint.com&quot;, &quot;type&quot;: &quot;isp&quot; }, &quot;carrier&quot;: { &quot;name&quot;: &quot;Sprint&quot;, &quot;mcc&quot;: &quot;310&quot;, &quot;mnc&quot;: &quot;120&quot; } } </code></pre> See <a href="https:&#x2F;&#x2F;ipinfo.io&#x2F;responses" rel="nofollow">https:&#x2F;&#x2F;ipinfo.io&#x2F;responses</a> for more of an overview of the differences between our plans.