Non-exit node: https://atlas.torproject.org/#details/EF4BD6E8E5817690B79C67... https://fraudguard.io/?ip=108.61.199.202

It does not seem to make a distinction between exit and relay nodes, they are both deemed "tor_tracker".

On a side note, companies really don't like to deal with people who can't access their site. Being told over and over "It's your ISP", even when on a conference call with said ISP (and nevermind how difficult it was to get that set up with someone who understands the problem) was infuriating.

TOR and people who speak for the service often say that it's safe to run a non-exit relay. It isn't. It's tracked and punished. I know from first-hand experience.

You can see for yourself: https://atlas.torproject.org

Due to a similar IP reputation service, I couldn't pay my taxes from home this year, just because I had run a non-exit Tor relay recently. It's a big problem.

ETA: I'd also strongly recommend not marking an IP address specially in any way just for having a non-exit relay -- from what I've seen, the clients of IP reputation vendors also don't understand the distinction, so they block both kinds if told about both kinds. It's an attractive nuisance.

Something doesn't seem correct to me about this...

It's not clear what this adds on top of FireHOL.

Thats the best answer. The secondary part is we want a simple way for any dev off the street to integrate with api.fraudguard.io in 5 minutes. Imagine you are a small company and you want to limit back office access to you CMS to only IPs outside of Germany. That takes just a couple minutes. Or you want to allow back office access to you CMS from everywhere but you want to decrease the session timeout to only 30 minutes if the originating IP is a tor node or public proxy, etc.

We just got out of beta (literally last night) but so far thats the majority of use cases that we've seen so far.

From a merchandising POV, you could consider moving up-market by building new more powerful features and giving them only to the $25 plan. Then, rename the plans to match who you expect to buy them. People identify with who they are more naturally than they do a number of requests per month.

Also, congrats on shipping.

Edit: Also, pre-fill the form with the visitors own IP -- or better yet just display the results?

This one I'm moving up the list - I like the idea "better yet just display the results of visitors IP"

Obviously we are concerned that a user that doesn't like (example IP) 4.2.2.1 for whatever reason might create 10 accounts and log this IP as malicious so we would need to tag it as user-generated before we turn it on. But we are considering it

I help develop a fairly popular webgame. One of our biggest headaches is people who are evading bans by using VPNs (public or not), VPSes, etc. Although we've outright blocked some large chunks of IPs (AWS, for instance), I've never seen a good service that identifies those specific blocks. Sometimes I go manually digging in the case of serious ban evaders, looking up the owners of specific IP blocks, but boy it'd be convenient if there was a service out there that did that.

Please don't do this. It's perfectly legitimate to route one's traffic through other nodes one owns.

Please consider other ways of dealing with banned players — perhaps make creating an account slow and/or costly.

The problem with the slow/costly account thing is that one of the big draws of our game is that there's no registration necessary. You can jump in a game instantly by pressing 'Play Now', and you just get named 'Some Ball 1/2/3/4/etc' and tossed with the registered players.

Tagpro is awesome btw.

Always glad to find a player in the wild! We're working hard on Next and hope to have the beta open soon.

[1] One source is http://www.routeviews.org/

https://www.shodan.io/search?query=port%3A500%2C4500+vpn

Or you could lookup the IP of the user on Shodan and check whether that IP is running a VPN service. Per IP lookups are free on Shodan and it's fairly simple. For example, this is how you'd do it in Python:

    def is_vpn(user_ip):

        import shodan

        api = shodan.Shodan("API key")

        host = api.host(user_ip)

        for banner in host['data']:

            if banner['port'] in [500, 4500]:

                return True

        return False

https://www.shodan.io/report/2aLrR79C

Edit: I made a modification for conciseness' sake, and to include SSH in the mix as that can be used as a poor man's VPN.

    def is_vpn(self, ip):
        api = shodan.Shodan(self.config['keys']['shodan'])
        host = api.host(ip)
        return any(banner['port'] in [22, 80, 500, 4500] for banner in host['data'])

https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.... https://www.microsoft.com/en-us/download/details.aspx?id=416...

> I help develop a fairly popular webgame.

... unless the web-based game relies on a plugin that can skirt the browser's sandbox, there's no way to probe for active ports.

Do you allow normal users to get around banned IPs by buying a pass or something? (Then you can ban the pass, like 4chan.)

How do you track botnets (along with the other collection you do) with a team of three? How many botnets are being tracked and which malware families? This is an especially dubious claim when coupled with another statement you made: "We do not rely on external sources at this time".

  "country": "China",
  "threat": "unknown",
  "risk_level": "1"

So heres how it works now. We do not rely on external sources at this time. The reason why, because our traffic is so high that no external source at least that we've found will serve our users traffic.

For example stopforumspam.com limits API requests to 20,000 per day. I haven't checked our stats today but during our beta (which ended yesterday) we served more than 20,000 API requests per hour. So even with huge cache durations set its very hard to rely on outside sources so instead we run all our own spam collectors, using our own domains, etc.

502 Bad Gateway

nginx/1.8.1

(I love this spirit of this project. If you have any way others can contribute, I would be interested!)

- Why can there be only one risk type per IP? What if an IP is a honeypot and botnet. It would make sense to me to have a list of threats or a different value for each.

- Why is the threat level a string? Is it meant to be compared for equality only?

Also your docs need a lot of work. I would like to know specifically what threat types there are currently, what their slug is and what specifically they mean.

Regarding only one risk type per IP. We set the severity to the max level logged in our system. If it's a 3, 4 and 5 based of attack type, frequency of attack, method of collection, etc it'll be the highest severity logged. We might look at integrating this differently in v2.

I don't think there are 100s, let alone 1000s, of low-maint customers that are thinking "hmm, this abuse issue is really a problem on my site, consuming at least an hour a month of my time, but I can't afford $49 to fix it".

Think about it, you're asking for $25 for a million checks. Typically that'll be sign-ups or some sort of interaction. So their volume is probably what, 10-50x times that. Even if they used your API for checking before anon comments, that means they're getting millions of pageviews/visits per month. If such a site can't afford a, I dunno, $199 plan, maybe they aren't worth dealing with.

If you really think you need a charity-level plan, perhaps include a contact link for "open source and educational projects".

Someone will probably point out some wildly successful freemium model. Suppose that's possible too. But even then you'll want to make a large gap between free and premium. No one wants to deal with $10/month business customers.

So... what is wrong with a "low" price?

Must pricing nowadays be all game-theory where you want to extract the maximum amount without any regard for underlying value or actual costs?

It's almost a meme on HN: "you are asking too little!" "Raise your prices, double your consulting rate!" "Businesses don't even notice bills under $4999!"

I'm from Romania where my "business" cell phone (with 1GB internet and basically unlimited calls) is costing me $7/month. My build server on AWS used to cost me $25/month. Nowadays I use my own machines so I only pay for some leftover storage and I get a whooping $1.50/month bill on my card. I pay $39/month for accounting.

No matter how great a startup believes their thing is, a business has to cover a lot of expenses and 100 super-duper-products to purchase do add up. At some point it might even make sense to say: yes, I'll have an employee waste 1 hour each month on this problem instead of adding another vendor/product/contract to the list.

And for people using this for fraud, it's gonna take more than a minute, and there might be even more damage. For instance, avoiding chargebacks on 0.1% would more than pay for itself. And that's a good selling point: "Our product will save you $x% a month". It makes it a no-brainer, instant ROI.

So getting, say, $995 vs $25 means he has to find 40x less customers! He can afford to spend a bit on sales. It's a meme on HN because it's true and us engineers have a terrible habit of repeatedly undervaluing things.

He could even offer a "pre-launch" plan if he's worried about startups not wanting to rack up bills before actually having customers. That way they can maintain price plan integrity.

Overall I feel HN/engineers (myself included; I have to force myself here) worry too much about edge cases and keep thinking somehow these cases will make a serious business.

Thanks

If you raise your price, you will only end up dealing with businesses that have identified a need for your product, and know exactly how much fraud and other issues cost them.

With your price as is anyone can use it for any purpose, including those that don't involve losing money because of a fraud transaction.

I considered using you for my site just to get GEO-IP. Sure, I could setup a geoip database myself and keep it in sync manually, but at your price point... it was a no brainer.

Plus I'd get threat analysis thrown in so I can know if one of my users isn't able to see the site because Cloudflare is blocking them for being a tor exit node.

But of course if you charge $1000 a month for that, I won't use it for 'any purporse'. I'll just use it for pre-screening new subscriber accounts (and not free ones) because that's the only time it'd make sense.

Remember, at $10 for $100, he has to convert 10x the number of accounts. People that are considering setting up their own DB usually don't fall into the category of "good SaaS customers".

This is something you can add to your own heuristic, but not really use as-is.