7 ms·
A vulnerability rating of your IP address
- distortedsignal 9y agoDoes this work with dynamic IP addresses? In the fine print at the bottom of the page, it says that "the data has been collected passively over the last month," and I'm not sure how you can do that for a dynamic IP address. Could you enlighten me?
- balgan 9y agoHi, essentially we scan the entire IPv4 space, 200 ports per month. What we mean by that is that when you open the page a scan won't open targeted directly at your ip address!
- revelation 9y agoSure, but for dynamic IP addresses, the box that had the IP when you scanned it days ago is not necessarily the same that has it now.
- sofaofthedamned 9y agoExactly, this makes this of dubious use at best.
- helb 9y ago> Torrent Downloads: If an IP address detected downloading torrents, the risk level is considered extreme. Why? There is some more info in the README at Github (https://github.com/binaryedge/ratemyip-openframework https://github.com/binaryedge/ratemyip-openframework), but nothing about why torrents induce extreme risk level.
- balgan 9y agoWe will add this information, but essentially we and other partners have seen a high quantity of torrents infected with malware. We intend to fine tune this in the future to differentiate the torrents depending on category!
- helb 9y agoThanks! Additional non-related questions: - How do you scan ipv6s? Scanning the entire space is easy for ipv4 (we do that for some router-security-related projects), but ipv6 space is freaking huge. - Have you considered using something like Shodan (https://www.shodan.io/ https://www.shodan.io/) API instead of scanning the address space by yourselves?
- balgan 9y ago- For IPv6 rather than scanning the entire space, we are currently passively collecting addresses from multiple sources and scan specific addresses - We wouldn't use shodan as we developed our own custom scanners and methodologies of scanning to increase data quality which is extremely important for our customers (cyberinsurers, SoCs, cyberrating companies). We also do some specific things with data which you can check on http://blog.binaryedge.io/2016/11/18/bsides-lisbon-2015/ http://blog.binaryedge.io/2016/11/18/bsides-lisbon-2015/
- msla 9y agoYou could also differentiate OSes, in that most malware is aimed at Windows machines.
- balgan 9y agoFeedback like this is exactly why we made the formula open, we believe there is still lots that can be done with this. Please submit an issue on https://github.com/binaryedge/ratemyip-openframework https://github.com/binaryedge/ratemyip-openframework so that we can have a discussion about impact/usefullness!
- Ajedi32 9y agoAlso: > Web: The lack of at least one security header represents an extreme level of exposure Don't really get that one either. So any site not using HSTS, CSP, or Key Pinning, for example, is automatically at extreme risk?
- balgan 9y agoWe agree that some of the "values" might seem a bit out of place`, we discussed them with multiple security professionals and tried to come up with the best with the different opinions we were given. Please please please submit an issue on the github. Far too many ratings work as blackboxes which is why we decided to "open" our formula. The link for the github is https://github.com/binaryedge/ratemyip-openframework https://github.com/binaryedge/ratemyip-openframework
- deedubaya 9y agoI don't necessarily agree with the risk level, but if analyzing a traditional business network, torrenting probably isn't being used for legitimate uses. Thusly, it's likely it either being used by malware or maybe a ignorant/malicious user.
- yellowapple 9y agoThe problem is that not all business networks are "traditional". Some might be pulling OS install media from a torrent (a lot of FOSS operating systems are distributed this way). Some might even be mirroring/seeding said media.
- IgorPartola 9y agoNo IPv6? Goddamnit, it is 2017.
- balgan 9y agowe will be adding this soon!
- ceejayoz 9y agoYou already have it. What it needs is a way for me to switch. I'm seeing my IPv6 reputation, but I'm more interested in my IPv4.
- robertcope 9y agoIt responded to my IPv6 address just fine.
- throwaway2016a 9y agoWhen I go to the page it shows my IPv6 address. Is your routing set up correctly?
- helb 9y agoIt displayed and "rated" my ipv6 address without any problem, even on an ipv6-only machine.
- mathieuh 9y agoIt showed me my IPv6 address.
- IgorPartola 9y agoMy bad. I forgot about a rather funky firewall rule I have because Netflix doesn't like IPv6. Retracted.
- pmontra 9y agoSome of the assessments make sense for a server but this is going to be called from client machines. Is there an endpoint to call and pass an IP address to test?
- balgan 9y agoUsing the "auto detection" is part of our free offering, our partners usually are able to look at specific ips as we work with cyberinsurers!
- deleted 9y ago[deleted]
- mediumdeviation 9y agoOn a side note, if your fan started spinning up when you opened this, it's because of the particle simulation in the header. I know because I reviewed this library (https://github.com/VincentGarreau/particles.js https://github.com/VincentGarreau/particles.js) when a colleague wanted to add something similar to our site. The problem is it uses a naive O(n^2) algorithm for linking up particles when they get near each other, which wastes a lot of CPU cycles. Running this script with a large number of particles and auto-linking on is ill-advised - but fortunately you can delete the <canvas> element quite easily to stop the script.
- dave5104 9y agoI also noticed they have some janky Javascript playing with the scrolling on the page, which also prevents me from using swipes to go back in my browser. Very annoying when sites mess with that. Give me my usual scrolling inertia!
- balgan 9y agoThanks for this info, I've asked the guys to try and fix this! Apologies in advance!
- fny 9y agoWow... I was about to use this on a landing page I'm building. Thanks for the tip!
- nikkettt 9y agoI just did! Annoying the I had to reduce the number of particles significantly in order not to force CPU to spark. Does anyone have suggestions for an alternative library? (I really don't want to have to write something like this myself for a landing page, talk about overkill)
- dom0 9y agoThe numbers don't add up. For example, I get 14 out of 100. Encryption are all 0, yet "Overall" is 3 out of 6. The only other non-zero value is "Number of open ports" (2). 2+3 != 14. Σ0 = 0 != 3. Obviously, I have no idea what those 12 risk points are. The three encryption points are not explained at all, neither are the remaining nine.
- balgan 9y agoIf you find an issue with the calculation please submit an issue on https://github.com/binaryedge/ratemyip-openframework https://github.com/binaryedge/ratemyip-openframework so that we can address it! Thank you so much!
- filipacsr 9y agoThe overall value of each category is truncated to the maximum value of that category - for example, if you have 10 open ports, you will get an overall score in "Attack Surface" category of 2, because it's the maximum value (vulnerability importance) that we attributed to that category. The final score is the sum of the overall values of all categories, and then it's normalized between 0 and 100. If you have all 0 in Encryption, and then the overall result for that category is 3, something went wrong... thank you for your feedback!
- dom0 9y agoHere's a screenshot http://i.imgur.com/TMXbdpv.png http://i.imgur.com/TMXbdpv.png
- v4n4d1s 9y agoThis tool does not provide enough information about the scan and the detected "problems". 1. It's only scanning for default ports. 2. It told me about having a CVE-Score "3/3", please provide me with the exact CVEs, so I can patch my system accordingly. 3. Running a webserver on Port 80 is not insecure per se, it's just not encrypted. 4. No feature to rescan, provided information is probably old. While I like the overall design, I think this tool is not for technical people, but for everyone who uses the word "cyber" on a daily unironically basis.
- balgan 9y agoHi! 1 - Its scanning 200 ports 2 - Indeed atm we just provide an overall view, we intend to improve this tool further. We had too many people requesting us custom scans when Doublepulsar came out. 3 - True, please submit an issue on the github so a discussion about this can be started. We like having an open formula that people can change/comment on. 4 - Scans are from last 2 months and will keep changing accordingly. It queries our database rather than doing an active scan!
- jsight 9y agoYeah, the CVE scan was really strange to me. I don't see the benefit if I can't see the CVEs themselves.
- sli 9y agoThat's how I felt about all of the ratings. Just arbitrary numbers. I have one out of two ports open? Or do two or more open ports automatically go red? No clue, it doesn't say. 6/6 on HTTP with SSL. Again, six what? Total open HTTP connections? Couldn't I have more than six, and wouldn't that data be important? No clue, it doesn't say. Trying the site with my VPN connection enabled is amusing.
- rishabhd 9y agoReminds me of stuff from Bitsight Tech except they use a proprietary algorithm to rate and give a rating on Organization basis which may have a lot of IPv4/v6 blocks. Also, Censys.io (discounting shodan & zoomeye).
- scierama 9y agoI report any scanning done against my IP's. I do not know what the intentions of the scanner are. People trying to make money making a product that scans my IP's and wastes bandwidth and computing resources that I have to pay for should be jailed in my humble opinion.
- fweespeech 9y agoThats an extreme overreaction to jail these people. Sure, a fine if they don't follow robots.txt might be appropriate but jail? That is absurd.
- scierama 9y agoWhat would you recommend, a fine, perhaps a stern talking to by the authorities?
- fweespeech 9y ago> What would you recommend, a fine, perhaps a stern talking to by the authorities? I already stated a fine is more than sufficient. Or do you think you should be jailed for speeding on the freeway too? Proportionality in relation to the offense is a thing.
- balgan 9y agoWe respect a blacklist, just drop us an email on info@binaryedge.io and we can add your ips to the blacklist and we will never touch them again!
- mikolajekpawlak 9y agoMaybe an automated system ? "Blacklist my IP", only validated if the action is requested by this IP.
- fweespeech 9y agoPlease just set up some sort of robots.txt related thing. E-mailing every single company that does this is ridiculous.
- wink 9y agoWow, I am amazed. Was actually expecting to be bombarded with false positives when I proxy via one of my servers to check that IP - but 0/100 all the time so far. Maybe it's broken the other way round? ;)
- helen89 9y agothanks for the info! I'm not sure this will work with the dynamic IP addresses. I use VPN network to protech my privacy and used to check my ip address to make sure that my real ip is hidden.