18 ms·

A New Future for Icanhazip

980 points by nkcmr 5y ago

sneak 5y ago
This story is kind of sad. I wonder why the operator didn't blacklist certain netblocks/ASNs who were abusing the service.
- thegeekbin 5y ago
  Why punish a group for one bad actor?
  - zootboy 5y ago
    > There were many times where I saw a big traffic jump and I realized the traffic was coming from the same ASN, and likely from the same company. I tried reaching out to these companies when I saw it but they rarely ever replied. Some even became extremely hostile to my emails. A hostile reply from a netblock operator seems like a perfectly valid reason to block their traffic.
    - jeroenhd 5y ago
      The problem is that you don't know what the source of the traffic is. It could be an incompetent network operator/sysadmin, but it could just as well be something like an IP camera that people bought in good faith. If you block the CGNAT system of an operator that has a hundred million subscribers because it all seems to come from a single IP range you know nothing about, you could be hurting innocent users with the block. That being said, a service like this doesn't come with any guarantees and if it'd disappear from the net tomorrow, I wouldn't blame the author. Blocking is a perfectly valid solution to this problem, but assuming malice isn't always the right answer. Were I in this situation, I'd rate limit networks per /24 (maybe even /16?) as much as I could, and work together with antivirus companies to help identify infections of malware known to use the service to discourage criminals from abusing the system. I wouldn't even bother hosting the site on IPv6 since those addresses are supposed to be public anyway. The author clearly has more patience than I do.
      - terom 5y ago
        Looking at the icanhazip.com site, I wonder how much any kind of rate-limiting per address/block would even help. At the HTTP level it's probably cheaper to just return the HTTP 200 response. I suppose if you're doing TLS handshakes then a packet-level rate-limit would help significantly, but at the same time I'd be wary of triggering any kind of retry-behavior. Worst-case scenario for a service like this would be having an error response/timeout trigger some kind of unlimited retry flood.
        jeroenhd 5y ago
        The block route I'd go with is blackholing the entire range into nothing through BGP or similar so the servers wouldn't have to deal with the traffic, similar to how anti DDOS tools often work. Might even redirect the DNS for that subnet to the IP of the people running the network, let them deal with the abuse. That'd be a very offensive approach, though. I probably wouldn't bother with TLS either, just a plain HTTP 0.1 response with minimum information should be enough.
      - eximius 5y ago
        In some sense, it might not matter. If an ASN/company admin responds to emails in a hostile fashion, does it matter if they bought their devices in good faith? They're still assholes.
        jeroenhd 5y ago
        Hostility can often come from a place of ignorance or misunderstanding. I can't say much for the former, but the latter can easily go wrong with the cultural and linguistic barrier between operators. The guy operating the NOC may be a dick, but is taking down the IoT networks for all of their customers unknowingly relying on your services really the right way? Personally, I'd say yes, it'd help. However, there's an argument to be made that the hostile ASN operator doesn't represent the people behind the network in the slightest. I can understand that someone may give such an asshat the benefit of doubt and drop it despite their abuse.
      - kortilla 5y ago
    - thegeekbin 5y ago
      As a network operator, you would be surprised how many AS operators are hostile or simply don’t respond. It’s unfortunately very common, even Tier-1’s are hostile. Out of the last month, I sent out 191 abuse reports, of which 10 got replied to, 2 were resolved 6 were “no f** off” style, and 2 were told “can’t fix / won’t fix / don’t know how to fix”. I’m not just referring to Chinese ASNs either, some US Telco’s, German, Australia even.
      - nixgeek 5y ago
        We're entering an era where the content providers and the major clouds are >50% of demand on new subsea capacity. Feels like this blurs 'Tier 1' and the role of backbones because major eyeball networks now interconnect directly with e.g. Facebook or Google. Anyway, on abuse@ response rates, my probably unpopular but realistic take based on looking at tens of thousands of such complaints over the years and having worked for ASNs which have received millions, I'd hazard everyone has an SNR and ROI problem with handling these. There's just too many of them and most aren't actionable. Some examples, "I saw a failed SSH login attempt from 1.2.3.4 and OMG that's a huge issue, you have been compromised, and you must solve this immediately!". OK, well, the subscriber might have: a) Typoed your IP address, b) Been running nmap/zmap over a wide range of IPs for research purposes; c) You're on an IP with a provider who recycled it to you, subscriber has outdated DNS records. What do you expect a 'Tier 1' to do with your report? Many ASNs are now just looking at the pattern of reports per IP address or subscriber, are automating scanning for e.g. open mail relays when whatever processes abuse@ determines the person is complaining about spam, or automating looking for anomalies in flows for DDoS complaints, a human may not even see the ticket unless the automation was able to confirm a problem may exist, and the human will probably only engage the subscriber and won't respond to the 1-1000 things received to abuse@ related to the issue. In Major's case with icanhazip.com it looks like pretty bad behavior from the Chinese ASNs mentioned, but could just be IOT configured to fetch its IP every minute instead of every 60 minutes of 24 hours because someone misunderstood cron. Unfortunate that nobody responded but 30B a day is ~350kRPS (which isn't a lot, in the grand scheme of the internet). I'm sure 30B requests per day is nothing at Cloudflare's scale and they have options to cure these ASNs behavior should they choose, including stuff like IP-based or ASN-based ratelimiting, or even IP/ASN restrictions. I'm sure Cloudflare will learn some interesting things about both the accidental contributors (e.g. cron) and intentional contributors (e.g. botnets) from analyzing the sources generating the requests, and I'm ultimately glad it is them picking this up, their other initiatives like 1.1.1.1 have had been positive for the internet (IMHO).
  - jjeaff 5y ago
    So shutting down the entire service would be preferable to blocking one group?
  - sneak 5y ago
    Denying a request is not punishment, it's simply a lack of consent. You're allowed to return 403s for any reason you like.
- blibble 5y ago
  or even better: respond with incorrect data they'll soon learn
coderholic 5y ago
I'm glad icanhazip will live on! We also see a lot of malware and bot traffic to https://ipinfo.io https://ipinfo.io, but nowhere near these levels!
- CliffStoll 5y ago
  I've been using ipinfo.io for several years -- checking a dynamic ip address every 10 minutes. My thanks for supplying this service! Is there a reason to change over to icanhazip ?
  - coderholic 5y ago
    Awesome! No of course no reason to switch away from us! We provide many more details than icanhazip and others (geo, asn, anycast etc). We handle 40 billion requests a month,and plan to be around forever! I'm just glad that icanhazip is staying up - it sucks when useful services go offline, and negatively impact all their users.
toxik 5y ago
Chinese originated spam and abuse is so outrageously widespread, I don’t understand why there isn’t a conversation going on about cutting them off from the wider internet. They blocked most of it anyway.
- wyager 5y ago
  I would rather have a global network with marginally more spam than a regional network with marginally less.
  - systemvoltage 5y ago
    I believe in reciprocity. China has blocked a lot of the western traffic. So, the west should block China. If they open up, we should welcome them with open arms. Similar spirit as some open source licenses - reciprocity creates fairness and increases collaboration, prevents hawks in a population of doves and improves stability. We are already doing this with trade. The amount of leeway and free lunch China has gotten from the west is insane. I don’t blame China, I blame the west and the rest of the world for not preventing it. Asymmetrical policies are often exploited by capitalism and governments have been caught off guard. I’m not an Anti-China lunatic. It’s just common sense.
    - yarcob 5y ago
      I really don't think blocks and embargoes are going to help anyone. They just suck for all the affected people, but I don't think they are very effective at convincing foreign governments to open up.
      - systemvoltage 5y ago
        We're talking about blocking IPs originating from China. How would that hurt the affected people outside of China? In regards to trade war, HN has discussed this ad-nauseum, I think we should restrict the discussion to internet traffic even though I brought it up as an analogy about asymmetric response from the west in general: https://hn.algolia.com/?q=trade+war https://hn.algolia.com/?q=trade+war
Ayesh 5y ago
I was using icanhazip to check if my Tor circuit was complete, and probably made 50-100 requests per week. The site was getting slow, and I thought it is just a random site that the author didn't really care too much. I dropped my jaw when I read it was getting 30B req/day. Thank you for running this site for so long, and thank you for keeping it up for free, and deciding to not monetize it.
- tyingq 5y ago
  I got a lot of mileage out of neverssl.com before somebody fixed the process to log into various "guest wifi" setups...ones that would intercept/redirect any http request. I'm somewhat curious what fixed things, as I've not had to use neverssl.com for some time.
  - lolinder 5y ago
    From what I can tell, most operating systems will now ping their own version of neverssl as you connect to a network to find out whether they need to show you a login prompt. It looks like they basically just check to see if they get the content they expect from a domain they own, and if not they serve you that page so you can see whatever it is your network injected. (You can usually see the OS domain in the address bar.)
    - toxik 5y ago
      captive.apple.com is what Apple uses
      - lolinder 5y ago
        Thanks. I was reaching for an example but don't have a guest WiFi nearby to test.
      - bombcar 5y ago
        Apple has at least ten or more of these I’ve seen - on badly configured networks you sometimes see it in the address bar - because cached responses could destroy the utility.
OskarS 5y ago
I’ve seen packages that do ”internet-detection” by calling out to icanhazip.com, and I just thought that was so irresposnible. What if your package got popular, how much money are you costing the hoster? For services like this, people just don’t consider the fact that there’s someone on the other side.
- ljm 5y ago
  I feel the same about dependency steps in CI, without a cache or any similar structure. Package repos like Rubygems, NPM and PyPi get utterly rinsed by the continual downloading and redownloading of stuff the client should have already stored.
  - trulyme 5y ago
    This. And both with GitHub and GitLab it takes quite a bit of an extra effort to setup caching. It hurts to see 'npm ci' download half the internet every time a developer pushes to dev server.
    - yellow_lead 5y ago
      Would be interesting to speculate about the greenhouse effect of all these repeated downloads
      - bombcar 5y ago
        It used to be possible to have a squid or even a backwards varnish cache handle lots of this but https everything has made that much harder to do. Still possible, however.
      - ljm 5y ago
        If nothing else, it is patently wasteful and, as a user, you don't really see CI billed in terms of network bandwidth. Just indirectly through the equivalent of mainframe minutes. And even then, that's not enough to discourage anyone from building a suboptimal pipeline.
  - 5y ago
swlkr 5y ago
That’s $8.03 per year right?
ColdHeat 5y ago
I used to use this site until I found https://checkip.amazonaws.com/ https://checkip.amazonaws.com/. Switched because I wasn't sure who was behind icanhazip.com and it's tough to beat AWS. Glad to hear that it will likely be maintained for awhile longer!
- madars 5y ago
  Something to be aware of: checkip.amazonaws.com will happily return an X-Forwarded-For address https://stackoverflow.com/questions/52618096/under-what-circumstances-does-checkip-amazonaws-com-return-multiple-addresses https://stackoverflow.com/questions/52618096/under-what-circ...
  - kortilla 5y ago
    Use https
    - lucb1e 5y ago
      That has nothing to do with an HTTP header. See for yourself: $ curl -HX-Forwarded-For:127.0.0.1 https://checkip.amazonaws.com 127.0.0.1
      - gruez 5y ago
        I think the point is to prevent middleboxes (eg. caching proxy servers) from interfering with the request. Otherwise I don't really see the issue with the ip address being affected by X-Forwarded-For. You can just... not specify the header.
      - thewakalix 5y ago
        HTTPS encrypts headers, thereby preventing other people from adding headers to your request. Typically people are not adding X-Forwarded-For to their own requests.
        lucb1e 5y ago
grouphugs 5y ago
my boats for me. i'm not abraham fucking over all of earth lmao
chrischen 5y ago
I feel like in theory google should be returning this site, instead of the ad-filled sites when one searches "my ip address." But it always seems like Google heavily over-values the domain name and search term matches.
- slig 5y ago
  The "first result" in a Google query for "my ip" and other combinations is a box with your public IP. There's no reason to click in any of the ad-filled sites anymore.
  - jetrink 5y ago
    This had been true for me for several years, but recently, I have found that Google no longer provides that info box and it's necessary to click into one of the search results. (I am using Firefox, but I am logged into a Google account of it makes any difference.)
    - arkitaip 5y ago
      Maybe you are getting a/b trapped?
  - chrischen 5y ago
    Yes that's true, but besides the point. My point is that obviously relevant (to a human) results like icanhazip don't show up anywhere just because the domain name is... creative. This happens to more verticals than this one, where the top results happen to be websites with some SEO tricks like having a domain name that matches the search term.
- deleted 5y ago
  [deleted]
madars 5y ago
Thanks for all your hard work! icanhazip.com / icanhazptr.com have been incredibly useful. Small feature request: back in the day {ipv4,ipv6}.{icanhazptr,icanhazip}.com only had A / AAAA records, but now it seems they have both and thus a simple "curl ipv4.icanhzptr.com" can also give me a v6 address (of course, "curl -4" works). Would Cloudfare be OK with separating them again?
- Tijdreiziger 5y ago
  > icanhazptr.com Cool, I didn't know about that one.
- tomschlick 5y ago
  http://v4.icanhazip.com/ http://v4.icanhazip.com/ seems to return just the v4 address, same with http://v6.icanhazip.com/ http://v6.icanhazip.com/
  - madars 5y ago
    Yep, same here -- no AAAA record for v4.icanhazip and no A record for v6.icanhazip . The documented interfaces were ipv4/ipv6 though https://major.io/icanhazip-com-faq/ https://major.io/icanhazip-com-faq/ and {v4,v6}.icanhazptr.com have both A and AAAA.
KirillPanov 5y ago
Suggest retitle: "Cloudflare acquires Icanhazip". Glad it will live on!
- trulyme 5y ago
  "Acquires" is a strong word when we are talking about $8 price. Maybe "Cloudflare becomes custodian of Icanhazip"?
c7DJTLrn 5y ago
I often use whatismyip.akamai.com as a reliable "what's my IP" service but unfortunately it isn't configured correctly for HTTPS.
- lucb1e 5y ago
  Out of curiosity, what makes you use it, if it isn't even configured correctly and there's a million alternatives out there?
mjsir911 5y ago
This kind of service is exactly what STUN servers are made for. Designed to be used with webrtc, but it works perfectly alright by itself. There are a plethora of unauthenticated STUN servers around, and while there's still room for abuse, the protocol is a bit more lightweight than full-blown http requests, and faster, too! I've dabbled with doing this on my own, but I've found `myip` to do the job nicely and without hassle: https://github.com/Snawoot/myip https://github.com/Snawoot/myip
- politelemon 5y ago
  Can this be done using the stun command directly? http://manpages.ubuntu.com/manpages/bionic/man1/stun.1.html http://manpages.ubuntu.com/manpages/bionic/man1/stun.1.html
  - Snawoot 5y ago
    It is, but utility above queries multiple public STUN servers concurrently. As soon as quorum of servers replied with matching addresses, result is returned. This way it's more reliable and offers decent latency guarantees.
superasn 5y ago
Wow so this person has been running this site for so many years, paying bills, answering god knows how many idiots and even getting close to trouble with 3 letter agencies and senators for absolutely nothing.. hats off to you sir, any other person would have thrown in the towel a long time ago. Also i feel little bad you didn't get any money out of it whether the site was designed to make money or not. It would have been a wonderful end to the story if you got something back for all the years of hardwork you put into running it. You do have my appreciation if that means anything though. P.S. this story is very similar to rawgit which was a wonderful site but also fell prey to malware aholes.
- jedberg 5y ago
  > Also i feel little bad you didn't get any money out of I Most likely it got them a much higher paying job than they would have otherwise gotten. Walking in and saying you single handedly run a site with billions of requests per day and petabytes of traffic will get you noticed.
  - rantwasp 5y ago
    Icanhazjob approach!
  - rajishx 5y ago
    Major didn't need icanhazip.com to get a good paying and quality job, this man is legend (at RAX when working with him)
    - jedberg 5y ago
      Being good is neither necessary or sufficient for getting a high paying job. Being able to get in front of a hiring manager who is offering a high paying job and convincing them to hire you is the only thing. And having a very popular website with a ton of traffic is more likely to get you in front of a hiring manager with a good job than actually being good.
      - 5y ago
eruci 5y ago
I used it for a while, then after a couple of failures decided to whip up my own at https://geocode.xyz/myip https://geocode.xyz/myip Took me 5 minutes of work and exactly one line of code.
- andrewstuart2 5y ago
  There's a lot more helpful info you can return, too. Try https://ifconfig.me https://ifconfig.me. Works great in bash scripts too, as it only returns the IP when called with a curl user agent.
  - eruci 5y ago
    This is cool!
leesalminen 5y ago
I run a very simple, completely free API service as well. Currently using Google Cloud Run, handling a constant 10 rps for ~$8/mo. Pretty happy with it. I could probably cost optimize more. I sure hope I never have to deal with 30 billion requests per day, though. I'm sure my patience would run thin as well. Thank you to the author for running this site for so many years!
kissgyorgy 5y ago
I use this service in my Dynamic DNS script for Cloudflare too: https://github.com/kissgyorgy/cloudflare-dyndns https://github.com/kissgyorgy/cloudflare-dyndns It's time to put this service to the first place.
- CliffStoll 5y ago
  Just checked your python script - looks great! I wrote my own script a few years ago -- yours is way more robust!
forrestthewoods 5y ago
> The site went from 1B requests per day to 30-35B requests per day over a weekend. This is absolutely mind blowing.
- jayonsoftware 5y ago
  I always type "what is my ip" in google and get a reply. I am amazed that this service gets 30B to 35B hits a day
  - aembleton 5y ago
    It will be bots using it. I have a python script that calls it every 5 minutes to get my current IP so that I can update my DNS records on Cloudflare. This is because my server is self hosted on a Pi and I don't have a static IP.
    - bombcar 5y ago
      It’s too bad there’s not a simpler way to just ask your router what it’s external IP is or if it has changed. You’d think SNMP could do it.
yakubin 5y ago
There was a thread[1] a couple months ago where I discovered a method to get one's IP address relying only on DNS: nslookup myip.opendns.com resolver1.opendns.com I love it. [1]: <https://news.ycombinator.com/item?id=26634476 https://news.ycombinator.com/item?id=26634476>
- zatkin 5y ago
  This command just returns the IP: dig +short @resolver2.opendns.com myip.opendns.com
- moreati 5y ago
  That will return an IPv6 address, if you have IPv6 connectivity. That's normally be fine, but for occasions it isn't there is dig +short -4 myip.opendns.com a @resolver1.opendns.com
deleted 5y ago
[deleted]
Klasiaster 5y ago
For those behind a home router an alternative is to use UPNP, e.g., through the miniupnpc package on Debian which ships the `/usr/bin/external-ip` script that postprocesses the `upnpc -s` output.
delduca 5y ago
I use this https://cloudflare.com/cdn-cgi/trace https://cloudflare.com/cdn-cgi/trace
slowmovintarget 5y ago
I appreciate the x-otter header, and I think I should now have my team add x-rtfm headers to all of our services and apps.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
jaeerffa 5y ago
Lolhis story is very similar to rawgit which was a wonderful site but also fell prey to malware aholes.
TazeTSchnitzel 5y ago
I admire the fact the author didn't snap at some point and start returning 0.0.0.0 or 127.0.0.1 to some or all queries.
- Aeolun 5y ago
  Or a rate limit of some kind
andrewmcwatters 5y ago
Reminds me of `echo $(dig @ns1.google.com o-o.myaddr.l.google.com TXT +short | tr -d \")`. I have no idea where this DNS query came from, because searching all of Google turns up nothing but https://github.com/GoogleCloudPlatform/cloud-self-test-kit/blob/master/tracerouter.py#L169 https://github.com/GoogleCloudPlatform/cloud-self-test-kit/b..., which is never referenced by anyone. I had to track it down myself for a bootstrap.sh, but I don't like using undocumented sources for critical infrastructure. My use case was needing to set the result of `hostname -f` in /etc/hosts in an automated fashion if a VPS provider didn't already add a line for the public Internet address in that file. You need to do this so that sendmail doesn't fail on `apt install` when it attempts to read your FQDN. So I couldn't use the NGINX example posted elsewhere here. It seems like https://checkip.amazonaws.com/ https://checkip.amazonaws.com/ is much more "reliable" in that it is publicly documented at https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/security-groups.html https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/s.... To anyone who needs to read this: please don't use "services" like icanhazip for your provisioning. Even my examples above are bad. It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. Edit: Oh goodness... even Amazon's documentation recommends using Google's undocumented DNS query.[1] [1]: https://aws.amazon.com/premiumsupport/knowledge-center/route-53-find-ecs-support-dns-resolver/ https://aws.amazon.com/premiumsupport/knowledge-center/route...
- quesera 5y ago
  > It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. It is not possible to know your public IP address, except by fetching the information from a known entity on the public network. And in some scenarios, your public IP will change frequently. There is no guarantee that it will be consistent across multiple requests.
  - andrewmcwatters 5y ago
    Yes it is? I'm not talking about a situation where you send a packet to a DHCP server with 0.0.0.0 in the headers, I'm talking about what happens after the fact. Once you have been allocated an IP address, there should be a way to fetch said address. That's the whole mechanism behind forging UDP packets. If I didn't know what my source IP address was, it would be OK to send 0.0.0.0 out into the world all the time. Practically speaking, today, it is, considering most, but not all, ISPs won't let you do this and they will rewrite UDP packets that attempt to forge their source. Edit: OK, since I'm not being clear, let me be explicit: There should be a mechanism in DHCP which allows for the querying of your public Internet address when receiving a packet from a client in one of the Private-Use Networks as defined in RFC 6890. This query should be exposed as a feature of ifconfig or ip, lest a user be forced to manually write such a packet to receive the data.
Kaze404 5y ago
Reading the title I expected the article to be about a zipping tool called Icanha Zip. Pleasantly surprised by the great article.
barosl 5y ago
Thanks for your service. Now it will get even more traffic as I realized the existence of the site!
pytlicek 5y ago
WOW! Nice story. I’m running very similar project for free and for fun. Also this is usually happening to me every day. Besides other things I’m providing also website checks, so almost every second registration is used to wake up bots like repl.co or minecraft bots hosted on such sites. Life isn’t easy, right? :D anyway it is still the fun to run such service and I understand why author want it alive for a such long time :) when you want to try something similar with few more features, give a try to hostbeat.info
zie 5y ago
You can implement this yourself in nginx like this: location /ip { add_header Content-Type "application/json"; return 200 '{"host":"$server_name","ip":"$remote_addr","port":"$remote_port","server_ip":"$server_addr","server_port":"$server_port"}\n'; } and you will get back a little JSON with everything you want.
- asdfaoeu 5y ago
  Doesn't seem to work right... {"ip": "127.0.0.1", ...} But seriously, of course you can but 99% of people would rather just use a simple site rather than hosting their own server.
  - zie 5y ago
    Because you were doing it from localhost, the connection came from localhost. It has to be exposed out on the internet for it to return an internet IP :) Anyways, I agree for 1 off things, whatever, use icanhazip or whatever you want, it doesn't matter if you make 1 request a day or 1 request a month... But if you are doing anything in code that uses it, you should just host it yourself and be a good net citizen.
cymon 5y ago
I wonder why he did not try to return empty responses to confirmed malware sources, to discourage them from using the site.
hyperion2010 5y ago
This is a perfect illustration of why the DNS system is fundamentally broken. There is zero reason why icanhazip.com needs to or should resolve to a single host or even a single virtual host managed by some SDN operated by a corp that controls thousands of machines. These queries could load balanced across the whole internet, the code is small enough that you could just whitelist the code by checksum and then compare results from multiple underlying hosts. The fact that you need a giant corporation to be able to practically run the backend for what is essentially urn:asker.public.ip is absurd beyond belief. The big players aren't going to fix this because the broken protocols give them a major competitive advantage.
- andrewmcwatters 5y ago
  It's worse than that: you shouldn't have to send an HTTP request to another server somewhere else in the world to figure out your public Internet address.
  - bombcar 5y ago
    I’m surprised there isn’t something in ICMP that returns the routable host IP. Then you could ping anything in the world that responds to ping and know your IP.
867-5309 5y ago
stopped using them a few years ago when they started blocking my VPN. I set up is.gd/icanhazip which points to https://dynupdate.no-ip.com/ip.php https://dynupdate.no-ip.com/ip.php who since the switch have been a great substitute
gamedna 5y ago
Had the pleasure of working with Major at Rackspace; his professionalism, ethics, and quality of person always impressed me and inspired me to be a better version of myself every day. This move is a very mature decision; one that was probably bittersweet. Kudos Major on taking a step forward and putting the stewardship where it belongs.
tofukid 5y ago
What qualifies as “abuse” for a website that simply returns your IP? I don’t get it. You made a free service, and then lots of people started abusing it by... using the service?
- iudqnolq 5y ago
  Giant amounts of traffic (order of billions of requests per day) from a small number of boxes. It clearly doesn't get them anything (if your IP isn't changing multiple times per second you'd be better off caching, if it is you're probably a moron), so it's reasonable to suspect it's either a mistake or an attempt to take the site offline.
simonjgreen 5y ago
I have admired Major for a long time, however I'm disappointed to see further defacto consolidation of widely used Internet infrastructure (regardless of if it should be getting used this way).
- simonjgreen 5y ago
  Not really sure why the downvoting. Do people really think private business is the best place for what has become such a heavily relied on free to use resource? Surely it would be better living with the same stewardship as the root DNS zones or similar.
xbar 5y ago
May the great bird of the galaxy roost upon your home planet, Major.
Cloudef 5y ago
I wonder how much it would've helped if the site was not python. The same thing can be replicated with just nginx something like this: location /remote_addr { default_type text/plain; return 200 "$remote_addr\n"; } It's possible to add rate limit there too to control some of the abuse, of course you could even go further and develop native program that's optimized just for this use case (as well as being a simple HTTP server).
- cbarrick 5y ago
  They did move from Python to nginx circa 2011. It's mentioned in the post.
  - Cloudef 5y ago
    It seems you are right. I was confused by the github page only containing the old python based solution.
dheera 5y ago
> We made a deal for them to pay me $8.03 I seriously can't imagine NOT negotiating with a company like CloudFlare for a decent chunk of money. As a multi-billion dollar corporation, I wouldn't leave money on the table.
codezero 5y ago
So it’s a honey pot now? What a lifecycle.
anonytrary 5y ago
> If you’re curious, Cloudflare did pay me for the site. We made a deal for them to pay me $8.03; the cost of the domain registration. The goal was never to make money from the site (although I did get about $75 in total donations from 2009 to 2021). The goal was to provide a service to the internet. Cloudflare has helped me do that and they will continue to do it as the new owners and operators of icanhazip.com. Damn, I'm almost mad at you for not hustling. Could have left with a few million easily over that entire time period, including charging Cloudfare a small fortune for the site! But hats off to you for being a true altruist. Too many paper altruists these days.
- kilroy123 5y ago
  How?
  - top_kekeroni_m8 5y ago
    There's a lot of value in owning a website that processes billions of requests per month. A lot of people rely on that website, what if he sold it to a malicious user? Tracking IPs or changing what they return?
Ice_cream_suit 5y ago
Truly selfless service. It cost him many thousands in money and tens of thousands in time. And : "If you’re curious, Cloudflare did pay me for the site. We made a deal for them to pay me $8.03; the cost of the domain registration. The goal was never to make money from the site (although I did get about $75 in total donations from 2009 to 2021). The goal was to provide a service to the internet. Cloudflare has helped me do that and they will continue to do it as the new owners and operators of icanhazip.com." BTW, speaking as a nerd, he has the best formatted resume that I have ever seen ! See: https://majorhayden.com/ https://majorhayden.com/
hackburg 5y ago
Are you in need of a professional hacker? We offer the following services and more... . Consulting services. . Email password retrieval. . Credit repair [revolving and installment tradelines}. . Phone hack. . Clearing of criminal records. . Recovery of lost funds on Binary Options and Capital investments. *. Database retrieval..e.t.c... Visit us to know more: Hackburg.blogspot.com
nitwit005 5y ago
With that kind of traffic I'd be tempted to take the site offline for a few days to see if some prominent services had an outage due to relying on it.
devwastaken 5y ago
Cloudflare has an official method to get external IP that uses chaosnet records. I found a little script for it a while ago. In python: https://gist.github.com/czaux/b729a5de8d1334afbbe147a6bcee55e1 https://gist.github.com/czaux/b729a5de8d1334afbbe147a6bcee55...
soheil 5y ago
I read it as "I can has zip" all the while trying to figure out what this has to do with compression.
KaiserPro 5y ago
icanhazip.com is firmly in my debug tool box, I am really grateful that it continues to exist!
Jamie9912 5y ago
There is a weird quirk with icanhazip. It will return an internal cloudflare ip address when using their WARP service with http/3 enabled
zfxfr 5y ago
Wow ! I would never have guessed icanhazip.com got such an enormous amount of requests per day ! I wonder how this site/service achieved such a notoriety ? I am really not trying to diminish the author work but since it is something pretty simple to build and I know there are lots of others alternative I wonder what makes people choose this one over an other like let's say : http://ipinfo.io/ip http://ipinfo.io/ip https://test-ipv6.com/ https://test-ipv6.com/ checkip.amazon.com checkip.dyndns.com http://whatismyip.akamai.com/ http://whatismyip.akamai.com/ ifconfig.me ip.zfx.fr // I even have mine ^^ etc...
zzo38computer 5y ago
It is pretty good; no HTML or anything else like that is needed. I sometimes use it (not very often, but occasionally it is useful); I have a shell script that calls curl to access it. As long as it is continuing working, OK. (I can verify that the returned data is correct without too much difficulty)

980 points by nkcmr 5y ago

This story is kind of sad. I wonder why the operator didn't blacklist certain netblocks/ASNs who were abusing the service.

thegeekbin 5y ago
Why punish a group for one bad actor?
- zootboy 5y ago
  > There were many times where I saw a big traffic jump and I realized the traffic was coming from the same ASN, and likely from the same company. I tried reaching out to these companies when I saw it but they rarely ever replied. Some even became extremely hostile to my emails. A hostile reply from a netblock operator seems like a perfectly valid reason to block their traffic.
  - jeroenhd 5y ago
    The problem is that you don't know what the source of the traffic is. It could be an incompetent network operator/sysadmin, but it could just as well be something like an IP camera that people bought in good faith. If you block the CGNAT system of an operator that has a hundred million subscribers because it all seems to come from a single IP range you know nothing about, you could be hurting innocent users with the block. That being said, a service like this doesn't come with any guarantees and if it'd disappear from the net tomorrow, I wouldn't blame the author. Blocking is a perfectly valid solution to this problem, but assuming malice isn't always the right answer. Were I in this situation, I'd rate limit networks per /24 (maybe even /16?) as much as I could, and work together with antivirus companies to help identify infections of malware known to use the service to discourage criminals from abusing the system. I wouldn't even bother hosting the site on IPv6 since those addresses are supposed to be public anyway. The author clearly has more patience than I do.
    - terom 5y ago
      Looking at the icanhazip.com site, I wonder how much any kind of rate-limiting per address/block would even help. At the HTTP level it's probably cheaper to just return the HTTP 200 response. I suppose if you're doing TLS handshakes then a packet-level rate-limit would help significantly, but at the same time I'd be wary of triggering any kind of retry-behavior. Worst-case scenario for a service like this would be having an error response/timeout trigger some kind of unlimited retry flood.
      - jeroenhd 5y ago
        The block route I'd go with is blackholing the entire range into nothing through BGP or similar so the servers wouldn't have to deal with the traffic, similar to how anti DDOS tools often work. Might even redirect the DNS for that subnet to the IP of the people running the network, let them deal with the abuse. That'd be a very offensive approach, though. I probably wouldn't bother with TLS either, just a plain HTTP 0.1 response with minimum information should be enough.
    - eximius 5y ago
      In some sense, it might not matter. If an ASN/company admin responds to emails in a hostile fashion, does it matter if they bought their devices in good faith? They're still assholes.
      - jeroenhd 5y ago
        Hostility can often come from a place of ignorance or misunderstanding. I can't say much for the former, but the latter can easily go wrong with the cultural and linguistic barrier between operators. The guy operating the NOC may be a dick, but is taking down the IoT networks for all of their customers unknowingly relying on your services really the right way? Personally, I'd say yes, it'd help. However, there's an argument to be made that the hostile ASN operator doesn't represent the people behind the network in the slightest. I can understand that someone may give such an asshat the benefit of doubt and drop it despite their abuse.
    - kortilla 5y ago
  - thegeekbin 5y ago
    As a network operator, you would be surprised how many AS operators are hostile or simply don’t respond. It’s unfortunately very common, even Tier-1’s are hostile. Out of the last month, I sent out 191 abuse reports, of which 10 got replied to, 2 were resolved 6 were “no f** off” style, and 2 were told “can’t fix / won’t fix / don’t know how to fix”. I’m not just referring to Chinese ASNs either, some US Telco’s, German, Australia even.
    - nixgeek 5y ago
      We're entering an era where the content providers and the major clouds are >50% of demand on new subsea capacity. Feels like this blurs 'Tier 1' and the role of backbones because major eyeball networks now interconnect directly with e.g. Facebook or Google. Anyway, on abuse@ response rates, my probably unpopular but realistic take based on looking at tens of thousands of such complaints over the years and having worked for ASNs which have received millions, I'd hazard everyone has an SNR and ROI problem with handling these. There's just too many of them and most aren't actionable. Some examples, "I saw a failed SSH login attempt from 1.2.3.4 and OMG that's a huge issue, you have been compromised, and you must solve this immediately!". OK, well, the subscriber might have: a) Typoed your IP address, b) Been running nmap/zmap over a wide range of IPs for research purposes; c) You're on an IP with a provider who recycled it to you, subscriber has outdated DNS records. What do you expect a 'Tier 1' to do with your report? Many ASNs are now just looking at the pattern of reports per IP address or subscriber, are automating scanning for e.g. open mail relays when whatever processes abuse@ determines the person is complaining about spam, or automating looking for anomalies in flows for DDoS complaints, a human may not even see the ticket unless the automation was able to confirm a problem may exist, and the human will probably only engage the subscriber and won't respond to the 1-1000 things received to abuse@ related to the issue. In Major's case with icanhazip.com it looks like pretty bad behavior from the Chinese ASNs mentioned, but could just be IOT configured to fetch its IP every minute instead of every 60 minutes of 24 hours because someone misunderstood cron. Unfortunate that nobody responded but 30B a day is ~350kRPS (which isn't a lot, in the grand scheme of the internet). I'm sure 30B requests per day is nothing at Cloudflare's scale and they have options to cure these ASNs behavior should they choose, including stuff like IP-based or ASN-based ratelimiting, or even IP/ASN restrictions. I'm sure Cloudflare will learn some interesting things about both the accidental contributors (e.g. cron) and intentional contributors (e.g. botnets) from analyzing the sources generating the requests, and I'm ultimately glad it is them picking this up, their other initiatives like 1.1.1.1 have had been positive for the internet (IMHO).
- jjeaff 5y ago
  So shutting down the entire service would be preferable to blocking one group?
- sneak 5y ago
  Denying a request is not punishment, it's simply a lack of consent. You're allowed to return 403s for any reason you like.
blibble 5y ago
or even better: respond with incorrect data they'll soon learn

coderholic 5y ago

I'm glad icanhazip will live on! We also see a lot of malware and bot traffic to https://ipinfo.io https://ipinfo.io, but nowhere near these levels!

CliffStoll 5y ago
I've been using ipinfo.io for several years -- checking a dynamic ip address every 10 minutes. My thanks for supplying this service! Is there a reason to change over to icanhazip ?
- coderholic 5y ago
  Awesome! No of course no reason to switch away from us! We provide many more details than icanhazip and others (geo, asn, anycast etc). We handle 40 billion requests a month,and plan to be around forever! I'm just glad that icanhazip is staying up - it sucks when useful services go offline, and negatively impact all their users.

toxik 5y ago

Chinese originated spam and abuse is so outrageously widespread, I don’t understand why there isn’t a conversation going on about cutting them off from the wider internet. They blocked most of it anyway.

wyager 5y ago
I would rather have a global network with marginally more spam than a regional network with marginally less.
- systemvoltage 5y ago
  I believe in reciprocity. China has blocked a lot of the western traffic. So, the west should block China. If they open up, we should welcome them with open arms. Similar spirit as some open source licenses - reciprocity creates fairness and increases collaboration, prevents hawks in a population of doves and improves stability. We are already doing this with trade. The amount of leeway and free lunch China has gotten from the west is insane. I don’t blame China, I blame the west and the rest of the world for not preventing it. Asymmetrical policies are often exploited by capitalism and governments have been caught off guard. I’m not an Anti-China lunatic. It’s just common sense.
  - yarcob 5y ago
    I really don't think blocks and embargoes are going to help anyone. They just suck for all the affected people, but I don't think they are very effective at convincing foreign governments to open up.
    - systemvoltage 5y ago
      We're talking about blocking IPs originating from China. How would that hurt the affected people outside of China? In regards to trade war, HN has discussed this ad-nauseum, I think we should restrict the discussion to internet traffic even though I brought it up as an analogy about asymmetric response from the west in general: https://hn.algolia.com/?q=trade+war https://hn.algolia.com/?q=trade+war

Ayesh 5y ago

I was using icanhazip to check if my Tor circuit was complete, and probably made 50-100 requests per week. The site was getting slow, and I thought it is just a random site that the author didn't really care too much. I dropped my jaw when I read it was getting 30B req/day. Thank you for running this site for so long, and thank you for keeping it up for free, and deciding to not monetize it.

tyingq 5y ago
I got a lot of mileage out of neverssl.com before somebody fixed the process to log into various "guest wifi" setups...ones that would intercept/redirect any http request. I'm somewhat curious what fixed things, as I've not had to use neverssl.com for some time.
- lolinder 5y ago
  From what I can tell, most operating systems will now ping their own version of neverssl as you connect to a network to find out whether they need to show you a login prompt. It looks like they basically just check to see if they get the content they expect from a domain they own, and if not they serve you that page so you can see whatever it is your network injected. (You can usually see the OS domain in the address bar.)
  - toxik 5y ago
    captive.apple.com is what Apple uses
    - lolinder 5y ago
      Thanks. I was reaching for an example but don't have a guest WiFi nearby to test.
    - bombcar 5y ago
      Apple has at least ten or more of these I’ve seen - on badly configured networks you sometimes see it in the address bar - because cached responses could destroy the utility.

OskarS 5y ago

I’ve seen packages that do ”internet-detection” by calling out to icanhazip.com, and I just thought that was so irresposnible. What if your package got popular, how much money are you costing the hoster? For services like this, people just don’t consider the fact that there’s someone on the other side.

ljm 5y ago
I feel the same about dependency steps in CI, without a cache or any similar structure. Package repos like Rubygems, NPM and PyPi get utterly rinsed by the continual downloading and redownloading of stuff the client should have already stored.
- trulyme 5y ago
  This. And both with GitHub and GitLab it takes quite a bit of an extra effort to setup caching. It hurts to see 'npm ci' download half the internet every time a developer pushes to dev server.
  - yellow_lead 5y ago
    Would be interesting to speculate about the greenhouse effect of all these repeated downloads
    - bombcar 5y ago
      It used to be possible to have a squid or even a backwards varnish cache handle lots of this but https everything has made that much harder to do. Still possible, however.
    - ljm 5y ago
      If nothing else, it is patently wasteful and, as a user, you don't really see CI billed in terms of network bandwidth. Just indirectly through the equivalent of mainframe minutes. And even then, that's not enough to discourage anyone from building a suboptimal pipeline.
- 5y ago

swlkr 5y ago

That’s $8.03 per year right?

ColdHeat 5y ago

I used to use this site until I found https://checkip.amazonaws.com/ https://checkip.amazonaws.com/. Switched because I wasn't sure who was behind icanhazip.com and it's tough to beat AWS. Glad to hear that it will likely be maintained for awhile longer!

madars 5y ago
Something to be aware of: checkip.amazonaws.com will happily return an X-Forwarded-For address https://stackoverflow.com/questions/52618096/under-what-circumstances-does-checkip-amazonaws-com-return-multiple-addresses https://stackoverflow.com/questions/52618096/under-what-circ...
- kortilla 5y ago
  Use https
  - lucb1e 5y ago
    That has nothing to do with an HTTP header. See for yourself: $ curl -HX-Forwarded-For:127.0.0.1 https://checkip.amazonaws.com 127.0.0.1
    - gruez 5y ago
      I think the point is to prevent middleboxes (eg. caching proxy servers) from interfering with the request. Otherwise I don't really see the issue with the ip address being affected by X-Forwarded-For. You can just... not specify the header.
    - thewakalix 5y ago
      HTTPS encrypts headers, thereby preventing other people from adding headers to your request. Typically people are not adding X-Forwarded-For to their own requests.
      - lucb1e 5y ago

grouphugs 5y ago

my boats for me. i'm not abraham fucking over all of earth lmao

chrischen 5y ago

I feel like in theory google should be returning this site, instead of the ad-filled sites when one searches "my ip address." But it always seems like Google heavily over-values the domain name and search term matches.

slig 5y ago
The "first result" in a Google query for "my ip" and other combinations is a box with your public IP. There's no reason to click in any of the ad-filled sites anymore.
- jetrink 5y ago
  This had been true for me for several years, but recently, I have found that Google no longer provides that info box and it's necessary to click into one of the search results. (I am using Firefox, but I am logged into a Google account of it makes any difference.)
  - arkitaip 5y ago
    Maybe you are getting a/b trapped?
- chrischen 5y ago
  Yes that's true, but besides the point. My point is that obviously relevant (to a human) results like icanhazip don't show up anywhere just because the domain name is... creative. This happens to more verticals than this one, where the top results happen to be websites with some SEO tricks like having a domain name that matches the search term.
deleted 5y ago
[deleted]

madars 5y ago

Thanks for all your hard work! icanhazip.com / icanhazptr.com have been incredibly useful. Small feature request: back in the day {ipv4,ipv6}.{icanhazptr,icanhazip}.com only had A / AAAA records, but now it seems they have both and thus a simple "curl ipv4.icanhzptr.com" can also give me a v6 address (of course, "curl -4" works). Would Cloudfare be OK with separating them again?

Tijdreiziger 5y ago
> icanhazptr.com Cool, I didn't know about that one.
tomschlick 5y ago
http://v4.icanhazip.com/ http://v4.icanhazip.com/ seems to return just the v4 address, same with http://v6.icanhazip.com/ http://v6.icanhazip.com/
- madars 5y ago
  Yep, same here -- no AAAA record for v4.icanhazip and no A record for v6.icanhazip . The documented interfaces were ipv4/ipv6 though https://major.io/icanhazip-com-faq/ https://major.io/icanhazip-com-faq/ and {v4,v6}.icanhazptr.com have both A and AAAA.

KirillPanov 5y ago

Suggest retitle: "Cloudflare acquires Icanhazip". Glad it will live on!

trulyme 5y ago
"Acquires" is a strong word when we are talking about $8 price. Maybe "Cloudflare becomes custodian of Icanhazip"?

c7DJTLrn 5y ago

I often use whatismyip.akamai.com as a reliable "what's my IP" service but unfortunately it isn't configured correctly for HTTPS.

lucb1e 5y ago
Out of curiosity, what makes you use it, if it isn't even configured correctly and there's a million alternatives out there?

mjsir911 5y ago

This kind of service is exactly what STUN servers are made for. Designed to be used with webrtc, but it works perfectly alright by itself. There are a plethora of unauthenticated STUN servers around, and while there's still room for abuse, the protocol is a bit more lightweight than full-blown http requests, and faster, too! I've dabbled with doing this on my own, but I've found `myip` to do the job nicely and without hassle: https://github.com/Snawoot/myip https://github.com/Snawoot/myip

politelemon 5y ago
Can this be done using the stun command directly? http://manpages.ubuntu.com/manpages/bionic/man1/stun.1.html http://manpages.ubuntu.com/manpages/bionic/man1/stun.1.html
- Snawoot 5y ago
  It is, but utility above queries multiple public STUN servers concurrently. As soon as quorum of servers replied with matching addresses, result is returned. This way it's more reliable and offers decent latency guarantees.

superasn 5y ago

Wow so this person has been running this site for so many years, paying bills, answering god knows how many idiots and even getting close to trouble with 3 letter agencies and senators for absolutely nothing.. hats off to you sir, any other person would have thrown in the towel a long time ago. Also i feel little bad you didn't get any money out of it whether the site was designed to make money or not. It would have been a wonderful end to the story if you got something back for all the years of hardwork you put into running it. You do have my appreciation if that means anything though. P.S. this story is very similar to rawgit which was a wonderful site but also fell prey to malware aholes.

jedberg 5y ago
> Also i feel little bad you didn't get any money out of I Most likely it got them a much higher paying job than they would have otherwise gotten. Walking in and saying you single handedly run a site with billions of requests per day and petabytes of traffic will get you noticed.
- rantwasp 5y ago
  Icanhazjob approach!
- rajishx 5y ago
  Major didn't need icanhazip.com to get a good paying and quality job, this man is legend (at RAX when working with him)
  - jedberg 5y ago
    Being good is neither necessary or sufficient for getting a high paying job. Being able to get in front of a hiring manager who is offering a high paying job and convincing them to hire you is the only thing. And having a very popular website with a ton of traffic is more likely to get you in front of a hiring manager with a good job than actually being good.
    - 5y ago

eruci 5y ago

I used it for a while, then after a couple of failures decided to whip up my own at https://geocode.xyz/myip https://geocode.xyz/myip Took me 5 minutes of work and exactly one line of code.

andrewstuart2 5y ago
There's a lot more helpful info you can return, too. Try https://ifconfig.me https://ifconfig.me. Works great in bash scripts too, as it only returns the IP when called with a curl user agent.
- eruci 5y ago
  This is cool!

leesalminen 5y ago

I run a very simple, completely free API service as well. Currently using Google Cloud Run, handling a constant 10 rps for ~$8/mo. Pretty happy with it. I could probably cost optimize more. I sure hope I never have to deal with 30 billion requests per day, though. I'm sure my patience would run thin as well. Thank you to the author for running this site for so many years!

kissgyorgy 5y ago

I use this service in my Dynamic DNS script for Cloudflare too: https://github.com/kissgyorgy/cloudflare-dyndns https://github.com/kissgyorgy/cloudflare-dyndns It's time to put this service to the first place.

CliffStoll 5y ago
Just checked your python script - looks great! I wrote my own script a few years ago -- yours is way more robust!

forrestthewoods 5y ago

> The site went from 1B requests per day to 30-35B requests per day over a weekend. This is absolutely mind blowing.

jayonsoftware 5y ago
I always type "what is my ip" in google and get a reply. I am amazed that this service gets 30B to 35B hits a day
- aembleton 5y ago
  It will be bots using it. I have a python script that calls it every 5 minutes to get my current IP so that I can update my DNS records on Cloudflare. This is because my server is self hosted on a Pi and I don't have a static IP.
  - bombcar 5y ago
    It’s too bad there’s not a simpler way to just ask your router what it’s external IP is or if it has changed. You’d think SNMP could do it.

yakubin 5y ago

There was a thread[1] a couple months ago where I discovered a method to get one's IP address relying only on DNS: nslookup myip.opendns.com resolver1.opendns.com I love it. [1]: <https://news.ycombinator.com/item?id=26634476 https://news.ycombinator.com/item?id=26634476>

zatkin 5y ago
This command just returns the IP: dig +short @resolver2.opendns.com myip.opendns.com
moreati 5y ago
That will return an IPv6 address, if you have IPv6 connectivity. That's normally be fine, but for occasions it isn't there is dig +short -4 myip.opendns.com a @resolver1.opendns.com

deleted 5y ago

[deleted]

Klasiaster 5y ago

For those behind a home router an alternative is to use UPNP, e.g., through the miniupnpc package on Debian which ships the `/usr/bin/external-ip` script that postprocesses the `upnpc -s` output.

delduca 5y ago

I use this https://cloudflare.com/cdn-cgi/trace https://cloudflare.com/cdn-cgi/trace

slowmovintarget 5y ago

I appreciate the x-otter header, and I think I should now have my team add x-rtfm headers to all of our services and apps.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

jaeerffa 5y ago

Lolhis story is very similar to rawgit which was a wonderful site but also fell prey to malware aholes.

TazeTSchnitzel 5y ago

I admire the fact the author didn't snap at some point and start returning 0.0.0.0 or 127.0.0.1 to some or all queries.

Aeolun 5y ago
Or a rate limit of some kind

andrewmcwatters 5y ago

Reminds me of `echo $(dig @ns1.google.com o-o.myaddr.l.google.com TXT +short | tr -d \")`. I have no idea where this DNS query came from, because searching all of Google turns up nothing but https://github.com/GoogleCloudPlatform/cloud-self-test-kit/blob/master/tracerouter.py#L169 https://github.com/GoogleCloudPlatform/cloud-self-test-kit/b..., which is never referenced by anyone. I had to track it down myself for a bootstrap.sh, but I don't like using undocumented sources for critical infrastructure. My use case was needing to set the result of `hostname -f` in /etc/hosts in an automated fashion if a VPS provider didn't already add a line for the public Internet address in that file. You need to do this so that sendmail doesn't fail on `apt install` when it attempts to read your FQDN. So I couldn't use the NGINX example posted elsewhere here. It seems like https://checkip.amazonaws.com/ https://checkip.amazonaws.com/ is much more "reliable" in that it is publicly documented at https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/security-groups.html https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/s.... To anyone who needs to read this: please don't use "services" like icanhazip for your provisioning. Even my examples above are bad. It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. Edit: Oh goodness... even Amazon's documentation recommends using Google's undocumented DNS query.[1] [1]: https://aws.amazon.com/premiumsupport/knowledge-center/route-53-find-ecs-support-dns-resolver/ https://aws.amazon.com/premiumsupport/knowledge-center/route...

quesera 5y ago
> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings. It is not possible to know your public IP address, except by fetching the information from a known entity on the public network. And in some scenarios, your public IP will change frequently. There is no guarantee that it will be consistent across multiple requests.
- andrewmcwatters 5y ago
  Yes it is? I'm not talking about a situation where you send a packet to a DHCP server with 0.0.0.0 in the headers, I'm talking about what happens after the fact. Once you have been allocated an IP address, there should be a way to fetch said address. That's the whole mechanism behind forging UDP packets. If I didn't know what my source IP address was, it would be OK to send 0.0.0.0 out into the world all the time. Practically speaking, today, it is, considering most, but not all, ISPs won't let you do this and they will rewrite UDP packets that attempt to forge their source. Edit: OK, since I'm not being clear, let me be explicit: There should be a mechanism in DHCP which allows for the querying of your public Internet address when receiving a packet from a client in one of the Private-Use Networks as defined in RFC 6890. This query should be exposed as a feature of ifconfig or ip, lest a user be forced to manually write such a packet to receive the data.

Kaze404 5y ago

Reading the title I expected the article to be about a zipping tool called Icanha Zip. Pleasantly surprised by the great article.

barosl 5y ago

Thanks for your service. Now it will get even more traffic as I realized the existence of the site!

pytlicek 5y ago

WOW! Nice story. I’m running very similar project for free and for fun. Also this is usually happening to me every day. Besides other things I’m providing also website checks, so almost every second registration is used to wake up bots like repl.co or minecraft bots hosted on such sites. Life isn’t easy, right? :D anyway it is still the fun to run such service and I understand why author want it alive for a such long time :) when you want to try something similar with few more features, give a try to hostbeat.info

zie 5y ago

You can implement this yourself in nginx like this: location /ip { add_header Content-Type "application/json"; return 200 '{"host":"$server_name","ip":"$remote_addr","port":"$remote_port","server_ip":"$server_addr","server_port":"$server_port"}\n'; } and you will get back a little JSON with everything you want.

asdfaoeu 5y ago
Doesn't seem to work right... {"ip": "127.0.0.1", ...} But seriously, of course you can but 99% of people would rather just use a simple site rather than hosting their own server.
- zie 5y ago
  Because you were doing it from localhost, the connection came from localhost. It has to be exposed out on the internet for it to return an internet IP :) Anyways, I agree for 1 off things, whatever, use icanhazip or whatever you want, it doesn't matter if you make 1 request a day or 1 request a month... But if you are doing anything in code that uses it, you should just host it yourself and be a good net citizen.

cymon 5y ago

I wonder why he did not try to return empty responses to confirmed malware sources, to discourage them from using the site.

hyperion2010 5y ago

This is a perfect illustration of why the DNS system is fundamentally broken. There is zero reason why icanhazip.com needs to or should resolve to a single host or even a single virtual host managed by some SDN operated by a corp that controls thousands of machines. These queries could load balanced across the whole internet, the code is small enough that you could just whitelist the code by checksum and then compare results from multiple underlying hosts. The fact that you need a giant corporation to be able to practically run the backend for what is essentially urn:asker.public.ip is absurd beyond belief. The big players aren't going to fix this because the broken protocols give them a major competitive advantage.

andrewmcwatters 5y ago
It's worse than that: you shouldn't have to send an HTTP request to another server somewhere else in the world to figure out your public Internet address.
- bombcar 5y ago
  I’m surprised there isn’t something in ICMP that returns the routable host IP. Then you could ping anything in the world that responds to ping and know your IP.

867-5309 5y ago

stopped using them a few years ago when they started blocking my VPN. I set up is.gd/icanhazip which points to https://dynupdate.no-ip.com/ip.php https://dynupdate.no-ip.com/ip.php who since the switch have been a great substitute

gamedna 5y ago

Had the pleasure of working with Major at Rackspace; his professionalism, ethics, and quality of person always impressed me and inspired me to be a better version of myself every day. This move is a very mature decision; one that was probably bittersweet. Kudos Major on taking a step forward and putting the stewardship where it belongs.

tofukid 5y ago

What qualifies as “abuse” for a website that simply returns your IP? I don’t get it. You made a free service, and then lots of people started abusing it by... using the service?

iudqnolq 5y ago
Giant amounts of traffic (order of billions of requests per day) from a small number of boxes. It clearly doesn't get them anything (if your IP isn't changing multiple times per second you'd be better off caching, if it is you're probably a moron), so it's reasonable to suspect it's either a mistake or an attempt to take the site offline.

simonjgreen 5y ago

I have admired Major for a long time, however I'm disappointed to see further defacto consolidation of widely used Internet infrastructure (regardless of if it should be getting used this way).

simonjgreen 5y ago
Not really sure why the downvoting. Do people really think private business is the best place for what has become such a heavily relied on free to use resource? Surely it would be better living with the same stewardship as the root DNS zones or similar.

xbar 5y ago

May the great bird of the galaxy roost upon your home planet, Major.

Cloudef 5y ago

I wonder how much it would've helped if the site was not python. The same thing can be replicated with just nginx something like this: location /remote_addr { default_type text/plain; return 200 "$remote_addr\n"; } It's possible to add rate limit there too to control some of the abuse, of course you could even go further and develop native program that's optimized just for this use case (as well as being a simple HTTP server).

cbarrick 5y ago
They did move from Python to nginx circa 2011. It's mentioned in the post.
- Cloudef 5y ago
  It seems you are right. I was confused by the github page only containing the old python based solution.

dheera 5y ago

> We made a deal for them to pay me $8.03 I seriously can't imagine NOT negotiating with a company like CloudFlare for a decent chunk of money. As a multi-billion dollar corporation, I wouldn't leave money on the table.

codezero 5y ago

So it’s a honey pot now? What a lifecycle.

anonytrary 5y ago

> If you’re curious, Cloudflare did pay me for the site. We made a deal for them to pay me $8.03; the cost of the domain registration. The goal was never to make money from the site (although I did get about $75 in total donations from 2009 to 2021). The goal was to provide a service to the internet. Cloudflare has helped me do that and they will continue to do it as the new owners and operators of icanhazip.com. Damn, I'm almost mad at you for not hustling. Could have left with a few million easily over that entire time period, including charging Cloudfare a small fortune for the site! But hats off to you for being a true altruist. Too many paper altruists these days.

kilroy123 5y ago
How?
- top_kekeroni_m8 5y ago
  There's a lot of value in owning a website that processes billions of requests per month. A lot of people rely on that website, what if he sold it to a malicious user? Tracking IPs or changing what they return?

Ice_cream_suit 5y ago

Truly selfless service. It cost him many thousands in money and tens of thousands in time. And : "If you’re curious, Cloudflare did pay me for the site. We made a deal for them to pay me $8.03; the cost of the domain registration. The goal was never to make money from the site (although I did get about $75 in total donations from 2009 to 2021). The goal was to provide a service to the internet. Cloudflare has helped me do that and they will continue to do it as the new owners and operators of icanhazip.com." BTW, speaking as a nerd, he has the best formatted resume that I have ever seen ! See: https://majorhayden.com/ https://majorhayden.com/

hackburg 5y ago

Are you in need of a professional hacker? We offer the following services and more... . Consulting services. . Email password retrieval. . Credit repair [revolving and installment tradelines}. . Phone hack. . Clearing of criminal records. . Recovery of lost funds on Binary Options and Capital investments. *. Database retrieval..e.t.c... Visit us to know more: Hackburg.blogspot.com

nitwit005 5y ago

With that kind of traffic I'd be tempted to take the site offline for a few days to see if some prominent services had an outage due to relying on it.

devwastaken 5y ago

Cloudflare has an official method to get external IP that uses chaosnet records. I found a little script for it a while ago. In python: https://gist.github.com/czaux/b729a5de8d1334afbbe147a6bcee55e1 https://gist.github.com/czaux/b729a5de8d1334afbbe147a6bcee55...

soheil 5y ago

I read it as "I can has zip" all the while trying to figure out what this has to do with compression.

KaiserPro 5y ago

icanhazip.com is firmly in my debug tool box, I am really grateful that it continues to exist!

Jamie9912 5y ago

There is a weird quirk with icanhazip. It will return an internal cloudflare ip address when using their WARP service with http/3 enabled

zfxfr 5y ago

Wow ! I would never have guessed icanhazip.com got such an enormous amount of requests per day ! I wonder how this site/service achieved such a notoriety ? I am really not trying to diminish the author work but since it is something pretty simple to build and I know there are lots of others alternative I wonder what makes people choose this one over an other like let's say : http://ipinfo.io/ip http://ipinfo.io/ip https://test-ipv6.com/ https://test-ipv6.com/ checkip.amazon.com checkip.dyndns.com http://whatismyip.akamai.com/ http://whatismyip.akamai.com/ ifconfig.me ip.zfx.fr // I even have mine ^^ etc...

zzo38computer 5y ago

It is pretty good; no HTML or anything else like that is needed. I sometimes use it (not very often, but occasionally it is useful); I have a shell script that calls curl to access it. As long as it is continuing working, OK. (I can verify that the returned data is correct without too much difficulty)