6 ms·

> After app startup, language selection and acceptance of privacy policy the app starts to figure out ‘real IP address’ by doing a request to both google and bi

> After app startup, language selection and acceptance of privacy policy the app starts to figure out ‘real IP address’ by doing a request to both google and bing with query “what+is+my+ip”. My guess is that the app just parses the returned HTML and figures IP from those responses. Aren't there free APIs to get your IP address, like ifconfig.me? This sounds like more work but probably doesn't have any chance of running into rate limits.

starttoaster 3y ago
There are APIs, and in my opinion, just falling back to a different HTTP API would probably be easier than parsing HTML. Though I use one of those APIs for a dynamic DNS client I built, and I've never actually seen a rate limit on them, even if I'm calling them every minute. I appreciate you showing them the benefit of the doubt here, but in my opinion the more likely answer is just that the person who did this is just underinformed on the state of quality of life-improving public APIs.
- nerdponx 3y ago
  It's also borderline trivial to set up your own on a VPS with Nginx.
  - LtdJorge 3y ago
    And leave traces?
judge2020 3y ago
Every cloudflare site responds with `ip=x.x.x.x` at /cdn-cgi/trace https://troyhunt.com/cdn-cgi/trace https://troyhunt.com/cdn-cgi/trace
- ignoramous 3y ago
  I often use cdn-cgi/trace endpoints to do latency measurements, sync time, geo-locate; real handy.
- raverbashing 3y ago
  Wow very cool I wonder what's the 'sliver' property
  - jgrahamc 3y ago
    It's information that's only really useful to us. It refers to a set of machines running the same version of our software. Part of how we do progressive rollouts of software.
    - raverbashing 3y ago
      Thanks for answering!
- blibble 3y ago
  I wonder what else they're serving up from my domains using my name?
  - judge2020 3y ago
    https://troyhunt.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js https://troyhunt.com/cdn-cgi/challenge-platform/h/b/scripts/... https://troyhunt.com/cdn-cgi/styles/fonts/opensans-300.woff https://troyhunt.com/cdn-cgi/styles/fonts/opensans-300.woff
- ranger_danger 3y ago
  Wow that's terrible. Is this written anywhere in their terms that you agree to let them host arbitrary content under your own domain without your knowledge?
eddythompson80 3y ago
It's a lot easier to hide your breadcrumbs if you're just calling google.com or bing.com. Those are services that get billions of hits an hour and no body cares to scan or correlate your calls to them (other than Google and Microsoft of course)
jaen 3y ago
Given that their "Command & Control" server already knows the user's IP anyway, this might be a disguise, with the actual intention being to check if Google is working from that IP, as these shady VPNs are often used to abuse the client as a proxy for SERP requests, to bypass IP-based search engine query limits (for SEO etc.).
whodev 3y ago
I was legit about to say how are they at minimum not using `checkip.amazonaws.com`

starttoaster 3y ago

There are APIs, and in my opinion, just falling back to a different HTTP API would probably be easier than parsing HTML. Though I use one of those APIs for a dynamic DNS client I built, and I've never actually seen a rate limit on them, even if I'm calling them every minute. I appreciate you showing them the benefit of the doubt here, but in my opinion the more likely answer is just that the person who did this is just underinformed on the state of quality of life-improving public APIs.

nerdponx 3y ago
It's also borderline trivial to set up your own on a VPS with Nginx.
- LtdJorge 3y ago
  And leave traces?

judge2020 3y ago

Every cloudflare site responds with `ip=x.x.x.x` at /cdn-cgi/trace https://troyhunt.com/cdn-cgi/trace https://troyhunt.com/cdn-cgi/trace

ignoramous 3y ago
I often use cdn-cgi/trace endpoints to do latency measurements, sync time, geo-locate; real handy.
raverbashing 3y ago
Wow very cool I wonder what's the 'sliver' property
- jgrahamc 3y ago
  It's information that's only really useful to us. It refers to a set of machines running the same version of our software. Part of how we do progressive rollouts of software.
  - raverbashing 3y ago
    Thanks for answering!
blibble 3y ago
I wonder what else they're serving up from my domains using my name?
- judge2020 3y ago
  https://troyhunt.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js https://troyhunt.com/cdn-cgi/challenge-platform/h/b/scripts/... https://troyhunt.com/cdn-cgi/styles/fonts/opensans-300.woff https://troyhunt.com/cdn-cgi/styles/fonts/opensans-300.woff
ranger_danger 3y ago
Wow that's terrible. Is this written anywhere in their terms that you agree to let them host arbitrary content under your own domain without your knowledge?

eddythompson80 3y ago

It's a lot easier to hide your breadcrumbs if you're just calling google.com or bing.com. Those are services that get billions of hits an hour and no body cares to scan or correlate your calls to them (other than Google and Microsoft of course)

jaen 3y ago

Given that their "Command & Control" server already knows the user's IP anyway, this might be a disguise, with the actual intention being to check if Google is working from that IP, as these shady VPNs are often used to abuse the client as a proxy for SERP requests, to bypass IP-based search engine query limits (for SEO etc.).

whodev 3y ago

I was legit about to say how are they at minimum not using `checkip.amazonaws.com`