5 ms·
I maintain a list of "23034 IPs to blocklist.txt" blocked IPs they contain all VPN providers. Often VPN providers seed Geofeeds with wrong data, this is why i
by faangguyindia 5mo ago
I maintain a list of
"23034 IPs to blocklist.txt"
blocked IPs they contain all VPN providers. Often VPN providers seed Geofeeds with wrong data, this is why i use traceroute and ping network to locate their real location.
- BLKNSLVR 5mo agoI have a script that logs IPs for any traffic coming in to my servers on ports that don't accept traffic. I then block those IPs from accessing ports behind which there are services. If they're checking my locked doors, I don't want them coming in my unlocked doors.
- notpushkin 5mo agoThis might be a good idea, but consider banning them for, say, a couple hours at a time. It’s easy to rotate IP, especially if you’re using a residential proxy service, and there’s a good chance you’ll end up blocking real users using the same ISP.
- m00dy 5mo agoyeah, I'm using https://proxybase.xyz https://proxybase.xyz for this. It's like Mullvad but for proxies. No kyc, no email but supports xmr.
- notpushkin 5mo agoI like the API-centric nature of it. $10/GB seems a bit steep though, especially compared to Mullvad’s 5 €/mo. Search for “mobile proxy” – those are usually cheap-ish monthly subscriptions, with unlimited traffic, and often an API to rotate the IP programmatically if you need it. No KYC, but you usually do have to sign up with an email.
- m00dy 5mo ago@ notpushkin, yes, it's a bit more expensive because it's for different use cases. You can't use VPNs or Mullvad for anything mission critical. Just try to log in to your bank in US, it will increase your risk score on their end because VPNs by nature are very easy to detect whereas "residential proxies" much harder.
- notpushkin 5mo ago> You can't use VPNs or Mullvad for anything mission critical. Just try to log in to your bank in US, it will increase your risk score on their end because VPNs by nature is very easy to detect whereas "residential proxies" much harder. Naturally! I’m just saying there’s residential proxy providers that are a LOT cheaper than that. (IIRC, you can usually reply to fresh comments if you click on the “n minutes ago” – the reply link should be visible there even if it isn’t shown in the main comments tree)
- m00dy 5mo agoI think when it comes to privacy or XMR, money is not really that important. Just give me a few names that support XMR payments + no KYC and providing mostly non-flagged residential IPs that you can use them for mission critical stuff.
- notpushkin 5mo agoThat’s a good question! I haven’t been in this scene for a long long time now, so can’t say for sure. I’ve been implementing an Instagram liker service back in... 2018 was it? So a stable pool of non-flagged residential proxies was important here, and it was my client who introduced me to the concept of “mobile proxies”. Basically, they use regular 3G/4G/5G modems with regular SIM cards, and expose that as a SOCKS proxy. You get a normal-looking IP from a pool of mobile operator’s IPs. Since mobile devices reconnect all the time (and are behind a CGNAT mostly nowadays), you can’t really flag an IP like that – and if it is flagged, you can get a fresh one in a moment. I’m not using this mostly because I’m too lazy to research. Here’s a random one I found (so not an endorsement!) which is $1/GB, seems to only require email to sign up, and takes crypto (including XMR): https://floppydata.com/ https://floppydata.com/
- KolmogorovComp 5mo agoDo they say how do they have access to those IPs? Most residential IPs are malware-infected devices.
- m00dy 5mo agoThat’s part of our value proposition. It’s same as when you go to a bank and ask where the yield comes for your account or asking OpenAI where they get data to train their models.
- KolmogorovComp 5mo ago> or asking OpenAI where they get data to train their models Yes I know it comes from pirating/torrenting/scrapping. Are you saying you acknowledge your IPs come from malware, and that is OK because OpenAI is shady too?
- m00dy 5mo agoFor the context, I have the right not to tell you anything about how we operate our business but we're not shady, we don't take any action without user consent. The other thing is that we don't use "source" keyword in our business context. I think when you use that essentially you inherently accept some part of your business is shady as hell. Instead, we use "providers". That's a lot better.
- CallMeMarc 5mo agoIs this your service? Since you've made seven posts to HN about it and also your username shows up in the commits on their GitHub. Because I'm quite curious on where the IPs are from. Usually residential IPs is a fancy wording for malware infested devices from regular people.
- notpushkin 5mo ago> Is this your service? Since you've made seven posts to HN about it and also your username shows up in the commits on their GitHub. Ohh, that makes sense haha. @m00dy: please disclose when you’re talking about your own projects! It’s okay to plug your stuff sometimes, just be honest about it :-)
- m00dy 5mo agoI’m not hiding anything :-)
- notpushkin 5mo agoNo, but you weren’t upfront about it either. I’ve suspected it looked like your own project but checked your comments in the profile and didn’t see any other, so I didn’t dig any deeper. > I’m not here to promote anything just wanted to share a valid use case in the right context. There’s a small difference: if one of your users did this it would be totally fair, but when a founder does this I think it’s a polite thing to disclose it. That’s what I’ve been doing when talking about my own project on HN [1], and I think in most cases other legit founders just say that upfront, too. I’m not sure if that breaks any rules, but it feels juuuuust a bit shady not to :-) [1]: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=notpushkin%20lunni&sort=byDate&type=all https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- throwaway2037 5mo ago> Since you've made seven posts to HN about it Do you have a tool to text search a user's comment history? Your comment is very specific: "seven"!
- throwaway2037 5mo agoYou should put your business (https://proxybase.xyz https://proxybase.xyz) in your HN profile. It might help to find more customers.
- m00dy 5mo agoI’m not here to promote anything just wanted to share a valid use case in the right context.
- throwaway2037 5mo agoAnd yet you regularly promote you own commercial product using submarine adverts on HN. Hmm... I can think of few other behaviours that HN commenters like less.
- illiac786 5mo agoThat’s nice, I need to implement this.
- hypeatei 5mo agoClosed ports are not "locked doors", and open ports are not "unlocked doors" That is a binary thought process with a lot of assumptions. You might introduce even more attack surface in pursuit of this "security" measure by installing additional software like fail2ban, for example. Close your ports, maybe assign a non-standard port to the popular ones (like SSH) to reduce log spam, and patch your server often. Anything more complicated than that is not worth it, IMO.
- BLKNSLVR 5mo agoI thought, and still think, it's a good analogy.
- lucb1e 5mo agoThere are a lot of legit scanners that look for problems to proactively warn the owner, so the mere presence of a packet on a port you aren't advertising somewhere is maybe a bit overkill, but if you think this is abuse: have you considered also reporting the abuse to the originating ISP? Otherwise they can never take action against that subscriber and the blocked IPs will just impact people that come after. ISPs that work with you and terminate subscribers that abuse their service should maybe not be blocked for more than a typical IP lease duration
- BLKNSLVR 5mo ago> There are a lot of legit scanners that look for problems to proactively warn the owner In my experience, most of the scanner firms seem to be creating their own maps of as much of the internet as they can get their grubby hands on, and then sell API access to their database of all services running on all the open ports on all the IP addresses they've probed and scanned and scraped. Firstly, I don't want my shit listed in these databases. Secondly, the traffic is probably negligible, but it's still coming down my pipes (tubes) without an invitation, and I don't like that, plus they then profit off this uninvited behaviour. It rubs me the wrong way. Finally, I highly doubt that (m)any of these services are doing it for altruistic purposes. They're doing it for reasons of profit, and then downstream of this is likely access by various intelligence agencies to this data. I just don't think they have a right to this data. > but if you think this is abuse: have you considered also reporting the abuse to the originating ISP? That's a good point, and if I can automate that, then I will, but I don't consider it a priority. Finding the party ultimately responsible for an IP address isn't a particularly simple process.
- lucb1e 5mo agoIt should be automateable, yes. Different RIRs (regional internet registries), which all operate their own WHOIS databases, might handle this differently but generally you should be able to get an abuse contact in an automated fashion for exactly this purpose > most of the scanner firms seem to be creating their own maps of as much of the internet as they can get their grubby hands on, and then sell API access to their database Yeah, sure, a lot of scanners are run by black or gray hats. Just saying that all options are on the table and blocking (or even reporting) e.g. the non-profit .nl operator organization for scanning tcp:443 on all the A/AAAA records of .nl domains is going to do much good (Example of what they're doing: https://www.sidn.nl/en/news-and-blogs/new-system-for-logo-based-detection-of-malicious-domain-names-successfully-piloted https://www.sidn.nl/en/news-and-blogs/new-system-for-logo-ba...)
- marcus_holmes 5mo agoYou know that people use VPNs for perfectly legitimate reasons, right? Like when I was travelling, sites would routinely use the language of my IP address location, not the language preference as I set it in my browser. So I would be served a site that I couldn't read. My only option was to use a VPN to spoof my location so that it would serve me a site in a language I understand.
- fortran77 5mo agoI use aVPN when I’m traveling and want to order food delivery for my 93 year old mother in NY. UberEats and InstaCart will stop me from ordering when logged in my mom’s NY account if I’m in China, Saudi Arabia, India, Vietnam, etc.
- notpushkin 5mo agoBy the way, if you’re a webmaster doing this, look at the Accept-Language header instead: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Accept-Language https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...