Comment by Furqan Ashraf on "One IP, Five Sources: What a Malicious Address Actually Proves"

Furqan Ashraf

We are small team, who loves to code.

The four cities for 195.178.110.155 is the part I'd push on. One more geolocation source would just add a fifth city. What the script is missing is a structured answer to "what kind of host is this": hosting, VPN, proxy, Tor or residential. That's what tells you whether a /32 block with an expiry is enough or whether the whole range deserves it.

Two small things in ip_tracer.sh while you're there: both geolocation calls go over plain http://, and ip-api's free endpoint doesn't do HTTPS at all, so a keyed source fits your env-var setup better. IPGeolocation.io is one (disclosure: I work there). Location and ASN are on the free plan at 1,000 a day, which matches your README's free-tier table. The host-type flags are paid, so they only make sense if you use this at work.

Sharing experience on CyberSecurity, Tooling and AI

1d ago

Thanks - the HTTP point is correct, and I'm fixing it: ipinfo moves to HTTPS, and ip-api's free endpoint can't do TLS, so it goes or gets replaced with a keyed source. On host type, I agree it's more decision-relevant than a fifth city. I'm adding a structured classification built from what the tool already has — AbuseIPDB usageType/isTor, RDAP/WHOIS, and ASN — with the evidence and confidence attached to each flag, and an explicit "unknown" for VPN/proxy where no free source exists. I am not currently using it for work at this time. I'll keep IPGeolocation.io in mind as an optional keyed source, though I'd keep paid host-type flags out of the default path. Appreciate the disclosure.

Thanks, bo, really appreciate you taking the time to reply. The explicit "unknown" with evidence and confidence attached is a nice touch. Most tools quietly guess there, and that's how a /32 block turns into a whole-range block by mistake.

If you do add a keyed source later and want a hand mapping fields into your classification, or anything else on the tool, just ask here. Happy to help.

Search Hashnode