API providing threat analysis of any given IP address

Re:API providing threat analysis of any given IP address by ThePhysicist on Saturday August 06, 2016 @03:02PM (#12239398)

Should be possible using the ASN id of the IP address, and I think Domaintools provides this information and some other fields as well, although their API is not free. That won't help with most VPNs though as they just rent servers from various providers, so you need some kind of active monitoring, which might be tricky to implement from a technical and legal point of view.

[ Parent | on HN ]

Re:API providing threat analysis of any given IP address by toast0 on Sunday August 07, 2016 @02:00AM (#12241231)

If you have a BGP feed, you can use that to go from IP -> ASN, otherwise, there are public bgp dumps [1]. Many networks renting servers are pretty simple to flag this way.

[1] One source is http://www.routeviews.org/

[ Parent | on HN ]

Re:API providing threat analysis of any given IP address by ThePhysicist on Sunday August 07, 2016 @06:34AM (#12241694)

Thanks for pointing this out, I couldn't find a way to get the ASN for free, so this is a great resource!

[ Parent | on HN ]