API providing threat analysis of any given IP address

Re:API providing threat analysis of any given IP address by achillean on Saturday August 06, 2016 @05:26PM (#12240012)

With Shodan you could export a list of IPs that are currently operating a VPN service:

https://www.shodan.io/search?query=port%3A500%2C4500+vpn

Or you could lookup the IP of the user on Shodan and check whether that IP is running a VPN service. Per IP lookups are free on Shodan and it's fairly simple. For example, this is how you'd do it in Python:

    def is_vpn(user_ip):

        import shodan

        api = shodan.Shodan("API key")

        host = api.host(user_ip)

        for banner in host['data']:

            if banner['port'] in [500, 4500]:

                return True

        return False

Here's an overview of the VPN services that are currently on Shodan:

https://www.shodan.io/report/2aLrR79C

[ Parent | on HN ]

Re:API providing threat analysis of any given IP address by AnkhMorporkian on Sunday August 07, 2016 @03:52PM (#12243357)

This is brilliant. Thank you so much!

Edit: I made a modification for conciseness' sake, and to include SSH in the mix as that can be used as a poor man's VPN.

    def is_vpn(self, ip):
        api = shodan.Shodan(self.config['keys']['shodan'])
        host = api.host(ip)
        return any(banner['port'] in [22, 80, 500, 4500] for banner in host['data'])

[ Parent | on HN ]

Re:API providing threat analysis of any given IP address by achillean on Sunday August 07, 2016 @04:56PM (#12243607)

I realized it only afterwards but you can actually just look at the host['ports'] property which contains a list of ports that were found open. And you might also want to include PPTP on port 1723.

[ Parent | on HN ]