Discussion on "One IP, Five Sources: What a Malicious Address Actually Proves"

bo · 2026-10-31T19:25:15.710Z

I used to own a WAF block list in AWS. The rules were simple: an allow list, a block list, and a queue of addresses that belonged in one or the other. The hard part was never the rule syntax. It was t

The four cities for 195.178.110.155 is the part I'd push on. One more geolocation source would just add a fifth city. What the script is missing is a structured answer to "what kind of host is this": hosting, VPN, proxy, Tor or residential. That's what tells you whether a /32 block with an expiry is enough or whether the whole range deserves it.

Two small things in ip_tracer.sh while you're there: both geolocation calls go over plain http://, and ip-api's free endpoint doesn't do HTTPS at all, so a keyed source fits your env-var setup better. IPGeolocation.io is one (disclosure: I work there). Location and ASN are on the free plan at 1,000 a day, which matches your README's free-tier table. The host-type flags are paid, so they only make sense if you use this at work.

Thanks - the HTTP point is correct, and I'm fixing it: ipinfo moves to HTTPS, and ip-api's free endpoint can't do TLS, so it goes or gets replaced with a keyed source. On host type, I agree it's more decision-relevant than a fifth city. I'm adding a structured classification built from what the tool already has — AbuseIPDB usageType/isTor, RDAP/WHOIS, and ASN — with the evidence and confidence attached to each flag, and an explicit "unknown" for VPN/proxy where no free source exists. I am not currently using it for work at this time. I'll keep IPGeolocation.io in mind as an optional keyed source, though I'd keep paid host-type flags out of the default path. Appreciate the disclosure.

Thanks, bo, really appreciate you taking the time to reply. The explicit "unknown" with evidence and confidence attached is a nice touch. Most tools quietly guess there, and that's how a /32 block turns into a whole-range block by mistake.

If you do add a keyed source later and want a hand mapping fields into your classification, or anything else on the tool, just ask here. Happy to help.

Search Hashnode

One IP, Five Sources: What a Malicious Address Actually Proves

Responses3