I'm on a campus network that reverse proxies all HTTP traffic. The service shows my internal 10.x.x.x IP. Just a heads-up that you might want to fix your handling of X-Forwarded-For headers.
Thanks for reporting! You should see that we correctly detect this as a bogon, but we should definitely be pulling the correct IP from the headers. I'll look into this.
I was at one point using https://github.com/tjfontaine/node-dns for the hostname lookups, but it was significantly slower that the built in dns module, so I ended up wrapping that with my own timeout logic.
This is interesting. IP address databases are typically bought and sold for figures in the thousands. This service presumably purchases one or some of these and attempts to make up the cost by providing it on an as-needed basis.
I wonder if there are any additional data sources that can just be bought wholesale and sold in pieces? Think of all the applications that needed very precise IP address data but couldn't afford the whole dataset. They can now exist!
I could also be wrong and this isn't at all the approach this service takes...
> IP address databases are typically bought and sold for figures in the thousands.
And presumably, therefore, issued under licenses that forbid you from starting a query service? I'm pretty sure most of these IP data providers will offer their own on-demand query services
That's for your own use however, the license says:
Access to the data is restricted to employees and contractors of the license holder. With contractors, the license holder is liable should the contractors violate the terms of the agreement.
Data may not be stored in a way that is publicly accessible.
This really looks like maxmind city level, so... until we get confirmation from the dev on what db it is, assume this service can disappear at any moment due to license issues.
Recommendation: I have the feeling your sales would be significantly boosted if you added some sort of tiered service plans on top of your free tier, instead of requiring the frictionful process of reaching out to a sales address.
I use https://freegeoip.net/ which gives you output in JSON, CSV or XML and has a limit of 10,000 requests per hour. The limit of 1,000 per day on this service is too low.
So something along the lines of tracking incoming requests, then doing a DNS lookup on the incoming IP? Isn't that something that something like Google Analytics could do for you? And in that case, would this be more for people who are avoiding GA?
Google Analytics can give you this data in the reports but won't allow you to get access to it in real time in your application.
Imagine you want to redirect users to the correct country page in your site. In this case you need to get access to the ip geolocation in real time. GA won't help you there.
If your goal is geo-redirection then a 3rd party service is usually a bad choice (speed + downtime). An memory geo-ip database is the best way to go - but this is usually also part of what you pay for when you buy the non-free version
It's less accurate than their commercial offering, but good enough in many cases. For ease of use, there's a nice C API (https://github.com/maxmind/geoip-api-c) and wrappers like pygeoip for Python.
If you are geolocating, I would suggest spending $370 to buy the MaxMind GeoIPCity database. There's an nginx module for it and any major language will have code to run queries against it.
IP addresses should only be announced by one ASN at a time (regardless if that AS is multihomed or singlehomed). If that's not the case that's usually a hint of prefix hijacking.
It gets my Location wrongish here on the Gold Coast, but not too far out. We have huge suburbs though, all of the GeoIP DB's seem to think im in the wrong suburb, despite having a static IP on Telstra cable.
But freegeoip's limit of 10,000 requests per hour is better than ipinfo's $200/mo plan (6,667/hr). Plus there are no limits if you run freegeoip on your own server.
Looks like no immediate fix either, which is a shame as I wanted to use it client side but (a) need SSL and (b) can't ignore Chrome (it fails on Chrome for Android latest too)..
Thanks for that! I'm building a small script which may evolve in a service and I was retrieving IP addresses using curl, this is way more clean. Thanks!
This believes that I am in Colchester, FreeGeoIP can say that I am just in the UK, Google in incognito mode thinks that I am in Sheffield. Correct answer: Manchester :)
My first guess would be that the domain uses a custom nameserver that logs all dns queries and serves back a different IP to each user. Then when the http request comes in to that specific IP, it can check the dns logs to identify the resolver.
But surely.. that would either require (a) a massive IP space (i guess that works if the site is IPv6 only), or (b) assuming a pretty short time between dns lookup and http request, and hence possibly false results if the dns lookup is cached somewhere and the IP has since been reused
I'd love to know if there's a better way of implementing this.
A better way would be to hand each client a unique hostname (sessionidhere.whatsmyresolver.stdlib.net) and match that dns query to the http client? For example as an ajax call from the main website.
And presumably this service is just repackaging such an existing system. My old company had a tool to figure our what widely used geo db was used for these services (to properly judge it's value), but I no longer have access to this tool.
I just finished integrating geo IP lookups into an app I'm working on, using a library that queries a number of the free IP lookup services out there. Something that I've learned from this is just how hard it is to stay on top of IP geolocations. Most of the free services use incomplete or outdated databases, and if you want decent accuracy you probably need to opt for a paid package from a company who has the resources to track IP address location changes, and keep their database up to date.
So, I'm wondering, does ipinfo.io maintain their own database, or do they sub-license someone else's database? If they're maintaining their own, how good are they at keeping it valid and updated and what is the coverage like?
It uses one of the free databases that are available.
Ip address 200.7.52.1 is a good way to check these services. This should position to the island of Sint Maarten. A serious offering would know that. The free ones always set the position to Curacao. Just about 900 NM away...
I was trying to figure out which database they were using as well. I've checked their results for my IP address against the results from MaxMind's GeoIP City and GeoIP2 City service and these return the closet results related to the Latitude/Longitude displayed on ipinfo.io, it also has a matching zip code. The network name differs since I'm on U-Verse but I think they are just displaying the company name from the ASN. I also checked Quova/Neustar and the results are vastly different.
Paid plan for API access I guess - hoping one wont use the same environment for both. I meant this for the stripe frame which kicks in, cant really trust an https frame that has a start from http.
Usually though I just use http://www.moanmyip.com for the weirdness of it. Or pretty much any search engine includes that up top when you search for "ip address".
117 comments
[ 530 ms ] story [ 453 ms ] threadAlso, I wonder if it handles X-Forwarded-For headers that contain multiple IP addresses, because there are multiple levels of proxying taking place.
Also. No IPv6? How boring.
* Courtesy of Wappalyzer
The code is written in coffeescript, and some key npm modules are:
- https://github.com/caolan/async
- https://github.com/brycebaril/node-tokenthrottle-redis
- https://github.com/rs/node-netmask
I was at one point using https://github.com/tjfontaine/node-dns for the hostname lookups, but it was significantly slower that the built in dns module, so I ended up wrapping that with my own timeout logic.
I posted this for a friend: https://twitter.com/coderholic
He's the guy behind Lighbox.com which Facebook acquired, really awesome guy!
I guess he'll be wondering where all the sudden traffic is coming in from!
At least it got the US part right.
JSONP support: http://ipinfo.io/?callback=test
Paid JSONP support: https://ipinfo.io/?callback=test
I wonder if there are any additional data sources that can just be bought wholesale and sold in pieces? Think of all the applications that needed very precise IP address data but couldn't afford the whole dataset. They can now exist!
I could also be wrong and this isn't at all the approach this service takes...
And presumably, therefore, issued under licenses that forbid you from starting a query service? I'm pretty sure most of these IP data providers will offer their own on-demand query services
Access to the data is restricted to employees and contractors of the license holder. With contractors, the license holder is liable should the contractors violate the terms of the agreement.
Data may not be stored in a way that is publicly accessible.
If you wanted to build a public server with that, you would have to use their per-usage API according to their FAQ: http://www.maxmind.com/en/faq#lookuptool
I'll probably be using this. Thanks!
Imagine you want to redirect users to the correct country page in your site. In this case you need to get access to the ip geolocation in real time. GA won't help you there.
http://www.maxmind.com/en/geolite_city_accuracy
It's less accurate than their commercial offering, but good enough in many cases. For ease of use, there's a nice C API (https://github.com/maxmind/geoip-api-c) and wrappers like pygeoip for Python.
http://www.maxmind.com/en/city http://nginx.org/en/docs/http/ngx_http_geoip_module.html
I use it for my bitcoin client: https://github.com/bit-c/bitc
Anyway, this 'quality' should be free anyway ;-)
Why not check both rather than just one?
ipinfo.io thinks I'm in Brisbane, which is slightly more accurate (although also less specific), although still about 25km out.
It gets my Location wrongish here on the Gold Coast, but not too far out. We have huge suburbs though, all of the GeoIP DB's seem to think im in the wrong suburb, despite having a static IP on Telstra cable.
https://github.com/fiorix/freegeoip/issues/32
"127.0.0.1 is a bogon or private IP address that should not appear on the Internet."
But then I learned that "bogon' is actually a word:
http://en.wikipedia.org/wiki/Bogon_filtering
And re-reading the sentence, I'm not sure what "bogon" would be a typo for anyway..."Vogon"? Anyway, good handling of an edge/nonsense case!
FreeGeoIP thinks I'm in Edinburgh, which is only slightly better.
But surely.. that would either require (a) a massive IP space (i guess that works if the site is IPv6 only), or (b) assuming a pretty short time between dns lookup and http request, and hence possibly false results if the dns lookup is cached somewhere and the IP has since been reused
I'd love to know if there's a better way of implementing this.
So, I'm wondering, does ipinfo.io maintain their own database, or do they sub-license someone else's database? If they're maintaining their own, how good are they at keeping it valid and updated and what is the coverage like?
Ip address 200.7.52.1 is a good way to check these services. This should position to the island of Sint Maarten. A serious offering would know that. The free ones always set the position to Curacao. Just about 900 NM away...
http://myip.ms/info/whois/200.7.52.1
Ideally they should be on separate domains, at which point HSTS would be more suited.
Usually though I just use http://www.moanmyip.com for the weirdness of it. Or pretty much any search engine includes that up top when you search for "ip address".
Why not just use Maxmind though?