Hacker News Reader

Comment by gurchik | Hacker News Reader

> After app startup, language selection and acceptance of privacy policy the app starts to figure out ‘real IP address’ by doing a request to both google and bing with query “what+is+my+ip”. My guess is that the app just parses the returned HTML and figures IP from those responses.

Aren't there free APIs to get your IP address, like ifconfig.me? This sounds like more work but probably doesn't have any chance of running into rate limits.

View on HN

Every cloudflare site responds with `ip=x.x.x.x` at /cdn-cgi/trace

https://troyhunt.com/cdn-cgi/trace

I often use cdn-cgi/trace endpoints to do latency measurements, sync time, geo-locate; real handy.

Wow very cool

I wonder what's the 'sliver' property

It's information that's only really useful to us. It refers to a set of machines running the same version of our software. Part of how we do progressive rollouts of software.

Thanks for answering!

I wonder what else they're serving up from my domains using my name?

https://troyhunt.com/cdn-cgi/challenge-platform/h/b/scripts/...

https://troyhunt.com/cdn-cgi/styles/fonts/opensans-300.woff

Wow that's terrible. Is this written anywhere in their terms that you agree to let them host arbitrary content under your own domain without your knowledge?

Given that their "Command & Control" server already knows the user's IP anyway, this might be a disguise, with the actual intention being to check if Google is working from that IP, as these shady VPNs are often used to abuse the client as a proxy for SERP requests, to bypass IP-based search engine query limits (for SEO etc.).

It's a lot easier to hide your breadcrumbs if you're just calling google.com or bing.com. Those are services that get billions of hits an hour and no body cares to scan or correlate your calls to them (other than Google and Microsoft of course)

There are APIs, and in my opinion, just falling back to a different HTTP API would probably be easier than parsing HTML. Though I use one of those APIs for a dynamic DNS client I built, and I've never actually seen a rate limit on them, even if I'm calling them every minute. I appreciate you showing them the benefit of the doubt here, but in my opinion the more likely answer is just that the person who did this is just underinformed on the state of quality of life-improving public APIs.

It's also borderline trivial to set up your own on a VPS with Nginx.

And leave traces?

I was legit about to say how are they at minimum not using `checkip.amazonaws.com`

Reply on news.ycombinator.com