What's new
By:

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Skynet What's Up?

bluepoint

bluepoint

Very Senior Member
Did we break AlienVault or firehol?:D
Code: 
Last 20 Unique Connections Blocked (Inbound);


--------------       | --------------                                          | --------------                                | ----------------------           
| IP Address |       | | AlienVault |                                          | | Ban Reason |                                | | Associated Domains |           
--------------       | --------------                                          | --------------                                | ----------------------           

185.153.197.142 (MD) | https://otx.alienvault.com/indicator/ip/185.153.197.142 | BanMalware: firehol_level3.netset*            |                                  
74.120.14.24    (US) | https://otx.alienvault.com/indicator/ip/74.120.14.24    | BanMalware: firehol_level3.netset*            |                                  
194.147.140.76  (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.76  | BanMalware: firehol_level3.netset*            |                                  
193.27.229.219  (RU) | https://otx.alienvault.com/indicator/ip/193.27.229.219  | BanMalware: firehol_level2.netset*            |                                  
194.147.140.80  ({
    "errorCode": "OVER_QUERY_LIMIT",
    "error": "maximum number of queries per day exceeded"
}) | https://otx.alienvault.com/indicator/ip/194.147.140.80  | BanMalware: firehol_level3.netset*            |                                                    
162.142.125.17  (US) | https://otx.alienvault.com/indicator/ip/162.142.125.17  | BanMalware: firehol_level2.netset             |                                  
94.102.51.17    (NL) | https://otx.alienvault.com/indicator/ip/94.102.51.17    | BanMalware: normshield_high_attack.ipset      |                                  
83.97.20.31     (RO) | https://otx.alienvault.com/indicator/ip/83.97.20.31     | BanMalware: normshield_high_bruteforce.ipset  |                                  
194.147.140.94  ({
    "errorCode": "OVER_QUERY_LIMIT",
    "error": "maximum number of queries per day exceeded"
}) | https://otx.alienvault.com/indicator/ip/194.147.140.94  | BanMalware: firehol_level3.netset*            |                                                    
104.206.128.14  (US) | https://otx.alienvault.com/indicator/ip/104.206.128.14  | BanMalware: firehol_level3.netset             |                                  
194.147.140.48  (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.48  | BanMalware: firehol_level3.netset*            |                                  
194.147.140.103 (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.103 | BanMalware: firehol_level3.netset*            |                                  
194.147.140.97  ({
    "errorCode": "OVER_QUERY_LIMIT",
    "error": "maximum number of queries per day exceeded"
}) | https://otx.alienvault.com/indicator/ip/194.147.140.97  | BanMalware: firehol_level3.netset*            |                                                    
194.147.140.106 (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.106 | BanMalware: firehol_level3.netset*            |                                  
194.147.140.98  ({
    "errorCode": "OVER_QUERY_LIMIT",
    "error": "maximum number of queries per day exceeded"
}) | https://otx.alienvault.com/indicator/ip/194.147.140.98  | BanMalware: firehol_level3.netset*            |                                                    
162.142.125.27  (US) | https://otx.alienvault.com/indicator/ip/162.142.125.27  | BanMalware: firehol_level3.netset*            |                                  
194.147.140.68  (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.68  | BanMalware: firehol_level3.netset*            |                                  
194.147.140.107 (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.107 | BanMalware: firehol_level3.netset*            |                                  
167.71.186.157  (US) | https://otx.alienvault.com/indicator/ip/167.71.186.157  | BanMalware: firehol_level3.netset             |                                  
194.147.140.66  (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.66  | BanMalware: firehol_level3.netset*            |
 
Im testing nextdns (DOT servers) In the logs
Code: 
api.db-ip.com
is blocked continuously. Do i need to unblock it when working with Skynet. Just to be shure. Tnx!

EDIT:
Got IT: Skynet uses that site so it is part of the shared whitelist between Diversion and Skynet.
 
Last edited:
Sonyrolfy said:
Im testing nextdns (DOT servers) In the logs
Code: 
api.db-ip.com
is blocked continuously. Do i need to unblock it when working with Skynet. Just to be shure. Tnx!

EDIT:
Got IT: Skynet uses that site so it is part of the shared whitelist between Diversion and Skynet.
Click to expand...
Here is everything skynet whitelists to prevent "breakage"

Code: 
ipdeny.com
ipapi.co
api.db-ip.com
api.bgpview.io
asn.ipinfo.app
speedguide.net
otx.alienvault.com
github.com
raw.githubusercontent.com
iplists.firehol.org
astrill.com
strongpath.net
snbforums.com
bin.entware.net
nwsrv-ns1.asus.com
 
bluepoint said:
Did we break AlienVault or firehol?:D
Code: 
Last 20 Unique Connections Blocked (Inbound);


--------------       | --------------                                          | --------------                                | ----------------------          
| IP Address |       | | AlienVault |                                          | | Ban Reason |                                | | Associated Domains |          
--------------       | --------------                                          | --------------                                | ----------------------          

185.153.197.142 (MD) | https://otx.alienvault.com/indicator/ip/185.153.197.142 | BanMalware: firehol_level3.netset*            |                                 
74.120.14.24    (US) | https://otx.alienvault.com/indicator/ip/74.120.14.24    | BanMalware: firehol_level3.netset*            |                                 
194.147.140.76  (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.76  | BanMalware: firehol_level3.netset*            |                                 
193.27.229.219  (RU) | https://otx.alienvault.com/indicator/ip/193.27.229.219  | BanMalware: firehol_level2.netset*            |                                 
194.147.140.80  ({
    "errorCode": "OVER_QUERY_LIMIT",
    "error": "maximum number of queries per day exceeded"
}) | https://otx.alienvault.com/indicator/ip/194.147.140.80  | BanMalware: firehol_level3.netset*            |                                                   
162.142.125.17  (US) | https://otx.alienvault.com/indicator/ip/162.142.125.17  | BanMalware: firehol_level2.netset             |                                 
94.102.51.17    (NL) | https://otx.alienvault.com/indicator/ip/94.102.51.17    | BanMalware: normshield_high_attack.ipset      |                                 
83.97.20.31     (RO) | https://otx.alienvault.com/indicator/ip/83.97.20.31     | BanMalware: normshield_high_bruteforce.ipset  |                                 
194.147.140.94  ({
    "errorCode": "OVER_QUERY_LIMIT",
    "error": "maximum number of queries per day exceeded"
}) | https://otx.alienvault.com/indicator/ip/194.147.140.94  | BanMalware: firehol_level3.netset*            |                                                   
104.206.128.14  (US) | https://otx.alienvault.com/indicator/ip/104.206.128.14  | BanMalware: firehol_level3.netset             |                                 
194.147.140.48  (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.48  | BanMalware: firehol_level3.netset*            |                                 
194.147.140.103 (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.103 | BanMalware: firehol_level3.netset*            |                                 
194.147.140.97  ({
    "errorCode": "OVER_QUERY_LIMIT",
    "error": "maximum number of queries per day exceeded"
}) | https://otx.alienvault.com/indicator/ip/194.147.140.97  | BanMalware: firehol_level3.netset*            |                                                   
194.147.140.106 (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.106 | BanMalware: firehol_level3.netset*            |                                 
194.147.140.98  ({
    "errorCode": "OVER_QUERY_LIMIT",
    "error": "maximum number of queries per day exceeded"
}) | https://otx.alienvault.com/indicator/ip/194.147.140.98  | BanMalware: firehol_level3.netset*            |                                                   
162.142.125.27  (US) | https://otx.alienvault.com/indicator/ip/162.142.125.27  | BanMalware: firehol_level3.netset*            |                                 
194.147.140.68  (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.68  | BanMalware: firehol_level3.netset*            |                                 
194.147.140.107 (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.107 | BanMalware: firehol_level3.netset*            |                                 
167.71.186.157  (US) | https://otx.alienvault.com/indicator/ip/167.71.186.157  | BanMalware: firehol_level3.netset             |                                 
194.147.140.66  (NL) | https://otx.alienvault.com/indicator/ip/194.147.140.66  | BanMalware: firehol_level3.netset*            |
Click to expand...
dave14305 said:
Exceeded the db-ip.com threshold. Browse here to see queries remaining.
Code: 
{
    "queriesLeft": 1000
}
Click to expand...
@bluepoint were you playing around with the firewall again? how did you hit the ratelimit? Idk If I have ever seen that being done on here. o_O
 
@dave14305 do you know of any other APIs that might not have this limitation?

Code: 
https://ipinfo.io/${ip}/country

But I don't know if they have a ratelimit and it doesn't list full country name, just the country code.

Code: 
curl -s http://ip-api.com/json/${ip} | awk -F '[:,]' '/"country"/ {gsub(/"/, "", $4); print $4}'

Returns just the country name, but that isn't over a secure connection.

Here is another, but Idk its accuracy in comparison to ipinfo.io.

Code: 
curl -sSL https://api.hostip.info/get_json.php?ip=${ip} | awk -F '[:,]' '/"country_name"/ {gsub(/"/, "", $2); print $2}'


Code: 
for ip in 194.147.140.80 194.147.140.94 194.147.140.97 194.147.140.98; do curl -sSL https://api.hostip.info/get_json.php?ip=$ip | awk -F '[:,]' '/"country_name"/ {gsub(/"/, "", $2); print $2}'; done
SWITZERLAND
SWITZERLAND
SWITZERLAND
SWITZERLAND


for ip in 194.147.140.80 194.147.140.94 194.147.140.97 194.147.140.98; do curl -sSL https://api.hostip.info/get_json.php?ip=$ip | awk -F '[:,]' '/"country_code"/ {gsub(/"/, "", $4); print $4}'; done
CH
CH
CH
CH

As you can see, I question the accuracy of api.hostip.info because the API skynet uses produces much different results.

Code: 
for ip in 194.147.140.80 194.147.140.94 194.147.140.97 194.147.140.98; do curl -sSL https://ipinfo.io/${ip}/country; done
UA
UA
UA
UA

After some research, https://ipinfo.io/${ip}/country does ratelimit after 50,000 queries. It allows 50,000 free lookups per day, but does not offer listing full countries name, just the code.
 
Last edited:
dave14305 said:
No, there has always been a dance between Skynet and these free services where they stop working, or start rate-limiting and Adamm has to find a new one. I don’t think this is much of an issue in this 2.5 year old thread.
Click to expand...
I agree, I havent personally queried this API enough to have to worry about this being an issue. I am curious about the steps the OP took to discover this ratelimit. I am under the impression, that the average user through normal use would not hit the ratelimit.
 
SomeWhereOverTheRainBow said:
Here is everything skynet whitelists to prevent "breakage"

Code: 
ipdeny.com
ipapi.co
api.db-ip.com
api.bgpview.io
asn.ipinfo.app
speedguide.net
otx.alienvault.com
github.com
raw.githubusercontent.com
iplists.firehol.org
astrill.com
strongpath.net
snbforums.com
bin.entware.net
nwsrv-ns1.asus.com
Click to expand...


Thanks a bunch, in the whitelist !
 
You must log in or register to reply here.

Similar threads

D
Questions About SkyNet and Blocking
2
Replies
22
Views
9K
Adamm
Adamm

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 471 (members: 17, guests: 454)
Back
Top