A New Future for Icanhazip

[superasn]

Wow so this person has been running this site for so many years, paying bills, answering god knows how many idiots and even getting close to trouble with 3 letter agencies and senators for absolutely nothing.. hats off to you sir, any other person would have thrown in the towel a long time ago.

Also i feel little bad you didn't get any money out of it whether the site was designed to make money or not. It would have been a wonderful end to the story if you got something back for all the years of hardwork you put into running it. You do have my appreciation if that means anything though.

P.S. this story is very similar to rawgit which was a wonderful site but also fell prey to malware aholes.

[jedberg]

> Also i feel little bad you didn't get any money out of I

Most likely it got them a much higher paying job than they would have otherwise gotten. Walking in and saying you single handedly run a site with billions of requests per day and petabytes of traffic will get you noticed.

[FabHK]

And they got a whopping $7 (nearly) in donations per year... :-/

[Ayesh]

I was using icanhazip to check if my Tor circuit was complete, and probably made 50-100 requests per week. The site was getting slow, and I thought it is just a random site that the author didn't really care too much.

I dropped my jaw when I read it was getting 30B req/day.

Thank you for running this site for so long, and thank you for keeping it up for free, and deciding to not monetize it.

[tyingq]

I got a lot of mileage out of neverssl.com before somebody fixed the process to log into various "guest wifi" setups...ones that would intercept/redirect any http request.

I'm somewhat curious what fixed things, as I've not had to use neverssl.com for some time.

[andrewmcwatters]

Reminds me of `echo $(dig @ns1.google.com o-o.myaddr.l.google.com TXT +short | tr -d \")`. I have no idea where this DNS query came from, because searching all of Google turns up nothing but https://github.com/GoogleCloudPlatform/cloud-self-test-kit/b..., which is never referenced by anyone. I had to track it down myself for a bootstrap.sh, but I don't like using undocumented sources for critical infrastructure.

My use case was needing to set the result of `hostname -f` in /etc/hosts in an automated fashion if a VPS provider didn't already add a line for the public Internet address in that file. You need to do this so that sendmail doesn't fail on `apt install` when it attempts to read your FQDN. So I couldn't use the NGINX example posted elsewhere here.

It seems like https://checkip.amazonaws.com/ is much more "reliable" in that it is publicly documented at https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/s....

To anyone who needs to read this: please don't use "services" like icanhazip for your provisioning. Even my examples above are bad.

It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings.

Edit: Oh goodness... even Amazon's documentation recommends using Google's undocumented DNS query.[1]

[1]: https://aws.amazon.com/premiumsupport/knowledge-center/route...

[quesera]

> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings.

It is not possible to know your public IP address, except by fetching the information from a known entity on the public network.

And in some scenarios, your public IP will change frequently. There is no guarantee that it will be consistent across multiple requests.

[Jasper_]

> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings.

There is no singular thing called a "public Internet address". Imagine you're writing paper letters to someone. You write a letter, you put your own From address, you drop it in the slot. When the mailperson comes to collect the letter, they replace your mailing address with a special other codeword. And when they receive mail, they replace that codeword back with your original address. You would never know it was intercepted unless you asked around. There's no official protocol to ask for your codeword, it's just a trick the mail service does on your behalf.

Your home router does exactly this; it's known as "Network Address Translation", or NAT. It's not an official part of IPv4, and there's no protocol to ask what it is. Your computer thinks its local IP address (typically some variety of 192.168.0.1) is its real, public address, and your router does the swap behind your back.

[fulafel]

> It does strike me as weird that there is seemingly no POSIX-compliant way to get your public Internet address, from my readings.

Because traditionally if you're doing things right, you're not using NAT, which is against IP specs and a nonstandard kludge. So you just take your socket and query its local endpoint address using getsockname and voila.

[thatjamesdude]

What kind of documentation would you like to see for a service like this?

Genuinely asking because I've always used the query

    dig +short myip.opendns.com @resolver1.opendns.com

to resolve the public IP my ISP has assigned me so I can update my homelab's IP.

I use Route53 and I either completely missed the checkip link or they simply don't mention it

[luckman212]

Why the extra `echo` and subshell $(...) ?

dig... | tr... works fine without it.

also, `dig -4 ... ` to get your IPv4 address, for us dual-stacked folks. Otherwise it returns your V6 address by default.

[gnopgnip]

dig myip.opendns.com resolver1.opendns.com is another option

[toxik]

Chinese originated spam and abuse is so outrageously widespread, I don’t understand why there isn’t a conversation going on about cutting them off from the wider internet. They blocked most of it anyway.

[mwcampbell]

It stands to reason that an especially large volume of abuse will originate from the most populous country in the world. I don't think that's a reason to cut them off from the global Internet. If it's true that their government is already oppressing their own people (I don't know what's truth and what's propaganda), then the rest of us shouldn't make it worse for those people by cutting off whatever outside connections they manage to have.

Also, I'm generally bothered by comments like this one that stir up the general human tendency toward xenophobia. We should be fighting that tendency within ourselves, not fighting the out group. Whichever group of people we want to demonize, we should remember that they're people just like us. We shouldn't punish the majority of them for what a minority are doing to us.

[jmartrican]

The other trending article on HN today is about Chinese fishing boats abusing the world's oceans. Its ok, we'll learn to get used to it.

[jedberg]

It's not even a new trend either. Back in 2003 when I worked at eBay and PayPal doing security, the bulk of the attempts came from China and Romania (Romania at the time had one ISP for the whole country that was fast but didn't care about abuse at all).

[liveoneggs]

15+ or so years ago I worked in the NOC of the 3rd or so largest ISP in the US and a random network engineer did this one evening. We got a big influx of customers complaining about email not working to their family, etc, until I finally figured it out.

That network guy (classic long hair "security" guy) was a lazy asshole for doing it then and the internet needs to have the technology to deal with bad actors beyond AS/geo-level blocking now.

[wyager]

I would rather have a global network with marginally more spam than a regional network with marginally less.

[egypturnash]

China currently makes some absurdly large percentage of the world's consumer goods, and the discussions about producing them are probably being had over the internet. Cut them off of the internet and we have to rebuild manufacturing capacity everywhere else.

Which might not be a bad thing overall, but it's sure not gonna make any transnational corporation's bottom line happy over the next few quarters, so they'll be waving a lot of money at politicians to make this not happen.

[croes]

Maybe that is the plan, that we cut them off, so they don't have to

[madars]

Thanks for all your hard work! icanhazip.com / icanhazptr.com have been incredibly useful.

Small feature request: back in the day {ipv4,ipv6}.{icanhazptr,icanhazip}.com only had A / AAAA records, but now it seems they have both and thus a simple "curl ipv4.icanhzptr.com" can also give me a v6 address (of course, "curl -4" works). Would Cloudfare be OK with separating them again?

[tomschlick]

http://v4.icanhazip.com/ seems to return just the v4 address, same with http://v6.icanhazip.com/

[Tijdreiziger]

> icanhazptr.com

Cool, I didn't know about that one.

[OskarS]

I’ve seen packages that do ”internet-detection” by calling out to icanhazip.com, and I just thought that was so irresposnible. What if your package got popular, how much money are you costing the hoster? For services like this, people just don’t consider the fact that there’s someone on the other side.

[Seirdy]

If you want, you can set up a similar service yourself by adding the following lines to an NGINX config:

    location = /ip {
            default_type text/plain;
            return 200 '$remote_addr';
    }

Requesting "yoursite.tld/ip" will then return your IP address. I set up something like this on all my servers and recommend that others do the same. It's easy to do the same for Apache and Caddy configs. That should help spread the load.

I'm curious as to what other overused utilities can be trivially done with pure server configs.

[ljm]

I feel the same about dependency steps in CI, without a cache or any similar structure. Package repos like Rubygems, NPM and PyPi get utterly rinsed by the continual downloading and redownloading of stuff the client should have already stored.

[kortilla]

The article was about abusive floods accounting for 90% of the traffic. The author was happy with legitimate use cases like packages doing detection, contrary to your comment.

[ColdHeat]

I used to use this site until I found https://checkip.amazonaws.com/. Switched because I wasn't sure who was behind icanhazip.com and it's tough to beat AWS. Glad to hear that it will likely be maintained for awhile longer!

[madars]

Something to be aware of: checkip.amazonaws.com will happily return an X-Forwarded-For address https://stackoverflow.com/questions/52618096/under-what-circ...

[epse]

Does that one only do IPv4?

[Ice_cream_suit]

Truly selfless service. It cost him many thousands in money and tens of thousands in time.

And :

"If you’re curious, Cloudflare did pay me for the site. We made a deal for them to pay me $8.03; the cost of the domain registration. The goal was never to make money from the site (although I did get about $75 in total donations from 2009 to 2021). The goal was to provide a service to the internet. Cloudflare has helped me do that and they will continue to do it as the new owners and operators of icanhazip.com."

BTW, speaking as a nerd, he has the best formatted resume that I have ever seen !

See: https://majorhayden.com/

[mjsir911]

This kind of service is exactly what STUN servers are made for. Designed to be used with webrtc, but it works perfectly alright by itself.

There are a plethora of unauthenticated STUN servers around, and while there's still room for abuse, the protocol is a bit more lightweight than full-blown http requests, and faster, too!

I've dabbled with doing this on my own, but I've found `myip` to do the job nicely and without hassle:

https://github.com/Snawoot/myip

[politelemon]

Can this be done using the stun command directly?

http://manpages.ubuntu.com/manpages/bionic/man1/stun.1.html

[yakubin]

There was a thread[1] a couple months ago where I discovered a method to get one's IP address relying only on DNS:

  nslookup myip.opendns.com resolver1.opendns.com

I love it.

[1]: <https://news.ycombinator.com/item?id=26634476>

[gamedna]

Had the pleasure of working with Major at Rackspace; his professionalism, ethics, and quality of person always impressed me and inspired me to be a better version of myself every day. This move is a very mature decision; one that was probably bittersweet. Kudos Major on taking a step forward and putting the stewardship where it belongs.

[coderholic]

I'm glad icanhazip will live on! We also see a lot of malware and bot traffic to https://ipinfo.io, but nowhere near these levels!

[CliffStoll]

I've been using ipinfo.io for several years -- checking a dynamic ip address every 10 minutes. My thanks for supplying this service! Is there a reason to change over to icanhazip ?

[chrischen]

I feel like in theory google should be returning this site, instead of the ad-filled sites when one searches "my ip address." But it always seems like Google heavily over-values the domain name and search term matches.

[slig]

The "first result" in a Google query for "my ip" and other combinations is a box with your public IP. There's no reason to click in any of the ad-filled sites anymore.

[KirillPanov]

Suggest retitle: "Cloudflare acquires Icanhazip".

Glad it will live on!

[leesalminen]

I run a very simple, completely free API service as well. Currently using Google Cloud Run, handling a constant 10 rps for ~$8/mo. Pretty happy with it. I could probably cost optimize more. I sure hope I never have to deal with 30 billion requests per day, though. I'm sure my patience would run thin as well. Thank you to the author for running this site for so many years!

[Klasiaster]

For those behind a home router an alternative is to use UPNP, e.g., through the miniupnpc package on Debian which ships the `/usr/bin/external-ip` script that postprocesses the `upnpc -s` output.

[zie]

You can implement this yourself in nginx like this:

        location /ip {
                add_header Content-Type "application/json";
                return 200 '{"host":"$server_name","ip":"$remote_addr","port":"$remote_port","server_ip":"$server_addr","server_port":"$server_port"}\n';
        }

and you will get back a little JSON with everything you want.

[asdfaoeu]

Doesn't seem to work right...

    {"ip": "127.0.0.1", ...}

But seriously, of course you can but 99% of people would rather just use a simple site rather than hosting their own server.

[delduca]

I use this https://cloudflare.com/cdn-cgi/trace

[c7DJTLrn]

I often use whatismyip.akamai.com as a reliable "what's my IP" service but unfortunately it isn't configured correctly for HTTPS.

[sneak]

This story is kind of sad. I wonder why the operator didn't blacklist certain netblocks/ASNs who were abusing the service.

[blibble]

or even better: respond with incorrect data

they'll soon learn

[thegeekbin]

Why punish a group for one bad actor?