Recently, I saw icanhazip.com pop up in my pFsense firewall logs. It was immediately blocked but the name piqued my interest, so I did a little digging which revealed an interesting backstory.
It’s owned by Cloudflare:
spoiler
spoiler
…but it hasn’t always been theirs: icanhazip: How a simple IP address tool survived a deluge of users. Pretty interesting, at least to me as I have never encountered it before.
I have it still blocked as nothing I’m doing seems hampered by blocking icanhazip.com’s ip range. Anyone else ever encounter icanhazip.com?
The back story of icanhazip is OK, but I want to know where you picked it up in your logs… Incoming on edge? Something in your network dialing out?
Suricata picked it up on the LAN side. I haven’t done an in depth review, but I am suspecting that SpeedTest Tracker is using icanhazip.com and ifconfig.co to check my ip and find the most appropriate test server. It’s on the list tho. For now I have them blocked and nothing seems to complain about it. I chose my own servers.
Could be.
Speedtest (the ookla one) uses a bunch of traceroute and compares hops to pick a peering point, but they display your public IP on the test page and probably use some icanhzip or other service to know that. It should come as no surprise to you that most north American ISPs pay Ookla to prefer peering points in which they have a heavy presence.
Icanhazip is an older service, I’m surprised cloudflare didn’t just kill it, they built their own when they were standing up 1.1.1.1.
Could also be some other tooling on your lan built before the Claude days.