Explain To Developers Which Type Is The Detection Script And Steps For Native Japanese IP

1. Overall Approach and Design Principles

- Objective: Determine whether a set of IPs is " Japanese native IP" (distributed by a Japanese domestic ISP, not exported through overseas proxies or CDN).
- Principle: Multi-dimensional verification; a single GeoIP cannot be fully trusted.
- Dimensions: GeoIP location, ASN attribution, reverse DNS, number and latency of Traceroute, whether the ASN is a well-known cloud/CDN ASN.
- Data sources: MaxMind GeoLite2-City/ASN, local whois/Team Cymru, ICMP/TCP latency measurement.
- Results: Based on weight aggregation (e.g., GeoIP 40%, ASN 30%, RDNS 10%, latency 20%).

2. Essential environment and dependency

- Recommended environments: Linux VPS (Debian/Ubuntu), Python3, pip.
- Main libraries: geoip2, requests, ipwhois, scapy (optional); System tools: traceroute, ping, whois.
- Databases: Download and regularly update MaxMind GeoLite2-City.mmdb and GeoLite2-ASN.mmdb.
- Permissions: Requires ICMP or TCP detection permissions; containers or environments without ICMP recommend using TCP SYN detection.
- Security: Scripts should perform speed-limited probing to prevent the firewall from recognizing them as attacks, and logs should be stored locally on the server.

3. Core detection script (example Python).

- Functions: Read IP lists, query City/ASN, whois reverse lookup, traceroute and ping delay.
- Example of determination rule: GeoCountry == "JP" score 40; ASN belongs to a major Japanese ISP with a score of 30; RDNS contains .jp or isp keywords and gets 10; Average latency < 50ms to 20
... - Extensible: Joining cloud/CDN ASN blacklists (Cloudflare, Akamai, AWS, etc.) reduces scores.
- Output: CSV or JSON, Fields: ip, country, asn, asn_name, rdns, avg_rtt, score, check.
- Note: The sample script needs to be replaced with the real MaxMind database path and handle exceptions.

#!/usr/bin/env python3
import geoip2.database, subprocess, socket
GEO_CITY='/data/GeoLite2-City.mmdb'
GEO_ASN='/data/GeoLite2-ASN.mmdb'
jp_isps = ['NTT','KDDI','SoftBank','IIJ','Rakuten']
reader_city=geoip2.database.Reader(GEO_CITY)
reader_asn=geoip2.database.Reader(GEO_ASN)
def check_ip(ip):
    rec_c=reader_city.city(ip)
    rec_a=reader_asn.asn(ip)
    country=rec_c.country.iso_code
    asn=rec_a.autonomous_system_number
    asn_org=rec_a.autonomous_system_organization or ''
    try:
        rdns=socket.gethostbyaddr(ip)[0]
    except: rdns=''
    # ping
    p=subprocess.run(['ping','-c','3','-W','1',ip], stdout=subprocess. PIPE, text=True)
    if 'rtt' in p.stdout:
        rtt=float(p.stdout.split('rtt min/avg/max/mdev = ')[1].split('/')[1])
    else:
        rtt=9999
    score=0
    if country=='JP': score+=40
    if any(x in asn_org for x in jp_isps): score+=30
    if '.jp' in rdns or 'ad.jp' in rdns: score+=10
    if rtt<50: score+=20
    return {'ip':ip,'country':country,'asn':asn,'asn_org':asn_org,'rdns':rdns,'rtt':rtt,'score':score}

4. Example data and determination tables

- Below is a comparison of real-world case types: local ISP, cloud platform, and CDN export.
- Case source: GeoIP/ASN/Traceroute detection and summary were performed on three IP groups.
- Threshold: score > = 70 determines the IP is native to Japan; 40-69 Suspicious; <40 Not native to Japan
... - Note: The cloud platform may return JP in Japan, but ASN will display AWS/Google, etc.
- Results Table: th style="text-align:center;"> conclusion).

IP	ASN	ASN name	Avg RTT(ms)	determination is <
203.181.0.1	4713	NTT Communications	18	100	native to Japan
13.230.0.1	16509	Amazon.com, Inc.	22	60	suspicious (says).
104.21.13.2	13335	Cloudflare, Inc.	8	30	Non-native (CDN

5. Application in server/host/domain/CDN/DDoS defense

- Anti-cheating: On the application side, "non-native IP" requests are marked as high risk and trigger two-factor authentication.
- Anti-DDoS: Put a large number of non-native/high-risk IPs into rate limits or IPset blacklists, which are dropped by the firewall.
- CDN strategy: For traffic identified as native to Japan, you can bypass the global CDN and return to the Japanese VPS to reduce latency.
- Log alerts: Combine fail2ban and honeypot to record abnormal ASN and RDNS situations.
- Deployment example: Japanese VPS configuration (Ubuntu 20.04, 4vCPU, 8GB RAM, BW 1Gbps, IP 203.181.0.10, ASN 4713), updated daily with local GeoIP database.

6. Summary and Precautions

- Multidimensional judgment is more accurate than a single GeoIP; it is recommended to combine ASN with routing latency.
- The database should be updated regularly (recommended daily or weekly), especially on the ASN blacklist.
- Respect privacy and rate limits legally/compliantly, and avoid excessive detection that could result in blocking.
- Practical Verification: By sampling real traffic and manually verifying traceroutes, weights and thresholds can be adjusted.
- For highly reliable judgments, private survey points can be deployed in multiple cities across Japan for passive or active detection to build more accurate geographic and routing models.