Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know of many companies that will sell ability to lookup IP/URI reputation. Be it DNSBL, json/*, returnpath, threatstop, surbl, ..., will let me perform lookups for a reasonable fee but, in case of this particular project, the lookup introduces unacceptable latency.

Do you know of anyone who offers a dataset that is meant for local integration and a periodic update service? I understand that the update lag will make the local database permanently out of date, but this is a tradeoff I have to accept.

share|improve this question
I have a question - 2 really: what do you mean by IP reputation? And more importantly, what is your end goal, is it may be that we can provide alternative answers - as in, what services exist to fulfil the same goals. – Rory Alsop Oct 14 '11 at 14:05
IP reputation would be a metric describing past activity from an IP address or prefix. Is it known to send spam, participate in a botnet, etc. I want the data to be available locally for quick lookups/scoring(/maybe even blocking) on a proxy with a lot of traffic. – Mike Oct 14 '11 at 14:53
@Mike - This sounds like a great deal like those magic beans Jack bought. – Ramhound Oct 14 '11 at 15:09
@Ramhound - relax, I am not selling anything. DNSBL lookup adds 30ms in a good case, and I do not have the data if the partner/supplier goes away for whatever reason. – Mike Oct 14 '11 at 15:55 do this for free.

The other main companies that do this (trusteer, markmonitor etc) do provide feeds of various types. Well worth asking them what type of feed you can get from them. Of course, they will all be cost options.

share|improve this answer

Webroot does provide IP/URL reputation for proactive threat detection .

share|improve this answer

Are you asking if the EULA from each of these providers permit the customer to store and aggregate the data long-term.

Team Cymru sells their malware URLs and Botnet CC (reseller SecurityZones) but the aggregation has to be done by the customer.

Websense and Sophos both have IP reputation products, but as you pointed out, their BL are stored in the cloud and not available to the customer to download.

A concern on the part of the vendors is whether you can aggregate and resell their data. How will you assure them that their data cannot be extracted from your service/device and re-used?

share|improve this answer

Symantec offers DeepSight, which provides real-time web services to access IP Reputation, Domain/URL Reputation, as well as malware and vulnerability data.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.