6

Is there an open source project or a list of "bad" IP addresses or ranges that are likely to be used by attackers or spammers?

UPDATE: ideally I want it to be a service call so I can call it using HttpClient or with JSON from my web page and get a yes/no (I find it hard to believe that no one has yet created such a web service)

Improve this question
7
  • Yes, you can get some information on this topic with a Google Search:<br> mcafee.com/threat-intelligence/ip/spam-senders.aspx
    – 16b7195abb140a3929bbc322d1c6f1
    Commented Jan 3, 2016 at 1:47
  • There are so many "bad" IP addresses and there are so many new ones being added each day and so many that fall off the "bad" list every day, by the time you had a chance to do anything with the list, it would be out-of-date.
    – pndfam05
    Commented Jan 3, 2016 at 2:10
  • 2
    Have you done any research on this topic? There are tons of various types of lists like this available.
    – schroeder ♦
    Commented Jan 3, 2016 at 3:28
  • Such a list isn't really useful, as it changes within minutes. Treat every IP address with the same restriction. One thing to note, if the address matches 127.* or 192.168.*, the hacker is already close nearby.
    – ott--
    Commented Jan 3, 2016 at 4:07
  • 1
    Given the moving target of compromised servers, individual computers, all addresses are a possible attack source. There is no such thing as a trusted source on the internet. While you might put a permanent block on netblocks like the RBN, it's only a small subset of potential attack vectors
    – Fiasco Labs
    Commented Jan 3, 2016 at 4:59

2 Answers 2

Reset to default
8

Is there an open source project or a list of "bad" IP addresses that are likely to be used by attackers or spammers?

What you looking for are open source Threat Intel feeds. There are a number of them you can subscribe to or likely query. Here are a handful I know of and should lead you in the right direction.

Improve this answer
3
  • plus malwaredomains.com, email blacklists, and on and on ...
    – schroeder ♦
    Commented Jan 3, 2016 at 3:28
  • 1
    Thanks, that's a good start, I would love to find a web service that has the most recent information... I'm still looking... or maybe I should write one :-)
    – Yovav
    Commented Jan 3, 2016 at 10:53
  • For something more dynamic, you may want to use the prowl.lupovis.io API and block proactively based on what comes from the API - as oppososed to bulk block.
    – AdventN
    Commented Dec 22, 2022 at 16:55
3

UPDATE: ideally I want it to be a service call so I can call it using HttpClient or with JSON from my web page and get a yes/no (I find it hard to believe that no one has yet created such a web service)

HTTP is too much overhead for such a simple task and does not scale that well. Such things are usually done with DNS and there are lots of such lists out there. Just search for DNSBL.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .