1

I just received a /24 IPv4 network from my ISP. This very same /24 network was previously used by some hosting provider and if I made a quick scan of those 256 IPv4 addresses agains some DNSBL databases, then many of the addresses were listed there. This made me wonder are there other such public databases for different threads than spam? For example maybe some CERTs or other organisations have such (public) databases where they list IP addresses involved in botnets or hosting (regularly) web-servers which serve malware.

  • I'm slightly confused about your question. However, yes, there is. There are RBLs for all sorts of malicious reasons. Whether it be spam, scanning host, brute force attacks, etc. Many custom (some private some not) RBLs exist for which match a pattern of unwanted behavior. – Jack Bahou Feb 24 '16 at 13:25
  • Ok, thanks! Could you name some specific RBLs which are for fighting against some other malicious activities than spam? – Martin Feb 24 '16 at 13:37
  • Well, I would suggest you google for specific RBLs you might want. If you want to block against bruteforce attempts, you're better off using something like fail2ban. AlienVault has their Open Threat Exchange(OTX) that has something of an RBL catalog if you will. They have a Python library that you might be able to leverage their OTX with but I'm not sure. I know its primary purpose is for supplementing their AlienVault USM platform. – Jack Bahou Feb 24 '16 at 15:14
2

The MXToolbox blacklist checker is a good place to start.

You can follow that up by reading some of the lists hosted at iblocklist.com particularly including the dshield list, and then some of the others.

Perhaps also look at the sources of "bad IP lists" in the Emerging Threats and Snort IDS/IPS rulesets.

  • agree about MXToolbox. Good resource all around. – Jack Bahou Feb 24 '16 at 16:13
  • Thanks! I used a custom script which worked similarly to MXToolbox blacklist check, but I checked only against around 10 DNS based email blacklists. Lists on iblocklist.com were useful! Are there "bad IP lists" distributed with Snort? Or what did you mean? – Martin Feb 24 '16 at 23:10
  • 1
    Snort can, at minimum, check against the DShield blocklist as part of the rules. – Anti-weakpasswords Feb 24 '16 at 23:29
  • Do you mean this list: feeds.dshield.org/block.txt? Are the IP addresses in this list responsible for DDoS attacks? Spreading worms? Some other malicious activity? I tried to find this information from DShield website, but I couldn't find it. – Martin Feb 25 '16 at 11:49
1

Robtex is an online tool that will give you various information about an IP or netblock. I prefer the "old robtex" version of the site, which is still available at the top next to the other links. The other linked resources will also have useful information from those vendors (McAfee, Google, Virustotal, etc.) about their perception of your netblock.

Good luck!

  • All I was able to find with Robtex were whois database records and DNS PTR records when I searched for subnets. Am I using this tool wrong or doesn't it provide any other information? Just for information, I found the Google Malware Distribution database, which is quite interesting. Allows one to search for websites which distribute malware. – Martin Feb 24 '16 at 23:31
  • 1
    Yeah, that's why I don't like the "new robtex" as much, you have to click on the "old robtex" link after you click through. E.g. punch in 8.8.8.8 in the main bar, click the entry that has "8.8.8.8" (link is ?dns=8.8.8.8), once you've got that, you can click "check 8.8.8.8 on: old robtex". When you scroll down, there's a section titled "Blacklists". robtex.com/en/advisory/dns/8/8/8/8 – Liczyrzepa Feb 25 '16 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.