Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have discovered that one of the IP addresses my company's domain names has been assigned to has blacklisted. It's a new domain and address for us. There's no website attached to it, but very often email using that address is getting filtered out.
Further investigation showed that the whole IP address block is blacklisted e.g. 123.456.789.x
Why would a whole block be blacklisted?
It's probably because of a couple of reasons:
The IP block was earlier assigned to someone who used it to spam or spread malware.
The IP Block belongs to a country that the site/company doesn't want connections from - generally done for countries that have a very high quantity of malicious traffic originating from them.
I have been involved with incidents where an attacker used a particular cloud service or VPS provider and their IP would rotate between an unpredictable range of IPs within a CIDR block. So, instead of blocking each IP as they appeared, we blocked the whole CIDR block until the attacker gave up.
It is easy to imagine that someone used the same technique and simply forgot to review the blocking rule.
Do you have control over the whole block of IPs? Or is it shared with other sites?
Some filtering rules or services do automatically blacklist a whole class C block, based on a proactive assumption that bad hosts come from bad neighborhoods. A rather "guilty until proven innocent" form of vigilante internet justice in my opinion.
Yes, sometimes it makes sense to knock out the whole block, but I've seen more than one small business get knocked offline because a completely unrelated site with a similar IP address had a compromised forum script. :-/
This might be cause by anything from potential malware infection on your IP address block to someone sending spam from that IP address.
You can use tools like online blacklist checkers to see which blacklisting service has done it and why. One of them is: http://whatismyipaddress.com/blacklist-check
tl;dr It might be a case of malware or spam in your network or simply misuse by someone using the IP address before your purchased the block.
To be fair, it is not really a whole "block". This is a just 255 addresses in /24 subnet which is safer to block as almost all organizations own subnets larger than the 256 address block. Like @Adamlive suggests, one rogue IP address implies at least the /24 block is owned by an attacker. Therefore, better to be safe than sorry.
