0

I have discovered that one of the IP addresses my company's domain names has been assigned to has blacklisted. It's a new domain and address for us. There's no website attached to it, but very often email using that address is getting filtered out.

Further investigation showed that the whole IP address block is blacklisted e.g. 123.456.789.x

Why would a whole block be blacklisted?

5 Answers 5

9

It's probably because of a couple of reasons:

  • The IP block was earlier assigned to someone who used it to spam or spread malware.

  • The IP Block belongs to a country that the site/company doesn't want connections from - generally done for countries that have a very high quantity of malicious traffic originating from them.

5

I have been involved with incidents where an attacker used a particular cloud service or VPS provider and their IP would rotate between an unpredictable range of IPs within a CIDR block. So, instead of blocking each IP as they appeared, we blocked the whole CIDR block until the attacker gave up.

It is easy to imagine that someone used the same technique and simply forgot to review the blocking rule.

3
  • 153.126.131.X is being blocked by Spamcannibal.
    – mycowan
    Commented Dec 23, 2016 at 3:54
  • @mycowan ok. But adding these specific details radically changes your question. Instead of a general question, you now are asking why this one entity would block that address range.
    – schroeder
    Commented Dec 23, 2016 at 7:07
  • Using SpamCannibal's own tools (spamcannibal.org/cannibal.cgi), it is because that entire range is classified as "generic/anonymous/un-named IP", which appears to be a misconfiguration on their end or the database is out-of-date.
    – schroeder
    Commented Dec 23, 2016 at 7:11
1

Do you have control over the whole block of IPs? Or is it shared with other sites?

Some filtering rules or services do automatically blacklist a whole class C block, based on a proactive assumption that bad hosts come from bad neighborhoods. A rather "guilty until proven innocent" form of vigilante internet justice in my opinion.

Yes, sometimes it makes sense to knock out the whole block, but I've seen more than one small business get knocked offline because a completely unrelated site with a similar IP address had a compromised forum script. :-/

1
  • The block addresses belongs to the company hosting our servers.
    – mycowan
    Commented Dec 27, 2016 at 1:34
-1

This might be cause by anything from potential malware infection on your IP address block to someone sending spam from that IP address.

You can use tools like online blacklist checkers to see which blacklisting service has done it and why. One of them is: http://whatismyipaddress.com/blacklist-check

tl;dr It might be a case of malware or spam in your network or simply misuse by someone using the IP address before your purchased the block.

-2

To be fair, it is not really a whole "block". This is a just 255 addresses in /24 subnet which is safer to block as almost all organizations own subnets larger than the 256 address block. Like @Adamlive suggests, one rogue IP address implies at least the /24 block is owned by an attacker. Therefore, better to be safe than sorry.

2
  • Definition of block: en.wikipedia.org/wiki/… Your assertion about who owns a CIDR block is completely false.
    – schroeder
    Commented Dec 22, 2016 at 8:01
  • @schroeder, why is that completely false? There might be organizations owning a single public IP, but most do not. Whole /24 or /16 blocks are owned by ISPs, CDNs, and regular companies.
    – sandyp
    Commented Dec 22, 2016 at 16:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .