anyone have anecdotes on how subscribing to an IP reputation service led them to discover internal compromises?

services like:

  • Is this really a question, in the StackExchange sense? – Iszi Jan 10 '11 at 20:48
  • as per @Iszi's comment, do you fancy rewording the Q to be more of a Q? – Rory Alsop Jan 29 '11 at 11:07

In the past I have used OpenDNS for a client. OpenDNS detected that not only was there malware phoning home on the network, but that there was Botnet traffic also coming from the network. The problem was that since OpenDNS sits outside the network, it only sees the public IP of the network--Since there were >150 machines on the internal network, there was no easy way to tell which one was infected.

So my caution would be that unless there was a 1 to 1 relationship to the public IP and the computer (webserver or something like that), or the IP rep service sniffed the traffic before it was NATed, then I am not sure how valuable it will be, except as an alerting mechanism that there is something nefarious going on in the internal network.


| improve this answer | |
  • I didn't realise OpenDNS offered that sort of info as a service. Cheers. +1 – Rory Alsop Jan 10 '11 at 12:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.