Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ones too. So far I have come across dshield (Internet Storm Center) and i-blocklist. What are others that I can consider that you have used and found useful?
The main aim is to prevent against DDoS. Being able to block TOR and anonymous proxies via the feed will also be nice.
I guess something should be noted on the botnet and DDoS.
The main interest of the distributed system of the botnet, is that you cannot identify a bot from a genuine client. Think of it like this:
Someone infects many computers by sending a virus. Each tricked user is now part of the so-called botnet. Let's say you have 100M bots.
This scenario implies that the IP addresses of the bots have dynamic or static IP addresses depending of their ISP policy. So collecting IP addresses is worthless. Soon or later, the pool is going to be renewed.
DDoS works this way: you will ask each bot to connect to one server. Question: How do you know if they are trying to access your server for a legit purpose or just to saturate your connection pool?
Given this, as you can't identify whether a client is part of the attack or not, you cannot compile a reliable list of IP of the distributed network.
Although is it not impossible, I think that the prevention of DDoS attacks by IP is not possible because of the two exposed challenges: use of a real identifier (IP address) and identification of bots.
Maybe if a group of servers would report attacks on live to a master server, it is more than probable that the next attack from that set of bots will have different IP addresses. Furthermore, you cannot deny access to your site if an IP appeared once in the list of one address that tried to access one server know to have suffer a DDoS attack, because you will ban legitimate clients that do have nothing to do with the attack.
By the way, I never heard of such a list.
TOR network exit node are more easily identifiable. Some resource like http://proxy.org/tor.shtml
Is the Spamhaus XBL something like what you're looking for?
The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies (HTTP, socks, AnalogX, wingate, etc), worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
It is more concerned with senders of spam email, but maybe it's some use.
You can find links to the TOR exit node list with a quick google search. The Spamhaus XBL is a great resource and I would likely utilize sinkholes and other options for blocking DoS attacks. But as I was recently tasked with creating a rather large list of ip's and domains related to malicious activity for another purpose whether it be botnets, spammers, malware payloads, exploit kits and DoS attacks. A good starting resource would be Lenny Zeltser's list you can find here although its become a bit dated many of the sources are still alive. http://zeltser.com/combating-malicious-software/malicious-ip-blocklists.html
A few websites attempt to roll up all malicious domain's and ip's into lists, malwaredomains.com - pulls from many many sources, spammers, exploit kits etc. emergingthreats.net - Known compromised hosts in snort format, Russian Business Network lists and more.
And then you get to the lists you pay to be a part of, I believe Arbor networks rolls one out and their are many other paid lists which are apparently effective though costly. If you are working for a company or in a specific industry you can find ISAC groups which share information such as lists of fresh DoS sources, botnet url's etc as long as you adhere to all rules, charter and share back. I also highly recommend reading up on ISC SIE, you can find more information here https://sie.isc.org/.
I hope some of these resources can help you in your search for lists but take it from someone who maintains a very large one daily, you should utilize other resources for DoS prevention as they are much more effective.
Related to @M'vy's answer, you should look at TorDNSEL
"TorDNSEL is an implementation of the active testing, DNS-based exit list for Tor exit nodes."
