7

I know of many companies that will sell ability to lookup IP/URI reputation. Be it DNSBL, json/*, returnpath, threatstop, surbl, ..., will let me perform lookups for a reasonable fee but, in case of this particular project, the lookup introduces unacceptable latency.

Do you know of anyone who offers a dataset that is meant for local integration and a periodic update service? I understand that the update lag will make the local database permanently out of date, but this is a tradeoff I have to accept.

Improve this question
4
  • 3
    I have a question - 2 really: what do you mean by IP reputation? And more importantly, what is your end goal, is it may be that we can provide alternative answers - as in, what services exist to fulfil the same goals.
    – Rory Alsop ♦
    Commented Oct 14, 2011 at 14:05
  • IP reputation would be a metric describing past activity from an IP address or prefix. Is it known to send spam, participate in a botnet, etc. I want the data to be available locally for quick lookups/scoring(/maybe even blocking) on a proxy with a lot of traffic.
    – Mike
    Commented Oct 14, 2011 at 14:53
  • 2
    @Mike - This sounds like a great deal like those magic beans Jack bought.
    – Ramhound
    Commented Oct 14, 2011 at 15:09
  • @Ramhound - relax, I am not selling anything. DNSBL lookup adds 30ms in a good case, and I do not have the data if the partner/supplier goes away for whatever reason.
    – Mike
    Commented Oct 14, 2011 at 15:55

4 Answers 4

Reset to default
5

Spamhaus.org do this for free.

The other main companies that do this (trusteer, markmonitor etc) do provide feeds of various types. Well worth asking them what type of feed you can get from them. Of course, they will all be cost options.

Improve this answer
4

Webroot does provide IP/URL reputation for proactive threat detection . http://www.webroot.com/En_US/partners-strategic-alliances.html

Improve this answer
1

Are you asking if the EULA from each of these providers permit the customer to store and aggregate the data long-term.

Team Cymru sells their malware URLs and Botnet CC (reseller SecurityZones) but the aggregation has to be done by the customer.

Websense and Sophos both have IP reputation products, but as you pointed out, their BL are stored in the cloud and not available to the customer to download.

A concern on the part of the vendors is whether you can aggregate and resell their data. How will you assure them that their data cannot be extracted from your service/device and re-used?

Improve this answer
1

Symantec offers DeepSight, which provides real-time web services to access IP Reputation, Domain/URL Reputation, as well as malware and vulnerability data.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .