Find an IP that is known to be on a DNSBL
I am configuring Zabbix to check my IPs against several DNSBLs. My IPs are currently not blacklisted. My monitoring needs to be tested, to verify that it will alert properly if one of my IPs does become blacklisted. How can I obtain, for testing, a known bad IP, one that is on a DNSBL?
Details
I've searched for published blacklists, but haven't found any. I'm guessing that publishing the lists would aid spammers, or have other bad side-effects.
Zabbix will call a Ruby script. That script will probably just shell out to rblcheck, since the lists it checks seem like a good start:
$ rblcheck 8.8.8.8
8.8.8.8 not listed by sbl.spamhaus.org
8.8.8.8 not listed by xbl.spamhaus.org
8.8.8.8 not listed by pbl.spamhaus.org
8.8.8.8 not listed by bl.spamcop.net
8.8.8.8 not listed by psbl.surriel.com
8.8.8.8 not listed by dul.dnsbl.sorbs.net
The DNSBLs that rblcheck uses is configurable. I can add or remove DNSBLs as needed, either permanently, or for testing.
linux zabbix rbl
asked Jan 16 at 15:03
Wayne ConradWayne Conrad
391416
add a comment |
I am configuring Zabbix to check my IPs against several DNSBLs. My IPs are currently not blacklisted. My monitoring needs to be tested, to verify that it will alert properly if one of my IPs does become blacklisted. How can I obtain, for testing, a known bad IP, one that is on a DNSBL?
Details
I've searched for published blacklists, but haven't found any. I'm guessing that publishing the lists would aid spammers, or have other bad side-effects.
Zabbix will call a Ruby script. That script will probably just shell out to rblcheck, since the lists it checks seem like a good start:
$ rblcheck 8.8.8.8
8.8.8.8 not listed by sbl.spamhaus.org
8.8.8.8 not listed by xbl.spamhaus.org
8.8.8.8 not listed by pbl.spamhaus.org
8.8.8.8 not listed by bl.spamcop.net
8.8.8.8 not listed by psbl.surriel.com
8.8.8.8 not listed by dul.dnsbl.sorbs.net
The DNSBLs that rblcheck uses is configurable. I can add or remove DNSBLs as needed, either permanently, or for testing.
linux zabbix rbl
asked Jan 16 at 15:03
Wayne ConradWayne Conrad
391416
4
Each DNSBL has its own test IP addresses for this purpose.
– Michael Hampton♦
Jan 16 at 16:02
@MichaelHampton That's perfect, thanks! How does one go about finding the test IP addresses? I haven't found the right search recipe for this (Googling for "DNSBL test addresses", for example, just yields forms and instructions for testing addresses). I can't find anything in the spamhaus FAQ, nor spamcop's.
– Wayne Conrad
Jan 16 at 16:16
3
They're different for each DNSBL, of course, and usually buried in their documentation. 127.0.0.2 is pretty common.
– Michael Hampton♦
Jan 16 at 16:22
@MichaelHampton Thanks. Do you want to paste those comments into an answer so I can vote it up?
– Wayne Conrad
Jan 16 at 16:26
add a comment |
I am configuring Zabbix to check my IPs against several DNSBLs. My IPs are currently not blacklisted. My monitoring needs to be tested, to verify that it will alert properly if one of my IPs does become blacklisted. How can I obtain, for testing, a known bad IP, one that is on a DNSBL?
Details
I've searched for published blacklists, but haven't found any. I'm guessing that publishing the lists would aid spammers, or have other bad side-effects.
Zabbix will call a Ruby script. That script will probably just shell out to rblcheck, since the lists it checks seem like a good start:
$ rblcheck 8.8.8.8
8.8.8.8 not listed by sbl.spamhaus.org
8.8.8.8 not listed by xbl.spamhaus.org
8.8.8.8 not listed by pbl.spamhaus.org
8.8.8.8 not listed by bl.spamcop.net
8.8.8.8 not listed by psbl.surriel.com
8.8.8.8 not listed by dul.dnsbl.sorbs.net
The DNSBLs that rblcheck uses is configurable. I can add or remove DNSBLs as needed, either permanently, or for testing.
linux zabbix rbl
asked Jan 16 at 15:03
Wayne ConradWayne Conrad
391416
I am configuring Zabbix to check my IPs against several DNSBLs. My IPs are currently not blacklisted. My monitoring needs to be tested, to verify that it will alert properly if one of my IPs does become blacklisted. How can I obtain, for testing, a known bad IP, one that is on a DNSBL?
Details
I've searched for published blacklists, but haven't found any. I'm guessing that publishing the lists would aid spammers, or have other bad side-effects.
Zabbix will call a Ruby script. That script will probably just shell out to rblcheck, since the lists it checks seem like a good start:
$ rblcheck 8.8.8.8
8.8.8.8 not listed by sbl.spamhaus.org
8.8.8.8 not listed by xbl.spamhaus.org
8.8.8.8 not listed by pbl.spamhaus.org
8.8.8.8 not listed by bl.spamcop.net
8.8.8.8 not listed by psbl.surriel.com
8.8.8.8 not listed by dul.dnsbl.sorbs.net
The DNSBLs that rblcheck uses is configurable. I can add or remove DNSBLs as needed, either permanently, or for testing.
linux zabbix rbl
linux zabbix rbl
asked Jan 16 at 15:03
Wayne ConradWayne Conrad
391416
asked Jan 16 at 15:03
Wayne ConradWayne Conrad
391416
edited Jan 16 at 15:31
Wayne Conrad
asked Jan 16 at 15:03
Wayne ConradWayne Conrad
391416
asked Jan 16 at 15:03
Wayne ConradWayne Conrad
391416
asked Jan 16 at 15:03
Wayne ConradWayne Conrad
391416
391416
4
Each DNSBL has its own test IP addresses for this purpose.
– Michael Hampton♦
Jan 16 at 16:02
@MichaelHampton That's perfect, thanks! How does one go about finding the test IP addresses? I haven't found the right search recipe for this (Googling for "DNSBL test addresses", for example, just yields forms and instructions for testing addresses). I can't find anything in the spamhaus FAQ, nor spamcop's.
– Wayne Conrad
Jan 16 at 16:16
3
They're different for each DNSBL, of course, and usually buried in their documentation. 127.0.0.2 is pretty common.
– Michael Hampton♦
Jan 16 at 16:22
@MichaelHampton Thanks. Do you want to paste those comments into an answer so I can vote it up?
– Wayne Conrad
Jan 16 at 16:26
add a comment |
4
Each DNSBL has its own test IP addresses for this purpose.
– Michael Hampton♦
Jan 16 at 16:02
@MichaelHampton That's perfect, thanks! How does one go about finding the test IP addresses? I haven't found the right search recipe for this (Googling for "DNSBL test addresses", for example, just yields forms and instructions for testing addresses). I can't find anything in the spamhaus FAQ, nor spamcop's.
– Wayne Conrad
Jan 16 at 16:16
3
They're different for each DNSBL, of course, and usually buried in their documentation. 127.0.0.2 is pretty common.
– Michael Hampton♦
Jan 16 at 16:22
@MichaelHampton Thanks. Do you want to paste those comments into an answer so I can vote it up?
– Wayne Conrad
Jan 16 at 16:26
4
4
Each DNSBL has its own test IP addresses for this purpose.
– Michael Hampton♦
Jan 16 at 16:02
Each DNSBL has its own test IP addresses for this purpose.
– Michael Hampton♦
Jan 16 at 16:02
@MichaelHampton That's perfect, thanks! How does one go about finding the test IP addresses? I haven't found the right search recipe for this (Googling for "DNSBL test addresses", for example, just yields forms and instructions for testing addresses). I can't find anything in the spamhaus FAQ, nor spamcop's.
– Wayne Conrad
Jan 16 at 16:16
@MichaelHampton That's perfect, thanks! How does one go about finding the test IP addresses? I haven't found the right search recipe for this (Googling for "DNSBL test addresses", for example, just yields forms and instructions for testing addresses). I can't find anything in the spamhaus FAQ, nor spamcop's.
– Wayne Conrad
Jan 16 at 16:16
3
3
They're different for each DNSBL, of course, and usually buried in their documentation. 127.0.0.2 is pretty common.
– Michael Hampton♦
Jan 16 at 16:22
They're different for each DNSBL, of course, and usually buried in their documentation. 127.0.0.2 is pretty common.
– Michael Hampton♦
Jan 16 at 16:22
@MichaelHampton Thanks. Do you want to paste those comments into an answer so I can vote it up?
– Wayne Conrad
Jan 16 at 16:26
@MichaelHampton Thanks. Do you want to paste those comments into an answer so I can vote it up?
– Wayne Conrad
Jan 16 at 16:26
add a comment |
1 Answer
1
active
oldest
votes
You could use spamcop statistics to find an IP.
It give netblock in the /24
You can see here; https://www.spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
From that page after you can click the SB link, and you will have directly some IP
An example; https://talosintelligence.com/reputation_center/lookup?search=77.120.228.0%2F24
answered Jan 16 at 15:31
yagmoth555♦yagmoth555
11.6k31742
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f949369%2ffind-an-ip-that-is-known-to-be-on-a-dnsbl%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You could use spamcop statistics to find an IP.
It give netblock in the /24
You can see here; https://www.spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
From that page after you can click the SB link, and you will have directly some IP
An example; https://talosintelligence.com/reputation_center/lookup?search=77.120.228.0%2F24
answered Jan 16 at 15:31
yagmoth555♦yagmoth555
11.6k31742
add a comment |
You could use spamcop statistics to find an IP.
It give netblock in the /24
You can see here; https://www.spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
From that page after you can click the SB link, and you will have directly some IP
An example; https://talosintelligence.com/reputation_center/lookup?search=77.120.228.0%2F24
answered Jan 16 at 15:31
yagmoth555♦yagmoth555
11.6k31742
add a comment |
You could use spamcop statistics to find an IP.
It give netblock in the /24
You can see here; https://www.spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
From that page after you can click the SB link, and you will have directly some IP
An example; https://talosintelligence.com/reputation_center/lookup?search=77.120.228.0%2F24
answered Jan 16 at 15:31
yagmoth555♦yagmoth555
11.6k31742
You could use spamcop statistics to find an IP.
It give netblock in the /24
You can see here; https://www.spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
From that page after you can click the SB link, and you will have directly some IP
An example; https://talosintelligence.com/reputation_center/lookup?search=77.120.228.0%2F24
answered Jan 16 at 15:31
yagmoth555♦yagmoth555
11.6k31742
edited Jan 16 at 15:37
answered Jan 16 at 15:31
yagmoth555♦yagmoth555
11.6k31742
answered Jan 16 at 15:31
yagmoth555♦yagmoth555
11.6k31742
answered Jan 16 at 15:31
yagmoth555♦yagmoth555
11.6k31742
11.6k31742
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f949369%2ffind-an-ip-that-is-known-to-be-on-a-dnsbl%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
4
Each DNSBL has its own test IP addresses for this purpose.
– Michael Hampton♦
Jan 16 at 16:02
@MichaelHampton That's perfect, thanks! How does one go about finding the test IP addresses? I haven't found the right search recipe for this (Googling for "DNSBL test addresses", for example, just yields forms and instructions for testing addresses). I can't find anything in the spamhaus FAQ, nor spamcop's.
– Wayne Conrad
Jan 16 at 16:16
3
They're different for each DNSBL, of course, and usually buried in their documentation. 127.0.0.2 is pretty common.
– Michael Hampton♦
Jan 16 at 16:22
@MichaelHampton Thanks. Do you want to paste those comments into an answer so I can vote it up?
– Wayne Conrad
Jan 16 at 16:26