search

mitchellkrogza / Phishing.Database

Phishing Domains, urls websites and threats database. We use the PyFunceble testing tool to validate the status of all known Phishing domains and provide stats to reveal how many unique domains used for Phishing are still active.
MIT License
1.12k stars 255 forks source link

[BUG(?)] Reserved/Bogon IP in the list #424

Closed PeterDaveHello closed 8 months ago

PeterDaveHello commented 1 year ago

Describe the bug

Just found 240.112.0.101 in https://github.com/mitchellkrogza/Phishing.Database/blob/master/phishing-IPs-ACTIVE.txt

Maybe 240.112.0.101 shouldn't be in the database because 240.0.0.0/4 is reserved for future use?

Not sure if it's a special situation when the IP was recorded, but the IP can't be described in many different dabases, even the geolocation database, which is very special I think.

Reference:

funilrys commented 1 year ago

This one is probably a bug cause I only find 240.112.0.101.static.digitalpacific.com.au

PeterDaveHello commented 1 year ago

240.112.0.101.static.digitalpacific.com.au resolved to 101.0.112.240 then 🤣 (sometimes reversed order when the IP address is in the domain name)

PeterDaveHello commented 1 year ago

BTW, 101.0.112.240 actually existing in some databases:

https://www.virustotal.com/gui/ip-address/101.0.112.240 image

I also found it in another commercial database that not listed on VirusTotal.

VirusTotal
VirusTotal
funilrys commented 1 year ago

@PeterDaveHello interesting. Let's whitelist that single IP and I'll take care of the IP range within the PyFunceble project.

PeterDaveHello commented 1 year ago

Okay, cool! That could help to find out abnormal data and fix them to the correct one earlier 👍

funilrys commented 1 year ago

FYI @PeterDaveHello:

Upon checking, I remember that Python already implements those through the std ipaddress.IPv4Address or ipaddress.IPv6Address classes. Therefore, PyFunceble should already be able to handle such IP ranges. In fact, PyFunceble already refuses to check such IPs.

So, this is a local issue with this project script... Let me keep this open as I'll probably do some refactoring next year.

Thank you for your time, feedback, and support @PeterDaveHello.