ip ban not on sources directory

romainmarcoux / malicious-ip

Aggregation of lists of malicious IP addresses, to be blocked in the WAN > LAN direction, integrated into firewalls: FortiGate, Palo Alto, pfSense, IPtables

https://www.linkedin.com/in/romainmarcoux/

88 stars 4 forks source link

ip ban not on sources directory #4

Closed PHB-fra closed 2 weeks ago

PHB-fra commented 3 weeks ago

Hi romain,

this ip 92.182.103.132 is on your file ( https://github.com/romainmarcoux/malicious-ip/blob/main/malicious-ip-by-country/full-fr-aa.txt ) 28/08/24 at 14h44 UTC+1

but a can't find it on your source : https://github.com/romainmarcoux/malicious-ip/tree/main/sources

Why this ip is on your list without source ?

Best regards,

romainmarcoux commented 3 weeks ago

In addition to the sources indicated on the README, I add IPs having carrying out illegitimate traffic on the systems of my few customers. This represents quite a few IP addresses on all the IP addresses of my aggregation. This IP address is one of the IP addresses to "weak signals" and has carried out not indexed web service scans several times.

Do you know the owner of this IP address?

PHB-fra commented 2 weeks ago

Owner of this IP is zaacom (compagny SEO Agency with botnet/crawlers).

romainmarcoux commented 2 weeks ago

Digging deeper, I see that the IP address is considered malicious on app[.]crowdsec[.]net/cti/92.182.103.132 I have no problem whitelisting the IP address but I have no information on this IP address:

The reverse DNS does not indicate any link with the Zaacom company.
No mention of this IP address on the Zaacom website and no mention on Google. Do you have any proof that the IP address belongs to Zaacom?

PHB-fra commented 2 weeks ago

hi romain,

I understand your point of view and you are right. It is up to them to make the necessary effort to not get blacklisted and to behave ethically.

just in evolution on the sources directory it is possible to have the "super-romain-filter.txt" file with what you have blacklisted in order to be compliant with the full-* files ?

How long do you keep the IP banned? (30D?)

romainmarcoux commented 2 weeks ago

This is a very good idea. I just added the source "sekio-a*.txt' (my company name). I updated the list of sources in the README. If you know someone at Zaacom, you can tell them to contact me so that I can authenticate their IP addresses and whitelist them. Thank you for helping to improve the project.

romainmarcoux commented 2 weeks ago

A person from Zaacom contacted me. I whitelisted the IP address.