ArditDulemata / blacklist-from-honeypot

Blacklist of ~1 year of honeypot unique IP's records generated by malicious activity

blacklist-from-honeypot

Blacklist of ~1 year of honeypot unique IP's records generated by malicious activity The blacklist contains around ~42+k unique IP's either targeting servers or web applications, most are routine automated bot attacks.

detailed-blacklist.txt

netcat whois.cymru.com 43 < unique-blacklist.txt | grep -v "AS Name" > detailed-list.txt

## OR BETTER FORMATTED INFO

nohup sh -c 'for i in $(cat old-blacklist.txt); do whois -h whois.cymru.com " -v $i "; done > get-details.txt 2>&1' &

Making use of the blacklist (example)

iptables -I INPUT -m geoip --src-cc RU,CN,IN,US,BR,TW,KR,NG,UA,TR,IR,IL,RS,PL,VN -j DROP

Other resources

Country codes : http://www.ip2country.net/ip2country/country_code.html

GoogleBot Public IPs : https://developers.google.com/search/apis/ipranges/googlebot.json

DuckDuckGo Public IPs : https://help.duckduckgo.com/duckduckgo-help-pages/results/duckduckbot/