[94954] in North American Network Operators' Group
RBL for bots?
daemon@ATHENA.MIT.EDU (Drew Weaver)
Thu Feb 15 11:22:27 2007
Date: Thu, 15 Feb 2007 11:30:34 -0500
From: "Drew Weaver" <drew.weaver@thenap.com>
To: <nanog@merit.edu>
Errors-To: owner-nanog@merit.edu
This is a multi-part message in MIME format.
------_=_NextPart_001_01C7511E.9E401BBE
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
Has anyone created an RBL, much like (possibly) the BOGON list which
includes the IP addresses of hosts which seem to be "infected" and are
attempting to brute-force SSH/HTTP, etc?
=20
It would be fairly easy to setup a dozen or more honeypots and examine
the logs in order to create an initial list.
=20
Anyone know of anything like this?
=20
-Drew
=20
------_=_NextPart_001_01C7511E.9E401BBE
Content-Type: text/html;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.5730.11" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D176372816-15022007><FONT face=3DArial =
size=3D2> =20
Has anyone created an RBL, much like (possibly) the BOGON list which =
includes=20
the IP addresses of hosts which seem to be "infected" and are attempting =
to=20
brute-force SSH/HTTP, etc?</FONT></SPAN></DIV>
<DIV><SPAN class=3D176372816-15022007><FONT face=3DArial=20
size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D176372816-15022007><FONT face=3DArial size=3D2>It =
would be fairly=20
easy to setup a dozen or more honeypots and examine the logs in order to =
create=20
an initial list.</FONT></SPAN></DIV>
<DIV><SPAN class=3D176372816-15022007><FONT face=3DArial=20
size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D176372816-15022007><FONT face=3DArial size=3D2>Anyone =
know of=20
anything like this?</FONT></SPAN></DIV>
<DIV><SPAN class=3D176372816-15022007><FONT face=3DArial=20
size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D176372816-15022007><FONT face=3DArial=20
size=3D2>-Drew</FONT></SPAN></DIV>
<DIV><SPAN class=3D176372816-15022007></SPAN> </DIV></BODY></HTML>
------_=_NextPart_001_01C7511E.9E401BBE--
