1

I am configuring Zabbix to check my IPs against several DNSBLs. My IPs are currently not blacklisted. My monitoring needs to be tested, to verify that it will alert properly if one of my IPs does become blacklisted. How can I obtain, for testing, a known bad IP, one that is on a DNSBL?

Details

I've searched for published blacklists, but haven't found any. I'm guessing that publishing the lists would aid spammers, or have other bad side-effects.

Zabbix will call a Ruby script. That script will probably just shell out to rblcheck, since the lists it checks seem like a good start:

$ rblcheck 8.8.8.8
8.8.8.8 not listed by sbl.spamhaus.org
8.8.8.8 not listed by xbl.spamhaus.org
8.8.8.8 not listed by pbl.spamhaus.org
8.8.8.8 not listed by bl.spamcop.net
8.8.8.8 not listed by psbl.surriel.com
8.8.8.8 not listed by dul.dnsbl.sorbs.net

The DNSBLs that rblcheck uses is configurable. I can add or remove DNSBLs as needed, either permanently, or for testing.

Wayne Conrad
  • 675
  • 1
  • 7
  • 20
  • 4
    Each DNSBL has its own test IP addresses for this purpose. – Michael Hampton Jan 16 '19 at 16:02
  • @MichaelHampton That's perfect, thanks! How does one go about finding the test IP addresses? I haven't found the right search recipe for this (Googling for "DNSBL test addresses", for example, just yields forms and instructions for testing addresses). I can't find anything in the spamhaus FAQ, nor spamcop's. – Wayne Conrad Jan 16 '19 at 16:16
  • 3
    They're different for each DNSBL, of course, and usually buried in their documentation. 127.0.0.2 is pretty common. – Michael Hampton Jan 16 '19 at 16:22
  • @MichaelHampton Thanks. Do you want to paste those comments into an answer so I can vote it up? – Wayne Conrad Jan 16 '19 at 16:26

1 Answers1

4

You could use spamcop statistics to find an IP.

It give netblock in the /24

You can see here; https://www.spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt

From that page after you can click the SB link, and you will have directly some IP

An example; https://talosintelligence.com/reputation_center/lookup?search=77.120.228.0%2F24

enter image description here

yagmoth555
  • 16,758
  • 4
  • 29
  • 50