1

I am configuring Zabbix to check my IPs against several DNSBLs. My IPs are currently not blacklisted. My monitoring needs to be tested, to verify that it will alert properly if one of my IPs does become blacklisted. How can I obtain, for testing, a known bad IP, one that is on a DNSBL?

Details

I've searched for published blacklists, but haven't found any. I'm guessing that publishing the lists would aid spammers, or have other bad side-effects.

Zabbix will call a Ruby script. That script will probably just shell out to rblcheck, since the lists it checks seem like a good start:

$ rblcheck 8.8.8.8
8.8.8.8 not listed by sbl.spamhaus.org
8.8.8.8 not listed by xbl.spamhaus.org
8.8.8.8 not listed by pbl.spamhaus.org
8.8.8.8 not listed by bl.spamcop.net
8.8.8.8 not listed by psbl.surriel.com
8.8.8.8 not listed by dul.dnsbl.sorbs.net

The DNSBLs that rblcheck uses is configurable. I can add or remove DNSBLs as needed, either permanently, or for testing.

  • 4
    Each DNSBL has its own test IP addresses for this purpose. – Michael Hampton Jan 16 at 16:02
  • @MichaelHampton That's perfect, thanks! How does one go about finding the test IP addresses? I haven't found the right search recipe for this (Googling for "DNSBL test addresses", for example, just yields forms and instructions for testing addresses). I can't find anything in the spamhaus FAQ, nor spamcop's. – Wayne Conrad Jan 16 at 16:16
  • 3
    They're different for each DNSBL, of course, and usually buried in their documentation. 127.0.0.2 is pretty common. – Michael Hampton Jan 16 at 16:22
  • @MichaelHampton Thanks. Do you want to paste those comments into an answer so I can vote it up? – Wayne Conrad Jan 16 at 16:26
4

You could use spamcop statistics to find an IP.

It give netblock in the /24

You can see here; https://www.spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt

From that page after you can click the SB link, and you will have directly some IP

An example; https://talosintelligence.com/reputation_center/lookup?search=77.120.228.0%2F24

enter image description here

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.