dfirsec / blacklist_check

Simple script to download and query IP address reputation lists from various sources.

IP Blacklist Check

Python script that downloads IP reputation blacklists from various sources and queries an IP address, or multiple IPs, against those lists. Utilizes the FreeGeopIP Live service for IP geolocation - ref: https://freegeoip.live/

API Key (add to settings.ini file) required for the following:

• AbuseIPDB
• Shodan
• VirusTotal

Installation

git clone https://github.com/dfirsec/blacklist_check.git
cd blacklist_check
pip install -r requirements.txt

Usage

        ____  __           __   ___      __     ________              __
       / __ )/ /___ ______/ /__/ (_)____/ /_   / ____/ /_  ___  _____/ /__
      / __  / / __ `/ ___/ //_/ / / ___/ __/  / /   / __ \/ _ \/ ___/ //_/
     / /_/ / / /_/ / /__/ ,< / / (__  ) /_   / /___/ / / /  __/ /__/ ,<
    /_____/_/\__,_/\___/_/|_/_/_/____/\__/   \____/_/ /_/\___/\___/_/|_|

usage: blacklist_check.py [-h] [-t [threads]] [-v] [-a] [-s] [-u | -fu | -sh] [-q query [query ...] | -f file | -i | -r]

IP Blacklist Check

optional arguments:
  -h, --help            show this help message and exit
  -t [threads]          threads for rbl check (default 25, max 50)
  -v                    check virustotal for ip info
  -a                    check abuseipdb for ip info
  -s                    check shodan for ip info
  -u                    update blacklist feeds
  -fu                   force update of all feeds
  -sh                   show blacklist feeds
  -q query [query ...]  query a single or multiple ip addrs
  -f file               query a list of ip addresses from file
  -i                    insert a new blacklist feed
  -r                    remove an existing blacklist feed

Example Run

blacklist_check's Issues

Fake DNSBL: nszones.com

According to spamhaus, nszones is a fake/ scam DNSBL: https://www.spamhaus.org/organization/statement/8/
You might want to remove it from your list.

doesnt work lot of url

Traceback (most recent call last):
File "/root/blacklist_check/utils/main_worker.py", line 199, in fetch
resp.raise_for_status()
File "/usr/local/lib/python3.6/site-packages/httpx/_models.py", line 1510, in raise_for_status
raise HTTPStatusError(message, request=request, response=self)
httpx.HTTPStatusError: Server error '503 Service Temporarily Unavailable' for url 'https://www.threatcrowd.org/feeds/ips.txt'
For more information check: https://httpstatuses.com/503

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "blacklist_check.py", line 239, in
main()
File "blacklist_check.py", line 104, in main
pbl.update_list()
File "/root/blacklist_check/utils/main_worker.py", line 256, in update_list
bl_dict["Blacklists"][name] = self.get_feeds(url)
File "/root/blacklist_check/utils/main_worker.py", line 212, in get_feeds
results = trio.run(self.fetch, feed)
File "/usr/local/lib/python3.6/site-packages/trio/_core/_run.py", line 1932, in run
raise runner.main_task_outcome.error
File "/root/blacklist_check/utils/main_worker.py", line 205, in fetch
print(f" {Tc.error}{Tc.dl_error} {Tc.gray}{url}{Tc.rst}")
File "/usr/local/lib/python3.6/site-packages/colorama/ansitowin32.py", line 47, in write
self.__convertor.write(text)
File "/usr/local/lib/python3.6/site-packages/colorama/ansitowin32.py", line 172, in write
self.wrapped.write(text)
UnicodeEncodeError: 'ascii' codec can't encode character '\u2716' in position 9: ordinal not in range(128)