Some resources for some.

[Dimitri]

While passing, I thought of dropping some links which might help some.

To know the ASN to which an IP belongs:
[iptoasn.com...]

There are many sites proposing the same, but, this one also proposes a downloadable file (public domain) with all the ASN and IP ranges (updated hourly):
[iptoasn.com...]

List of AWS IP ranges :
[ip-ranges.amazonaws.com...]

List of TOR exit nodes (has to be retrieved frequently)
[check.torproject.org...]

You can get the list of IP ranges used by Google Cloud with the method listed here (+script example):
[cloud.google.com...]

And data from the different RIR :

ftp://ftp.arin.net/pub/stats/arin/delegated-arin-extended-latest
ftp://ftp.ripe.net/ripe/stats/delegated-ripencc-latest
ftp://ftp.apnic.net/pub/stats/apnic/delegated-apnic-latest
ftp://ftp.lacnic.net/pub/stats/lacnic/delegated-lacnic-latest
ftp://ftp.afrinic.net/pub/stats/afrinic/delegated-afrinic-latest

Country information are not always accurate for not saying totally wrong, because ASN are rearranging them all the time, however, the accuracy is not that bad, for what it is.

Cheers,

[tangor]

Tool boxes need tools!

Thanks for the resources. :)

[blend27]

Thanks for the resources Dmitri. DATA Is Good, ALWAYS(gimmi mo, gimmi mo, gimmi mo - Vikings [youtube.com...] )!

Data from ftp.ripe.net is extremely compact but still usable and sometimes very helpful, I mean take this for example:

Helpful part is that I could nuke entire /22 based on:

ripencc|RO|ipv4|5.253.204.0|1024|20190211|allocated

^^ - It says that on Feb 11 of 2019 this IPV4 range, staring with 5.253.204.0 contains 1024 ips within, was allocated to Romania in RIPEICC.

1. Take 5.253.204.0 and convert it to integer = 100518912
2. Take 100518912 and add 1024 and then convert it back to IP = 5.253.207.255.
3. 1024 translates to /22 subnet.

so it would seem that it belongs to Romania all together.

M247 Europe
5.253.204.0 - 5.253.207.255
5.253.204.0/22

But other things to consider(not in that DB):
5.253.204.0/24 - Luxembourg - M247 Luxembourg NOC
5.253.205.0/25 - Belgium - M247-BRUSSELS-SERVERS
5.253.206.0/26 - Poland - M247 LTD Warsaw Infrastructure
5.253.207.0/24 - Austria -M247 LTD Vienna Infrastructure

See what I mean?

When I need more info(IP Gets caught by my firewall) and based on RIR(region) from the record above I usually use/parse RDAP JSon Data from:

arin - rdap.arin.net/registry/ip/#ip#
ripencc - rest.db.ripe.net/search.json?query-string=#ip#
afrinic - rdap.afrinic.net/rdap/ip/#ip#"
apnic - wq.apnic.net/query?searchtext=#ip#
lacnic - rdap.lacnic.net/rdap/ip/#ip#

@tangor - Tool boxes need tools!

All the info ne weed :) - rest.db.ripe.net/search.json?query-string=5.253.205.0

[JorgeV]

Hello,

Thank you for the links.

You can also consider this

An open source list of ASNs known to belong to cloud, managed hosting, and colo facilities.
[github.com...]

However, among this list, there are some ASN which are legitimate ISP, so it's not to be taken right away, but it can be a good starting point, to build your own blocking list, or feed your investigations.

[Jonesy]

And, you can consider this.

"Daily feed of bad IPs (with blacklist hit scores) "
[github.com ]

Daily I collect the ip list of Bad Actors from GitHub and merge it into
my pf (FreeBSD) block list.
There are 8 levels of lists, from 1.txt being the largest at 2 MB to
8.txt at 670 bytes (as of 08-Feb-20.) The large list contains IP's
that have been reported for abuse at least one or more times.
The short list contains IP's that have been reported by many, many
"abusees". :-)

Myself, I use one of the middle text files -- currently 3.txt.

[Dimitri]

Thank you @JorgeV and @Jonesy.

Just a reminder , do not take list like that straight. Always have a way to verify / crosscheck the data, for not banning or blocking legitimate IPs.