Latest Posts

Bulk IP Reputation Check using Security Websites and Open Source Scripts

This topic has been haunted in my mind for quite a while. As an information security guy, we got tons of reports about end point activities. One of them is the website ip or urls they were accessing. A typical network abnormal behaviour for an infected or compromised end point is huge amount of accessing malicious ip or bad reputation websites.

For many investigations, I can generate an ip list but how to quickly find out the ip reputation is a challenge for me.

That is why I am writing this post today. I am still checking those websites or scripts, hopefully I can get a good understanding then comes out my own script to do this job.

Online Service -

Here are some good online resources: - Simple IP and Domain Reputation Tracking System - Mostly focus on email reputation. It will use following online services to do a search;

  • SpamCop
  • Barracuda
  • SenderSscore
  • SenderBase

Run Scripts

[[email protected] ~]# yum install git
[[email protected] ~]# rm -r -d -f TekDefense-Automater/
[[email protected] ~]# git clone
Cloning into 'TekDefense-Automater'...
remote: Enumerating objects: 260, done.
remote: Total 260 (delta 0), reused 0 (delta 0), pack-reused 260
Receiving objects: 100% (260/260), 136.82 KiB | 0 bytes/s, done.
Resolving deltas: 100% (143/143), done.
[[email protected] ~]# ls
[[email protected] ~]# cd TekDefense-Automater/
[[email protected] TekDefense-Automater]# ls  tekdefense.xml
docs          LICENSE   sites.xml

[[email protected] TekDefense-Automater]# python -h

[[email protected] TekDefense-Automater]# python test.txt -o test.out -c test.csv -w test.html -d 10

YouTube Video



  1. Please help to fix this error, do let me know what parameter to be change.

    [email protected]:~/TekDefense-Automater# python
    Traceback (most recent call last):
    File "", line 40, in
    from siteinfo import SiteFacade, Site
    File "/root/TekDefense-Automater/", line 28, in
    import requests
    ImportError: No module named requests

  2. module "Requests" is not installed by default by python. Follow this to install it.