Take the 2-minute tour ×

I know of many companies that will sell ability to lookup IP/URI reputation. Be it DNSBL, json/*, returnpath, threatstop, surbl, ..., will let me perform lookups for a reasonable fee but, in case of this particular project, the lookup introduces unacceptable latency.

Do you know of anyone who offers a dataset that is meant for local integration and a periodic update service? I understand that the update lag will make the local database permanently out of date, but this is a tradeoff I have to accept.

share|improve this question
I have a question - 2 really: what do you mean by IP reputation? And more importantly, what is your end goal, is it may be that we can provide alternative answers - as in, what services exist to fulfil the same goals. –  Rory Alsop Oct 14 '11 at 14:05
IP reputation would be a metric describing past activity from an IP address or prefix. Is it known to send spam, participate in a botnet, etc. I want the data to be available locally for quick lookups/scoring(/maybe even blocking) on a proxy with a lot of traffic. –  Mike Oct 14 '11 at 14:53
@Mike - This sounds like a great deal like those magic beans Jack bought. –  Ramhound Oct 14 '11 at 15:09
@Ramhound - relax, I am not selling anything. DNSBL lookup adds 30ms in a good case, and I do not have the data if the partner/supplier goes away for whatever reason. –  Mike Oct 14 '11 at 15:55
add comment

4 Answers

Spamhaus.org do this for free.

The other main companies that do this (trusteer, markmonitor etc) do provide feeds of various types. Well worth asking them what type of feed you can get from them. Of course, they will all be cost options.

share|improve this answer
add comment

Webroot does provide IP/URL reputation for proactive threat detection . http://www.webroot.com/En_US/partners-strategic-alliances.html

share|improve this answer
add comment

Are you asking if the EULA from each of these providers permit the customer to store and aggregate the data long-term.

Team Cymru sells their malware URLs and Botnet CC (reseller SecurityZones) but the aggregation has to be done by the customer.

Websense and Sophos both have IP reputation products, but as you pointed out, their BL are stored in the cloud and not available to the customer to download.

A concern on the part of the vendors is whether you can aggregate and resell their data. How will you assure them that their data cannot be extracted from your service/device and re-used?

share|improve this answer
add comment

Symantec offers DeepSight, which provides real-time web services to access IP Reputation, Domain/URL Reputation, as well as malware and vulnerability data.

share|improve this answer
add comment

Your Answer


