Way back in 2018 I posted a diary describing how I have been using the Neutrino API to do IP reputation checks. In the subsequent 2+ years that python script has evolved some which hopefully I can go over at some point in the future, but for now I would like to show you the most recent capability I added into that script.
As most of you know, The Spamhaus Project has been forefront in the fight against Spam for over 20 years. But did you know they provide a DNS query based api that can be used, for low volume non-commercial use, to query all of the Spamhaus blocklists at once. The interface is zen.spamhaus.org. Because it is DNS query based you can perform the query using nslookup or dig and the returned IP address is the return code.
For example say we want to test whether or not 126.96.36.199 is on a Spamhaus list. First because the interface takes a DNS query we would need to reverse the IP address and then add .zen.spamhaus.org. i.e. the DNS query would look like 188.8.131.52.zen.spamhaus.org
or with dig...
As you can see in both cases the DNS response returned two results. 127.0.0.2 and 127.0.0.9. In practicality just the fact that you receive return codes tells you that this IP is on Spamhaus's lists, and has recently been involved in naughty behavior. However to know which Spamhaus lists in particular the return codes apply to:
If you query an IP which is not on any Spamhaus lists the result will be Non-Existent Domain (NXDOMAIN)
I have created a Python script which performs this lookup and have integrated this code into my ip reputation script.
The script does have a bug. The socket.gethostbyname() function only returns one result, so is returning an incomplete result for IPs which are on multiple Spamhaus lists. Since usually all I am looking for is if the IP is on any list I have never bothered to research how to fix this bug.
For those of you who are interested, the script is below. As usual, I only build these scripts for my own use/research, so a real python programmer could very likely code something better.
-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - Twitter:namedeplume (Protected)
Apr 17th 2021
Apr 17th 2021
3 weeks ago