Skip to content

Latest commit

 

History

History
78 lines (68 loc) · 2.12 KB

AS_Report.md

File metadata and controls

78 lines (68 loc) · 2.12 KB
Raw

DShield: Internet Storm Center

The ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers.

AS Report

Number of source IPs within the AS that sent packets detected by our sensors.

IP Address

  • Website
  • https://www.dshield.org/as.html
  • Source
  • https://www.dshield.org/asdetailsascii.html?as=4782
  • Data
  • IP Address
  • Format
  • Text
  • API/Token
  • None
  • Status
  • Ok
  • Comments
  • No comment
Sample Output of IntelMQ
{
  "feed": {
    "name": "DShield",
    "accuracy": 100.0,
    "url": "https://dshield.org/asdetailsascii.html?as=4782"
  },
  "extra": "{\"last_seen\": \"2016-07-06\", \"reports\": 151, \"targets\": 75}",
  "source": {
    "ip": "117.56.109.226",
    "asn": 4782
  },
  "time": {
    "observation": "2016-07-07T11:57:20+00:00",
    "source": "2016-07-07T07:41:20+00:00"
  },
  "raw": "MTE3LjA1Ni4xMDkuMjI2CTE1MQk3NQkJMjAxNi0wNy0wNgkyMDE2LTA3LTA3IDA3OjQxOjIw",
  "classification": {
    "type": "brute-force"
  }
}

There's not only IP information in https://www.dshield.org/asdetailsascii.html?as=4782, but also more information like:

  • First Seen
  • Last Seen

It looks like:

# asdetailsascii.html
# created: Tue, 30 Aug 2016 06:22:09 +0000#
# Source IP is 0 padded so each byte is three digits long
# Reports: number of packets received
# Targets: number of target IPs that reported packets from this source.
# First Seen: First time we saw a packet from this source
# Last Seen: Last time we saw a packet from this source
# Updated: Last time the record was updated.
#
# IPs are removed if they have not been seen in 30 days.
#
# source IP <tab> Reports <tab> Targets <tab> First Seen <tab> Last Seen <tab> Updated <CR>
117.056.109.226	131	54		2016-08-29	2016-08-29 23:04:06
061.067.077.098	64	46		2016-08-28	2016-08-28 23:40:42
211.079.148.155	1	1		2016-08-11	2016-08-16 12:36:48
# (c) SANS Inst. / DShield. some rights reserved.
# Creative Commons ShareAlike License 2.5
# http://creativecommons.org/licenses/by-nc-sa/2.5/