attackteamfamily / blackip

沙箱IP、网络测绘ip、全网扫描ip等等收集

黑IP收集(攻击向)

项目简介

在日益增强的攻防对抗中，全网测绘、云沙箱、动态样本分析等等防御项的系统对TeamServer展开了疯狂围剿。此项目旨在收集整理这些IP用于对抗分析。

数据

ACL	Blocked IP	Line Num	File Size	description
blackip.txt	238745164	1556	22k	黑ip合集
sandbox.txt	65343	320	4.4k	云沙箱
redwarden_ip.txt	238744726	1143	16k	RedWarden项目收集
cs_scan_ip.txt	206	206	2k	扫描CobaltStrike的恶意IP合集

使用

git clone https://github.com/AttackTeamFamily/blackip.git
cd blackip
bash start.sh

贡献说明

希望公鸡队小伙伴们，积极贡献ip。贡献方式：

• 提交Issues
• 提交格式：

简介：全网测绘ip|云沙箱ip|漏扫ip|......
IP列表：
1.1.1.1/24
2.2.2.2
3.3.3.3

• 量大可以直接上传压缩包

贡献致谢

• @timwhitez
• RedWarden项目
• @Winck
• @waterrr

blackip's Issues

扫描CobaltStrike的恶意IP合集

原理

CobaltStrike上线默认会发送CheckSum8验证，某些扫描器会根据此规则爆破CS服务器。

数据来源

分布在世界各地的多台服务器自动监控并定期汇总。

数据准确性

目前只收集主动探测CheckSum8的黑IP，证书/端口特征被标记不在本项目考虑范围之内。 通过特定算法实现99.9%的准确性，精准标记恶意扫描的IP。

项目地址：https://github.com/waterrr/BlackIP
IP列表：https://github.com/waterrr/BlackIP/blob/main/ip.txt

我收集的ip【改成json后缀导入到火绒黑名单就可以了】

{
"ver":"5.0",
"tag":"ipblacklist",
"data":[
{
"id":23,
"raddr":"194.154.78.220",
"tmp_field_sel":true,
"memo":""
},
{
"id":40,
"raddr":"194.154.78.252",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":12,
"raddr":"213.33.190.152",
"tmp_field_sel":true,
"memo":""
},
{
"id":14,
"raddr":"213.33.190.245",
"tmp_field_sel":true,
"memo":""
},
{
"id":16,
"raddr":"217.114.218.24",
"tmp_field_sel":true,
"memo":""
},
{
"id":24,
"raddr":"66.129.105.52",
"tmp_field_sel":true,
"memo":""
},
{
"id":9,
"raddr":"79.104.209.204",
"tmp_field_sel":true,
"memo":""
},
{
"id":15,
"raddr":"89.208.29.72",
"tmp_field_sel":true,
"memo":""
},
{
"id":31,
"raddr":"95.208.29.82",
"tmp_field_sel":true,
"memo":""
},
{
"id":49,
"raddr":"95.25.0.0-95.25.255.255",
"tmp_field_sel":true,
"memo":""
},
{
"id":50,
"raddr":"95.25.0.1/16",
"tmp_field_sel":true,
"memo":"c2黑名单"
},
{
"id":47,
"raddr":"95.25.103.122",
"tmp_field_sel":true,
"memo":""
},
{
"id":4,
"raddr":"95.25.191.183",
"tmp_field_sel":true,
"memo":"沙盒"
},
{
"id":25,
"raddr":"95.25.204.122",
"tmp_field_sel":true,
"memo":""
},
{
"id":34,
"raddr":"95.25.204.192",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":6,
"raddr":"95.25.204.253",
"tmp_field_sel":true,
"memo":""
},
{
"id":21,
"raddr":"95.25.204.43",
"tmp_field_sel":true,
"memo":""
},
{
"id":41,
"raddr":"95.25.204.9",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":10,
"raddr":"95.25.210.167",
"tmp_field_sel":true,
"memo":""
},
{
"id":43,
"raddr":"95.25.210.179",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":37,
"raddr":"95.25.211.162",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":36,
"raddr":"95.25.211.209",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":17,
"raddr":"95.25.211.215",
"tmp_field_sel":true,
"memo":""
},
{
"id":33,
"raddr":"95.25.215.58",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":7,
"raddr":"95.25.215.92",
"tmp_field_sel":true,
"memo":""
},
{
"id":48,
"raddr":"95.25.32.184",
"tmp_field_sel":true,
"memo":""
},
{
"id":46,
"raddr":"95.25.35.59",
"tmp_field_sel":true,
"memo":""
},
{
"id":35,
"raddr":"95.25.46.100",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":51,
"raddr":"95.26.0.0/16",
"tmp_field_sel":true,
"memo":"c2黑名单"
},
{
"id":39,
"raddr":"95.26.114.140",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":5,
"raddr":"95.26.134.64",
"tmp_field_sel":true,
"memo":"沙盒"
},
{
"id":8,
"raddr":"95.26.150.218",
"tmp_field_sel":true,
"memo":""
},
{
"id":42,
"raddr":"95.26.159.155",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":45,
"raddr":"95.26.165.2",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":30,
"raddr":"95.26.177.78",
"tmp_field_sel":true,
"memo":""
},
{
"id":20,
"raddr":"95.26.195.8",
"tmp_field_sel":true,
"memo":""
},
{
"id":28,
"raddr":"95.26.203.14",
"tmp_field_sel":true,
"memo":""
},
{
"id":27,
"raddr":"95.26.203.43",
"tmp_field_sel":true,
"memo":""
},
{
"id":13,
"raddr":"95.26.210.66",
"tmp_field_sel":true,
"memo":""
},
{
"id":44,
"raddr":"95.26.216.188",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":32,
"raddr":"95.26.217.129",
"tmp_field_sel":true,
"memo":""
},
{
"id":38,
"raddr":"95.26.217.231",
"tmp_field_sel":true,
"memo":"沙盒黑名单"
},
{
"id":29,
"raddr":"95.26.237.2",
"tmp_field_sel":true,
"memo":""
},
{
"id":11,
"raddr":"95.26.58.109",
"tmp_field_sel":true,
"memo":""
},
{
"id":19,
"raddr":"95.26.59.201",
"tmp_field_sel":true,
"memo":""
},
{
"id":3,
"raddr":"95.26.65.64",
"tmp_field_sel":true,
"memo":"沙盒"
},
{
"id":26,
"raddr":"95.26.81.150",
"tmp_field_sel":true,
"memo":""
},
{
"id":18,
"raddr":"95.26.95.201",
"tmp_field_sel":true,
"memo":""
},
{
"id":22,
"raddr":"95.26.97.195",
"tmp_field_sel":true,
"memo":""
}
]
}

云沙箱信息抓取项目

详情及原理见文章：https://mp.weixin.qq.com/s/IFv1zJfTvaUKJ3Y0y8_VvA

抓取了将近大半个月，数据见csv文件（有重复项）

result.csv