To report a botnet PRIVATELY please email: [EMAIL PROTECTED] ---------- On Wed, Oct 25, 2006 at 10:54:34PM -0400, Jason Lewis wrote: > When you say you started the DB with the RIRs, what did you use? Just > IP space or owner info? all of it? > > jas
The raw data I used to seed the database is here: ftp://ftp.ripe.net/ripe/stats/RIR-Statistics-Exchange-Format.txt ftp://ftp.afrinic.net/pub/stats/afrinic/delegated-afrinic-latest ftp://ftp.apnic.net/stats/apnic/delegated-apnic-latest ftp://ftp.arin.net/pub/stats/arin/delegated-arin-latest ftp://ftp.lacnic.net/pub/stats/lacnic/delegated-lacnic-latest ftp://ftp.ripe.net/ripe/stats/delegated-ripencc-latest The data format is described in the RIR-Statistics-Exchange-Format.txt and is trivial to parse. arin|US|ipv4|64.77.224.0|4096|20020614|allocated 64.77.224.0 starts a range of 4096 hosts. I just created blank records (no connection count) and flagged them with the appropriate country. The only reason I even did this was to test my DB and it seemed a simply way to get real information in it. Jon Yarden, Senior Systems Administrator, BluegrassNet -- Those who make peaceful revolution impossible will make violent revolution inevitable. -- John F. Kennedy _______________________________________________ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server information are public and available to law enforcement upon request. http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
