ALPHANET Blackholes: blackholes.alphanet.ch

Introduction

blackholes.alphanet.ch hosts a blacklist for IPv4 addresses that behaved badly in the past.

This is a volunteer project which does not state nor imply any warranty or fitness for whatever purpose, and explicitely excludes any warranty.

The blacklist is available as:

• a RBL DNS list, which is not complete for current technical reasons
• a file to download (on request), containing IP address and CIDR subnets, which is complete -- we also have at your disposal a simple Linux ipset/iptables scripts which blocks ingress or also egress traffic, at your option
• graphically at attacks.alphanet.ch

We use this blacklist to block access to our services through our in-house IPS which mostly acts at layer 3 (IP firewalling) or is used in some applications (notably scores for the e-mail anti-spam spamassassin) and we know that some people outside ALPHANET use it, too.

IPs or whole subnets gets added to that list when

• they behave badly (we operate spam traps and quite a few honeypots on various ASes and of course also real services whose logs are centrally parsed)
• we are informed of bad behaviour by third parties

We often report break-in attempts to AbuseIPdb, too. However, most of the times we report general categories in order not to give too much information to attackers where our honeypots are.

We usually remove them automatically after a week, as long as the address is no longer actively attacking. It may however take longer sometimes, for various reasons.

Please unblock me!

Being on a blocklist usually has a reason: you should thoroughly check what your systems are doing: are they sending out spam? are they scanning services?

We suggest that you check where else your IP address might be blocked, for example through MultiRBL, AbuseIPdb, or Cisco Talos. For MultiRBL, each of the block list has normally a contact address.

We will gladly unblock you, as long as the IP address or range you want to be unblocked is not actively attacking.

Our contact address is: blackholes@alphanet.ch

-- MarcSCHAEFER - 13 Sep 2024