2026-09-12

Hosts seen attacking, as their own signal

is_attack_source and attack_source name single hosts seen attacking honeypots and sensors in the last days, from three published lists refreshed hourly; a hit weighs 50, apart from the netblock-level blocklists, and flags a monitored address.

Every IP answer carries is_attack_source and attack_source: whether an attack-source list names the address, and which one. The lists are Emerging Threats' compromised-hosts list, the CINS Army list and blocklist.de, and they name single hosts seen attacking honeypots and sensors in the last days rather than netblocks or operators, which is why they sit beside is_blocklisted rather than inside it. The flag is tri-state like every other, and the three lists cover IPv4 today.
A hit weighs 50, between your own reports at 60 and a datacenter range at 40, because an entry says a machine was misbehaving this week, not that a netblock belongs to a criminal operation. risk_signals carries it as attack_source with the dataset attack-source-lists, the bulk CSV gained the two columns after blocklist, and a finished bulk run's summary counts how many rows carried it.
The lists are refreshed hourly, like the botnet list and the Tor exits, and a monitored address that newly appears on one is flagged attack_source and named in the alert as "seen attacking, listed by" the list.
The publishers' terms, as published on 12 September 2026 and repeated on the product page: Emerging Threats' open ruleset, which its compromised-hosts rules are built from, is BSD-licensed and is credited as that licence asks; CINS says its Army list is "provided as a simple text file, with which you can parse and use in any way you see fit"; blocklist.de calls itself a free and voluntary service and offers its export files "as they are", with no licence text.

markdown version: /changelog/2026-09-12-attack-source-lists.md · atom feed: /changelog.atom

All releases