Detecting suspicious malicious IP lookups and blocking them quickly is one of the most important tasks for a cyber security team. There are several ways to do this: using specifically designed software, lookup and reputation tools or relying on a strong firewall.

Malicious IP Lookup

There are many reasons why an IP address could get classified as malicious, such as launching a denial of service attack, being connected to devices that have been swarmed with malware, dropping malware or hosting phishing websites. However, the more an IP is seen doing such activities and the more it shows behavior patterns that are associated with malicious activity, the more likely its reputation is to deteriorate and be deemed suspicious.

This can result in the IP being blocked and blacklisted by several different databases that monitor spam and unwanted activity on the Internet, such as Spamhaus, Google Postmaster Tools, or Microsoft SNDS. This means that the suspicious IP can no longer send or receive emails and will not be able to connect to sites.

With Webroot BrightCloud’s dynamically scored IP Reputation Service, you can block these threats before they reach your network and devices by using real-time consortium data that cuts through the reliance on static lists and provides an analytical score on an IP address in both its IPv4 and IPv6 format. The tool reveals all the key details such as associated rDNS, ASN, timezone and full risk analysis report. It also scans in real time to detect a proxy, VPN or TOR connection and checks whether an IP is known to be involved in a high risk activity such as SPAM or fraud.