Ask IFIN: AS Reputation Lookup?

General
, ,
1

Following our own advice for IOC distillation, I’m curious if anyone has go-to resources for AS reputation tracking? It seems like VirusTotal should be able to do this in theory, but almost nobody votes on AS entries. I’d love to know what you have for this.

Edit: Eh nevermind on VirusTotal. you can look up the start of a subnet for a prefix in VT, but that’s it.

2

Reputation tracking I’m not sure about how this process usually goes, but from my networking days I do know of a tool that might be able to help in some circumstances.

BGPlay is a very old tool that gives historical data about BGP peering in a graphical representation. You give it an AS number and it will query the RIPE database for all of the BGP peering data within the timeframe you selected and will then show you how the peering data changed over time giving you insights into specific AS routing information, if/when AS numbers get transferred, or even watching whole networks go down.

Again, it’s not a complete solution but it can be a helpful tool for piecing together malicious AS numbers to see who they are peering with, or how their networks change over time.

[edit] Here is a web-based version of the same application: BGPlay BGP routing visualization