An IP intelligence database is a list of IP addresses with questionable reputations. IP addresses gain a questionable reputation and are added to the database as a result of having performed exploits or attacks, or these addresses might represent proxy servers, scanners, or systems that have been infected. You can prevent system attacks by excluding traffic from malicious IP addresses. The IP Intelligence database is maintained online by a third party.
The BIG-IP system can connect to an IP intelligence database, download the contents, and automatically keep the database up to date. You use iRules to instruct the system on how to use IP address intelligence information. For example, iRules can instruct the system to verify the reputation of and log the originating IP address of all requests.
You can also use the IP address intelligence information within security policies in the Application Security Manager to log or block requests from IP addresses with questionable reputations.
Along with the IP address, the IP intelligence database stores the category that explains the reason that the IP address is considered untrustworthy.
|Botnets||IP addresses of computers that are infected with malicious software (Botnet Command and Control channels, and infected zombie machines) and are controlled as a group by a Bot master, and are now part of a botnet. Hackers can exploit botnets to send spam messages, launch various attacks, or cause target systems to behave in other unpredictable ways.|
|Cloud Provider Networks||IP addresses and networks that are used by cloud providers.|
|Denial-of-Service||IP addresses that have launched denial-of-service (DoS) attacks, distributed denial-of-service (DDoS) attacks, anomalous SYN flood attacks, or anomalous traffic detection. These attacks are usually requests for legitimate services, but occur at such a fast rate that targeted systems cannot respond quickly enough and become bogged down or unable to service legitimate clients.|
|Illegal Web sites||IP addresses that contain criminally obscene or potentially criminal internet copyright and intellectual property violations.|
|Infected Sources||Active IP addresses that issue HTTP requests with a low reputation index score, or that are known malicious web sites offering or distributing malware, shell code, rootkits, worms, or viruses.|
|Phishing||IP addresses that host phishing sites, and other kinds of fraud activities, such as ad click fraud or gaming fraud.|
|Proxy/Anonymous Proxies||IP addresses that are associated with web proxies that shield the originator's IP address (such as proxy and anonymization services). This category also includes TOR anonymizer addresses.|
|Scanners||IP addresses that are involved in reconnaissance, such as probes, host scan, domain scan, and password brute force, typically to identify vulnerabilities for later exploits.|
|Spam Sources||IP addresses that are known to distribute large amounts of spam email by tunneling spam messages through proxy, anomalous SMTP activities, and forum spam activities.|
|Web Attacks||IP addresses involved in cross site scripting, iFrame injection, SQL injection, cross domain injection, or domain password brute force.|
|Windows Exploits||Active IP addresses that have exercised various exploits against Windows resources by offering or distributing malware, shell code, rootkits, worms, or viruses using browsers, programs, downloaded files, scripts, or operating system vulnerabilities.|