AbuseBox: Open-Source Tool Monitors IP Blacklists, DNS, SSL, and Email Records
AbuseBox is a new open-source tool designed to monitor IP addresses and domains against over 60 DNS blacklists, retrieve reputation scores, and inspect critical records, alerting users to changes.
A new open-source tool named AbuseBox has been released, offering a comprehensive solution for monitoring IP addresses and domains against a wide array of security indicators. The tool aggregates checks against more than 60 DNS blacklists, fetches reputation scores from AbuseIPDB, and scrutinizes DNS, SSL, and email authentication records. Its primary function is to alert users when any of these monitored parameters change, providing a centralized dashboard for security oversight.
The dashboard consolidates critical attention points into a single view, including blacklist listings, expiring SSL certificates and domains, and server downtime. This unified approach eliminates the need for manual, one-at-a-time checks for blacklist lookups, certificate validity, and DNS queries, streamlining the monitoring process for security professionals and system administrators.
AbuseBox performs a single-host check that scans 60 different DNSBL providers and displays the AbuseIPDB reputation score. While the DNSBL and AbuseIPDB checks require a free AbuseIPDB API key, the DNS records, SSL certificates, WHOIS information, and server status checks operate without the need for any API keys, making them readily accessible.
Further enhancing its utility, the tool includes an email check that validates SPF, DKIM, and DMARC records, which are crucial for verifying sender legitimacy. These records are graded from A to F, offering a clear assessment of email security posture. The server-status check, meanwhile, tests DNS resolution, connectivity on ports 80 and 443, and measures HTTP response times, providing insights into server availability and performance.
Users can register domains and IP addresses as assets within AbuseBox, configuring specific checks for each. The default scheduler re-checks these assets every 360 minutes, with alerts configurable via email, Slack, Discord, or webhooks for events such as new listings, recoveries, outages, and expiry warnings. The tool also supports bulk checks for up to 300 hosts from various file formats and subnet scans up to a /24 range.
Setup is facilitated through Docker Compose, requiring users to clone the repository, copy an example environment file, and run the Docker Compose command. The default login credentials (admin/password123) must be changed upon first sign-in. While a quick blacklist check is available without an account, limited to 10 requests per minute, other endpoints require a token. The project is MIT licensed, developed in Python using FastAPI and React, and utilizes SQLite for data storage, making it a flexible and accessible open-source solution.
AbuseBox is freely available on GitHub, offering a robust, community-driven approach to network and domain monitoring. Its comprehensive feature set and ease of deployment aim to empower organizations of all sizes to better manage their digital footprint and respond proactively to potential security threats.