This project contains scripts to fetch and process data related to bad Autonomous System Numbers (ASNs) most used in phishing attacks or abused by attackers. The data is fetched from multiple sources . This folders includes scripts to automatically update the list of bad ASNs and retrieve their corresponding IP ranges.

This script automatically fetches the latest list of bad ASNs most used in phishing attacks from www.cybercrimeinfocenter.org and saves the output in a file named latest_bad_asn_phishing_list.csv

• This script performs the following steps:
  • Fetches the main page that lists all the quarterly reports.
  • Parses the HTML to find the latest URL for the "bad ASN" report.
  • Fetches the data from the latest URL.
  • Extracts the table and saves it to a CSV file named latest_bad_asn_phishing_list.csv.

This script fetches the updated IP ranges of each bad ASN listed in the consolidated list of ASNs and saves the IP ranges of each ASN in the current folder. Reads the lists of ASNs from:

• latest_bad_asn_phishing_list.csv (Cybercrime Info Center).
• bad_asn_static_list.csv (my static List of ASNs).
• evild3ad-ASN-BlackList.csv (mostly VPN ASNs from https://github.com/evild3ad/Microsoft-Analyzer-Suite/blob/main/Blacklists/ASN-Blacklist.csv)
• spamhaus_asn_list.csv (Spamhaus ASN Drop List).

This script performs the following steps:

• Fetches the ASN lists from the sources above.
• Combines all ASNs into a single deduplicated list.
• Execute the get_ip_range.py script with the AS numbers as arguments. It will fetch the IP ranges of the listed ASNs and saves the results in the current folder.

For correlation the folder correlation_maxmind_geo_db contains a script that automatically downloads, extracts, and updates the latest MaxMind GeoLite2 databases (ASN, City, and Country).

All the BAD ASNs ip ranges in one file: _ALL_BAD_ASN_IP_Ranges_List.csv

fixme..

• AS15557 (exclude it if necessary)
• ...