AS65099.net // BGP threat feed about · peering · how it works · sources · configs

AS65099.net — free BGP threat feed

A community blocklist delivered as BGP routes. Peer with us and blackhole ~32,000 malicious prefixes automatically.

1.About

AS65099.net is a free service for hosting providers, small ISPs, and corporate networks that want a simple way to drop traffic to known bad sources at the edge.

Instead of importing lists into every firewall, you peer once over BGP and install the feed as blackhole routes.

Data refreshes every 1 hour. Last successful refresh: .

2.Peering details

Neighbor
176.100.36.217
Remote AS
65099
Session
eBGP multihop
AFI
IPv4 unicast
Action
blackhole / discard

We advertise host routes for malicious sources. You apply an inbound policy that turns every prefix from this session into a blackhole / discard route, so traffic to those destinations is silently dropped on your edge. Routes carry the NO_ADVERTISE BGP community.

3.How it works

  1. Configure the session. Point an eBGP multihop neighbor at 176.100.36.217 with remote AS 65099.
  2. Apply the inbound policy. Use the sample config for your platform below. It rewrites the next-hop to discard or marks the route as blackhole.
  3. Done. Routes install pointing at Null0 / discard. Updates and withdrawals are handled live over BGP.

Each sample sets a sane maximum-prefix safety limit and routes the discard next-hop (10.99.99.99 for IPv4, 100::1 for IPv6) to Null0. Replace <YOUR-ASN> with your own AS number before applying.

4.Source data

Public blocklists mapped to BGP communities.

ListSource URLCommunity
IPsum level 3 raw.githubusercontent.com/stamparm/ipsum 999:1001
Spamhaus DROP iplists.firehol.org/files/spamhaus_drop.netset 999:1002
FireHOL level 2 iplists.firehol.org/files/firehol_level2.netset 999:1003
Cybercrime IP set iplists.firehol.org/files/cybercrime.ipset 999:1004
FireHOL abusers 1d iplists.firehol.org/files/firehol_abusers_1d.netset 999:1005
Team Cymru bogons www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt 999:1006

Communities let peers identify the source list if they want to log, filter, or prefer specific feeds. All routes use next-hop 10.99.99.99.

5.Sample BGP configs

Replace <YOUR-ASN> and apply inbound.

download 
Loading…