Feature #3508
closed
DNS Lookup - Additional links
0%
Description
Feature Request - To add additional External links to Resolve IP addresses. Or to allow User Specified links in the GUI.
When using Snort/Suricata, you can click on the ICON to "Resolve host via Reverse DNS Lookup". The existing setup only allows a lookup with DNSStuff. The Icon is also available in the Firewall Logs.
The following links below are free open links to resolve a suspected IP address to establish if its potentially malicious.
The External links are in this file ----> vi /usr/local/www/diag_dns.php
Here are some Examples of Links that I have tested that work in the 2.1 Release.
<?=gettext("NOTE: The following links are to external services, so their reliability cannot be guaranteed.");?><br/><br/>
<a target="_new" href="http://kb.bothunter.net/ipInfo/nowait.php?IP=<?php echo $ipaddr; ?>"><?=gettext("BOTHunter");?></a><br/>
<a target="_new" href="http://sitecheck2.sucuri.net/results/<?php echo $ipaddr; ?>"><?=gettext("Securi SiteCheck");?></a><br/>
<a target="_new" href="http://www.dshield.org/ipinfo.html?IP=<?php echo $ipaddr; ?>"><?=gettext("DShield Threat Lookup");?></a><br/>
<a target="_new" href="https://www.mywot.com/en/scorecard/<?php echo $ipaddr; ?>"><?=gettext("Web of Trust (WOT) Scorecard");?></a><br/>
<a target="_new" href="http://quttera.com/sitescan/<?php echo $ipaddr; ?>"><?=gettext("Quattera");?></a><br/>
<a target="_new" href="https://www.iblocklist.com/search.php?string=<?php echo $ipaddr; ?>"><?=gettext("I-Block List");?></a><br/>
<a target="_new" href="https://www.virustotal.com/en/ip-address/<?php echo $ipaddr; ?>/information"><?=gettext("VirusTotal Info");?></a><br/>
<a target="_new" href="http://private.dnsstuff.com/tools/whois.ch?ip=<?php echo $ipaddr; ?>"><?=gettext("IP WHOIS @ DNS Stuff");?></a><br/>
<a target="_new" href="http://private.dnsstuff.com/tools/ipall.ch?ip=<?php echo $ipaddr; ?>"><?=gettext("IP Info @ DNS Stuff");?></a>
Updated by
Updated by BBcan177 . about 10 years ago
The following additional lookups would be beneficial for Mail Server users.
SenderScore
Spamhaus Blocklist
SPAMcop Blocklist
multirbl RBL Lookup
MXToolbox
<?=gettext("NOTE: Mail Server DNSRBL Lookups");?><br/><br/>
<a target="_new" href="https://senderscore.org/lookup.php?lookup=<?php echo $ipaddr; ?>&ipLookup=Go"><?=gettext("SenderScore");?></a><br/>
<a target="_new" href="http://www.spamhaus.org/query/bl?ip=<?php echo $ipaddr; ?>"><?=gettext("Spamhaus Blocklist");?></a><br/>
<a target="_new" href="http://www.spamcop.net/w3m?action=checkblock&ip=<?php echo $ipaddr; ?>"><?=gettext("SPAMcop Blocklist");?></a><br/>
<a target="_new" href="http://multirbl.valli.org/lookup/<?php echo $ipaddr; ?>.html"><?=gettext("multirbl RBL Lookup");?></a><br/>
<a target="_new" href="http://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a<?php echo $ipaddr; ?>&run=toolpage"><?=gettext("MXToolbox");?></a><br/>
Updated by Jim Pingle over 4 years ago
- Status changed from New to Closed
We removed all tools links from the DNS lookup page a while ago. Third party sites are not reliable to link to in this way, unfortunately. If they change any aspect of how the script works (URL, parameters, etc) then the link is dead until we make a new release to fix it up.