overview

b


a

zFeed is a realtime datafeed with information about worldwide datacenter and online infrastructure attacks.

Features:

  • qualified IP-dataset (see below), allowing our customers to get valuable information for each IP, like:
    • probability of a botnet-member
    • badness-factor
    • member of a malicious cidr/asn
  • design protection-strategies, based on the data
  • High Coverage on global Botnet-Activity
  • Search-API
  • Statistics based on CIDR and ASN available

  • REST-API for retrieving datasets in JSON-Format

  • PUSH-Solutions for realtime available
  • capable of being easily integrable into SIEMS and Firewalls

Protection-Strategies based on zFeed-Dataset

  • conservative:

    • usefull for browser-based Webapps with an anonymous userbase
    • block only the very bad guys
    • protect from botnet-attacks
  • progressive:

    • usefull for public APIs
    • block any identified bad guy on a certain threshold
  • aggressive:

    • usefull for anything that must be on the internet but is not available to everyone
    • block any bad activity

Customers:

  • Vendors
  • Providers
  • Datacenter-Operators

Contact:

  • zfeed@zero.bs

Sample-API-Resonse

"stats":{
  "timestamp":1520123456,
  "more_data":false,
  "resultset":16787,
  "last_event":1520223456
  },
"results":{
    "31.162.0.126":{
      "cidr":"31.162.0.0/18",
      "last_seen":1520223456,
      "asn_name":"PJSC Rostelecom",
      "asn":12389,
      "scores":{
        "XXXscore":3,
        "YYYscore":0,
        "ZZZscore":4,
        "AAAscore":0,
        "BBBscore":100
      }
    },
  "144.48.9.147":{
    "cidr":"144.48.8.0/22",
    "last_seen":1520223456,
    "asn_name":"Cloudie Limited",
    "asn":55933,
    "scores":{
      "XXXscore":14,
      "YYYscore":2,
      "ZZZscore":4792,
      "AAAscore":0,
      "BBBscore":100
      }
    },
  "58.218.200.29":{
    "cidr":"58.208.0.0/12",
    "last_seen":1520223456,
    "asn_name":"No.31,Jin-rong Street",
    "asn":4134,
    "scores":{
      "XXXscore":36,
      "YYYscore":2,
      "ZZZscore":48,
      "AAAscore":100,
      "BBBscore":0
      }
    },
  ...


}

Search-API

zFeed provides an endpoint to search for events and statistics for a given IP. The result includes statistics for contamination of the CIDR and ASN the IP belongs to as well.

{
  "scores": {
    "XXXscore": 30,
    "YYYscore": 2,
    "ZZZscore": 1287,
    "AAAscore": 0,
    "BBBscore": 80
  },
  "ip": {
    "network_size": 1,
    "bad_ip_count": 0,
    "event_count": 0,
    "bad_ip_ratio": 0,
    "overall_ranking": 1
  },
  "cidr": {
    "network_size": 255,
    "bad_ip_count": 7,
    "event_count": 65,
    "bad_ip_ratio": 0,
    "overall_ranking": 0.9579139981701739
  },
  "asn": {
    "network_size": 2048,
    "bad_ip_count": 54,
    "event_count": 62377,
    "bad_ip_ratio": 0.002828125,
    "overall_ranking": 0.8172371638141809
  }
}