ThreatSTOP Blog

ThreatSTOP announces first IPv6 feed

Written by threatstop | March 19, 2012

We are making available our first IP v6 feed – the v6 full bogons – as a technology demonstration. It uses the exact same DNS distribution method as our standard IP v4 lists and thus demonstrates clearly that our mechanism is IP v6 compliant.

The feed is available to our subscribers via DNS as follows:

dig @64.87.26.147 bogonsv6.threatstop.local ptr +tcp

and then a subsequent apl lookup of all the entries returned by that i.e.

dig @64.87.26.147 001-netb.bogonsv6.threatstop.local apl +tcp
dig @64.87.26.147 002-netb.bogonsv6.threatstop.local apl +tcp

dig @64.87.26.147 060-netb.bogonsv6.threatstop.local apl +tcp

The feed is extremely large (over 53000 networks broken down into 60 groups of 900). It has been made available the same way that our basic feed is – that is any registered IP address can retrieve it.

In the near future we will also add the IP v6 versions of our current IP v4 feeds in IPv4-mapped IPv6 address format as defined in RFC 2373 (i.e. ::FFFF:ip.add.re.ss )