Lion Cipher Lab

Turn a flat list of malicious IPs into infrastructure intelligence: enrich and cluster by ASN and prefix (offline)

• Threat Intel Analyst
• Intermediate
• ~50 min
• Free · no account required

Why it matters

A blocklist of IP addresses is one of the lowest forms of threat intelligence there is. It is a list of dots with no relationships: block these forty addresses and you have solved exactly forty problems, each of which the adversary can replace in minutes by spinning up the next host in the same pool. The value was never in the individual addresses -- it is in the STRUCTURE behind them, and that structure is mostly invisible until you enrich each IP with where it actually lives on the internet: which Autonomous System (the network operator's routing domain) announces it, which prefix (the CIDR…

What you'll learn

• defining, from zero, what an ASN, an announced prefix/CIDR, a BGP announcement, an AS holder and an IP-to-ASN mapping actually are -- and why a flat blocklist has none of that structure
• building a self-contained, offline dataset: a 40-line malicious-IP list and a plainly-labelled fictional IP-to-ASN stub (CIDR -> asn / as_name / country) that stands in for a real dataset
• writing a pure-stdlib enrichment that does LONGEST-PREFIX MATCH with the ipaddress module, so each IP is attached to the most specific announcing prefix (and you can see a /24 win over an overlapping /16)
• clustering the enriched indicators by ASN and by /24 and reading the concentration off the sorted output -- measuring that 3 ASNs carry 30 of your 40 IPs
• pivoting from a hot ASN/prefix to sibling addresses you never flagged, and doing the blocking-economics math (a /24 = 256 addresses; an ASN can announce thousands)
• confronting the honest limits out loud: the CDN / shared-host false positive (one ASN holds good and bad), snapshot staleness, prefix != ownership, and that this is clustering, not attribution to a named actor
• naming the REAL free paths that replace the stub -- pyasn built from a RouteViews/CAIDA MRT snapshot, Team Cymru's IP-to-ASN whois/DNS service, and BGP looking glasses -- and how each differs from the teaching stub

Steps in this lab

1. The vocabulary of routing, from zero: ASN, prefix, BGP, holder, IP-to-ASN
2. The problem: a flat blocklist is dots with no relationships
3. Ship the data: the 40-IP indicator list and a LABELLED IP-to-ASN stub
4. Enrich with longest-prefix match, and read the enriched table
5. Cluster by ASN and by /24, and read the concentration
6. Pivot from a hot ASN, and do the blocking-economics math
7. Honest negatives: what this does NOT tell you
8. Do it for real: pyasn, Team Cymru, and looking glasses (and judgment)

Open the full interactive lab →