#19619·maltrail

[TRAILS TESTS] Checks for Amazon IPs

Author: MikhailKasimovCreated Sep 1, 2026Updated Sep 1, 2026
Labelsenhancement

Hello!

For consideration.

There's some problematic Amazon-related IP: 13.248.148.254

SilentPush indicates on high-risk reputation: https://explore.silentpush.com/enrichment/ipv4/13.248.148.254

Image

VT: https://www.virustotal.com/gui/ip-address/13.248.148.254

Image

And Maltrail: https://github.com/stamparm/trails/blob/main/malware/redline.txt#L9090-L9092 as having trust to ThreatFox.

But this IP seems to be related to shared provider infra:

Image

Proposition: to take https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html

[1] https://ip-ranges.amazonaws.com/ip-ranges.json [2] https://ip-ranges.amazonaws.com/geo-ip-feed.csv

and to have an update for tests/test_redistribution.py and /data/cdn_ranges.txt.

Related commit: https://github.com/stamparm/trails/commit/59045a100b1da7646bbd9977dc2a27e2a40f7cf6