[TRAILS TESTS] Checks for Amazon IPs
Hello!
For consideration.
There's some problematic Amazon-related IP: 13.248.148.254
SilentPush indicates on high-risk reputation: https://explore.silentpush.com/enrichment/ipv4/13.248.148.254
VT: https://www.virustotal.com/gui/ip-address/13.248.148.254
And Maltrail: https://github.com/stamparm/trails/blob/main/malware/redline.txt#L9090-L9092 as having trust to ThreatFox.
But this IP seems to be related to shared provider infra:
Proposition: to take https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html
[1] https://ip-ranges.amazonaws.com/ip-ranges.json
[2] https://ip-ranges.amazonaws.com/geo-ip-feed.csv
and to have an update for tests/test_redistribution.py and /data/cdn_ranges.txt.
Related commit: https://github.com/stamparm/trails/commit/59045a100b1da7646bbd9977dc2a27e2a40f7cf6
Source: stamparm/maltrail