AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records
AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes. A DNS blacklis...
AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes. A DNS blacklist, or DNSBL, is a list that mail servers and other services consult when deciding whether to trust an address.
The dashboard keeps one list of what needs attention: blacklist listings, expiring certificates and domains, servers that are down, and weak email security. That replaces running a blacklist lookup, a certificate check and a DNS query one at a time.
What AbuseBox checks
A single-host check scans 60 DNSBL providers and shows the AbuseIPDB reputation score alongside, which needs a free AbuseIPDB API key. DNS records, SSL certificates, WHOIS and server status work with no keys.
The email check validates SPF, DKIM and DMARC records, which tell receiving servers which senders are legitimate, and grades them from A to F. The server-status check tests DNS resolution, ports 80 and 443, and HTTP response time.
How you run it
You register domains and IPs as assets, choose which checks run on each, and let the scheduler re-check them every 360 minutes by default. Alerts go out by email, Slack, Discord or a webhook for new listings, recoveries, outages and expiry warnings. Bulk checks take up to 300 hosts from a pasted list or a TXT, CSV or XLSX file, and subnet scans go up to a /24.
Setup is Docker Compose: clone the repository, copy the example .env file, run docker compose up — build, and open localhost:3000. Fresh installs start with the login admin and password123, so change it at first sign-in. You can run the blacklist quick check without an account, limited to 10 requests per minute per IP address, and every other endpoint needs a token. The code is MIT licensed, written in Python with FastAPI and React, and stores data in SQLite.
AbuseBox is available for free on GitHub.
Must read:
20 open-source cybersecurity tools to keep your team ready for anything
GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
