{"id":26010203,"url":"https://github.com/jblukach/caretaker","last_synced_at":"2026-03-03T02:31:53.125Z","repository":{"id":190824761,"uuid":"683256204","full_name":"jblukach/caretaker","owner":"jblukach","description":"Project Caretaker helps users easily check and verify their online reputation and IP safety using Open Source Intelligence (OSINT).","archived":false,"fork":false,"pushed_at":"2026-01-16T10:30:44.000Z","size":6996,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-01-17T00:07:48.598Z","etag":null,"topics":["dns","domain","intel","ipv4","ipv6","osint","spf","threat"],"latest_commit_sha":null,"homepage":"https://api.lukach.io/osint/ip","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jblukach.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-08-26T02:02:29.000Z","updated_at":"2026-01-16T10:30:47.000Z","dependencies_parsed_at":"2023-08-26T15:37:47.144Z","dependency_job_id":"6b98b7d6-d9ce-4827-a4f2-27666c2eb30f","html_url":"https://github.com/jblukach/caretaker","commit_stats":null,"previous_names":["jblukach/caretaker"],"tags_count":7715,"template":false,"template_full_name":null,"purl":"pkg:github/jblukach/caretaker","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jblukach%2Fcaretaker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jblukach%2Fcaretaker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jblukach%2Fcaretaker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jblukach%2Fcaretaker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jblukach","download_url":"https://codeload.github.com/jblukach/caretaker/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jblukach%2Fcaretaker/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30030829,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-03T00:31:48.536Z","status":"online","status_checked_at":"2026-03-03T02:00:07.650Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dns","domain","intel","ipv4","ipv6","osint","spf","threat"],"created_at":"2025-03-05T22:40:07.702Z","updated_at":"2026-03-03T02:31:51.086Z","avatar_url":"https://github.com/jblukach.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Project Caretaker](images/caretaker.png)\n\nReputation is the most critical asset available when using the Internet, as it helps us decide which services we feel safe using. It can also impact an end-users ability to use the web if the connection had previous suspect behavior. Project Caretaker aims to provide a Threat Feed for North Dakota so that anyone can verify Internet reputation.\n\nEvery day at 14:00 UTC, the Internet addresses for the Broadband Association of North Dakota (BAND) members, North Dakota Univesity System (NDUS), and the State of North Dakota (ITD) get updated from Security Trails, a Recorded Future company.\n\n- https://bgpview.io\n- https://broadbandnd.com\n- https://ndit.nd.gov\n\nI added additional Internet Service Providers (ISPs) to improve state coverage. :earth_americas:\n\n### Autonomous System Numbers (ASN)\n\n* 11138 - BEK Communications Cooperative (BCC-141)\n* 11232 - Midcontinent Communications (MIDCO-1)\n* 14090 - North Dakota Telephone Company (GONDT)\n* 14511 - Polar Communications (PLAR)\n* 14543 - SRT Communications, Inc. (SRTC)\n* 15267 - 702 Communications (702COM)\n* 18780 - Reservation Telephone Coop. (RTC-81)\n* 19530 - State of North Dakota, ITD (SNDI-1)\n* 21730 - Halstad Telephone Company (HALSTA)\n* 26794 - Dakota Carrier Network (DCN-38)\n* 27539 - West River Telecommunications Cooperative (WRVR)\n* 29744 - United Telephone Mutual Aid Corporation (UNITED-190)\n* 31758 - Griggs County Telephone Co. (GCT-43)\n* 32809 - Dickey Rural Networks (DRN-3)\n* 33339 - Nemont Telecommunications (NEMON-2)\n* 36374 - Stellar Association, LLC (SAL-65)\n* 55105 - Northwest Communications Cooperative (NCC-115)\n* 63414 - Dakota Central Telecommunications Cooperative (DAKTE)\n* 400439 - Consolidated Telecommunications (CONSO-10)\n\nIt results in **1,295,104** IPv4 addresses and **31** IPv6 cidr allocations to monitor for reputation. \n\nA /32 subnet of IPv6 has 65,536 /48 subnets, each with 65,536 /64 subnets with 18,446,744,073,709,551,616 addresses, making a vast number. IPv6 addresses get converted to integers to determine if they fall into any of the monitored ranges.\n\n### Brand Monitoring\n\nEvery day at 14:00 UTC, queries run against **Censys** for trusted certificates with the province of either **North Dakota** or the abbreviation **ND** to collect **8,232** domain names for ```apex``` and ```www``` brand monitoring.\n\nThank you to **Censys** for providing research access that makes this possible!\n\n- https://search.censys.io\n\nCertificate Transparency (CT) is a security standard for monitoring and auditing the issuance of digital certificates. Chrome, Firefox, Safari, etc., web browsers require certificates to be listed to be trusted when surfing the Internet.\n\n- https://certificate.transparency.dev\n\nThe domain names from the certificates are normalized to guarantee valid top-level domains with wild cards removed.\n\n- https://www.iana.org\n\n### Email Security\n\nEvery day at 15:00 UTC, domains are checked for Mail Exchange (**MX**) records to determine if an email server is present; once identified, verification of Domain-based Message Authentication, Reporting \u0026 Conformance (**DMARC**), and Sender Policy Framework (**SPF**) records occurs.\n\nSender Policy Framework is an email authentication standard that determines the addresses and domains that can send emails that require reputation monitoring.\n\n### Misconfiguration\n\nEvery day starting at 15:00 UTC, queries run against **Censys** for misconfigurations that expose insecure services to the Internet. \n\nThanks again to **Censys** for providing research access that makes this possible!\n\n- https://search.censys.io\n\n### Monitored Services\n\n|     |     |     |     |\n|:---:|:---:|:---:|:---:|\n| ACTIVEMQ | AFP | AMQP | APPLE_AIRPORT_ADMIN | \n| BACNET | COAP | COBALT_STRIKE | CWMP **+** |\n| DARKGATE | DCERPC | DHCPDISCOVER | DNP3 | \n| ECHO | ELASTICSEARCH | EPMD | ETHEREUM | \n| FINGERD | FOX | FTP | IMAP |\n| IPMI | IPP | ISCSI | IOTA |\n| KRPC | KUBERNETES | LDAP | MDNS |\n| MEMCACHED | MMS | MODBUS | MONERO_P2P |\n| MONGODB | MQTT | MSSQL | MYSQL |\n| NBD | NETBIOS | NNTP | OPC_UA |\n| ORACLE | PC_ANYWHERE | PCOM | PGBOUNCER |\n| POP3 | PORTMAP | POSTGRES | PPTP |\n| PROMETHEUS | REDIS | RLOGIN | ROCKETMQ |\n| RDP | RTSP | S7 | SCCM | \n| SIP | SKINNY | SMB | SNMP | \n| SPICE | SSDP | TACACS_PLUS | TEAM_VIEWER |\n| TELNET | TFTP | TPLINK_KASA | UPNP |\n| VNC | WHOIS | WINRM | X11 |\n| ZEROMQ |\n\n- https://search.censys.io/search/definitions\n\n**+** CWMP prevalence required exclusion from Midcontinent results.\n\n### Reputation\n\nThe following threat feeds pull at thirty minutes past the hour to determine if any addresses from North Dakota exist on the lists. \n\nIf there are others that you would like added, please open an issue on the repository?\n\nI appreciate all the work that goes into maintaining these lists - thank you!\n\n- https://cert.pl\n- https://cinsscore.com\n- https://feodotracker.abuse.ch\n- https://github.com/drb-ra\n- https://github.com/elliotwutingfeng\n- https://github.com/jblukach\n- https://github.com/montysecurity\n- https://github.com/stamparm\n- https://github.com/Ultimate-Hosts-Blacklist\n- https://greensnow.co\n- https://jamesbrine.com.au\n- https://oisd.nl\n- https://openphish.com\n- https://osint.digitalside.it\n- https://otx.alienvault.com\n- https://phishing.army\n- https://report.cs.rutgers.edu\n- https://sslbl.abuse.ch\n- https://urlabuse.com\n- https://zonefiles.io\n- https://www.binarydefense.com\n- https://www.blocklist.de\n- https://www.dan.me.uk\n- https://www.nubi-network.com\n- https://www.proofpoint.com\n\nThe critical part is making the results usable by anyone with just a website visit!\n\nThe lookup completes using the Internet address your connection originates from to protect the potential sensitivity of the returned results.\n\nWe don't want to tip the hand like playing cards, losing the advantage!\n\n- https://verify.tundralabs.org\n\nIf the website returns **gray**, it means there is no data currently available, but that does not mean there still could not be a problem. \n\n![Project Caretaker Unknown Alert](images/unknown.png)\n\nWhen the website returns **orange**, it will list sources and last-seen timestamps of potential reputation concerns.\n\n![Project Caretaker Suspect Alert](images/suspect.png)\n\nWhen the website returns **yellow**, monitoring is not occurring.\n\n![Project Caretaker Suspect Alert](images/monitor.png)\n\nWhen the website returns **red**, please try again or check back later.\n\n![Project Caretaker Error Alert](images/error.png)\n\nYou may require additional assistance to resolve the issue outside of this project; at least the awareness to start asking questions will exist.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjblukach%2Fcaretaker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjblukach%2Fcaretaker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjblukach%2Fcaretaker/lists"}