[1/2] sources: Replacement of Feodo Recommended Tracker list to ipblocklist sources file
Commit Message
- FEODO_RECOMMENDED list is still being updated but the number of events can be very
low. However as it is still active then it has been added back in as discussed in
the Dev Conf Call on Nov 4th.
- FEODO_IP list covers any IP that has been detected as a botnet in the last 30 days.
This could lead to false positives if the botnet has been fixed within one day of
being detected. So it was agreed that this list would stay removed.
- FEODO_AGGRESSIVE list contains all IP's that havce ever been detected as botnets since
the list was started. It is not intended to be used for blocking as it would have a
huge false positive effect. This list will also stay removed as it should not have
been included originally.
- This patch set adds back in the FEODO_RECOMMENDED list into the sources file and in the
associated patch for the update.sh file removes the lines that removed the files
related to FEODO_RECOMMENDED.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/ipblocklist/sources | 6 ++++++
1 file changed, 6 insertions(+)
@@ -61,6 +61,12 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name' => 'Emerging Threats Blocklis
'parser' => 'dshield',
'rate' => '1h',
'category' => 'attacker' },
+ 'FEODO_RECOMMENDED'=> {'name' => 'Feodo Trojan IP Blocklist (Recommended)',
+ 'url' => 'https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt',
+ 'info' => 'https://feodotracker.abuse.ch/blocklist',
+ 'parser' => 'ip-or-net-list',
+ 'rate' => '5m',
+ 'category' => 'c and c' },
'CIARMY' => { 'name' => 'The CINS Army List',
'url' => 'https://cinsscore.com/list/ci-badguys.txt',
'info' => 'https://cinsscore.com/#list',