threatinator 0.1.1

data/spec/feeds/data/ET_compromised-ip_reputation.txt

@@ -0,0 +1,11 @@
+1.179.128.245
+1.62.100.3
+1.93.24.83
+1.93.24.90
+1.93.25.102
+1.93.25.251
+1.93.26.130
+1.93.26.15
+1.93.26.17
+1.93.26.32
+1.93.26.70

data/spec/feeds/data/alienvault-ip_reputation.txt

@@ -0,0 +1,18 @@
+
+###
+# Alienvault IP Reputation Database
+# https://reputation.alienvault.com/
+###
+
+# Generic format
+
+37.205.198.162 # Scanning Host IT,,42.8333015442,12.8332996368
+182.131.22.235 # Scanning Host CN,Chengdu,30.6667003632,104.066703796
+58.250.71.43 # Scanning Host CN,Guangzhou,23.1166992188,113.25
+211.160.19.250 # Scanning Host CN,Hang,30.2936000824,120.161399841
+203.121.165.16 # C&C TH,,15.0,100.0
+211.151.57.196 # Scanning Host CN,Beijing,39.9289016724,116.388298035
+108.59.1.5 # Scanning Host A1,,0.0,0.0
+108.59.5.139 # Scanning Host US,,39.6734008789,-75.7052001953
+108.85.139.165 # Scanning Host US,Los Angeles,34.043800354,-118.251197815
+109.169.60.121 # Scanning Host US,,38.0,-97.0

data/spec/feeds/data/arbor_domainlist.txt

@@ -0,0 +1,11 @@
+#
+# ATLAS Currently monitored fastflux domains
+# (c) 2014 Arbor Networks
+#
+# comments: atlas@arbornetworks.com
+# generated: Thu Jul  3 00:20:16 2014
+#
+# DOMAIN
+brylanehome.com
+emltrk.com
+

data/spec/feeds/data/arbor_ssh.txt

@@ -0,0 +1,16 @@
+190.255.48.99          2257.0
+91.217.82.135          1984.0
+113.31.19.111          1832.0
+125.65.112.133         1714.0
+204.93.219.147         1408.0
+46.20.10.101           1295.0
+85.25.191.144          1198.0
+199.119.227.17         1168.0
+58.26.187.6            1135.0
+221.2.227.118          1.0
+186.18.67.167          1.0
+190.248.54.165         1.0
+186.169.181.150        1.0
+186.22.21.101          1.0
+186.113.86.157         1.0
+other                  0

data/spec/feeds/data/autoshun_shunlist.csv

@@ -0,0 +1,20 @@
+Shunlist as of Mon, 21 Jul 2014 13:30:02 -0500
+1.93.25.165,2014-07-11 09:58:15,SSH Brute Force
+1.93.26.130,2014-07-14 09:55:26,SSH Brute Force
+1.93.30.188,2014-07-09 08:36:42,SSH Brute Force
+1.93.34.230,2014-07-16 08:01:23,SSH Brute Force
+1.169.130.159,2014-07-07 23:10:08,Attempted MS SQL Server version enumeration
+1.214.212.74,2014-07-09 03:35:12,SSH Brute Force
+1.235.28.170,2014-07-16 03:13:39,SSH Brute Force
+2.133.208.102,2014-07-16 23:48:25,Malware Distribution Site
+2.184.57.192,2014-07-21 02:26:17,Teminal Server (RDP) brute force
+4.31.171.50,2014-07-07 06:58:50,Sipvicious Scan
+5.1.13.241,2014-07-16 23:48:23,Malware Distribution Site
+5.104.226.12,2014-07-16 09:01:23,SSH Brute Force
+5.135.112.45,2014-07-21 08:01:22,Sipvicious Scan
+5.135.176.35,2014-07-12 16:18:47,SSH Brute Force
+5.148.172.116,2014-07-07 06:58:09,SSH Brute Force
+5.159.232.139,2014-07-07 06:58:09,SSH Brute Force
+5.178.71.246,2014-07-20 21:16:07,SSH Brute Force
+5.199.165.189,2014-07-19 05:48:09,Sipvicious Scan
+5.199.166.61,2014-07-20 08:06:28,Sipvicious Scan

data/spec/feeds/data/blocklist_de_apache-ip-reputation.txt

@@ -0,0 +1,17 @@
+106.187.47.170
+107.150.59.170
+107.23.78.119
+108.59.252.133
+109.197.193.202
+109.200.1.211
+109.228.235.167
+109.70.54.11
+110.168.195.5
+110.44.123.159
+110.77.136.102
+23.91.115.60
+24.114.29.162
+2a00:1210:fffe:72::1
+2a01:238:20a:202:1000::25
+31.23.230.60
+31.28.99.108

data/spec/feeds/data/blocklist_de_bots-ip-reputation.txt

@@ -0,0 +1,15 @@
+1.23.110.131
+101.255.170.18
+101.66.202.183
+101.66.204.111
+101.66.251.72
+101.71.196.164
+101.78.144.2
+103.18.80.99
+103.20.220.205
+200.93.43.157
+200.93.92.234
+2001:250:4001:4001:e23f:49ff:fe44:595c
+2002:5bbc:75c1::5bbc:75c1
+201.144.141.194
+201.18.145.149

data/spec/feeds/data/blocklist_de_ftp-ip-reputation.txt

@@ -0,0 +1,7 @@
+110.172.152.4
+111.192.138.169
+112.111.172.203
+112.111.174.157
+112.111.174.74
+112.111.175.40
+112.198.77.229

data/spec/feeds/data/blocklist_de_imap-ip-reputation.txt

@@ -0,0 +1,8 @@
+1.174.214.119
+1.34.60.59
+1.54.216.1
+1.93.46.156
+101.166.161.198
+101.78.154.74
+103.10.134.220
+103.232.8.3

data/spec/feeds/data/blocklist_de_pop3-ip-reputation.txt

@@ -0,0 +1,11 @@
+1.168.130.111
+1.168.94.111
+1.171.195.165
+1.174.219.82
+1.175.64.9
+1.46.226.159
+1.52.121.30
+1.52.247.168
+1.53.0.215
+1.53.22.70
+1.53.230.168

data/spec/feeds/data/blocklist_de_proftpd-ip-reputation.txt

@@ -0,0 +1,12 @@
+1.54.201.61
+109.95.47.203
+111.192.138.169
+111.192.148.129
+112.111.172.203
+112.111.174.74
+112.111.175.117
+112.111.175.40
+112.90.37.197
+112.90.37.198
+112.90.37.220
+112.90.37.228

data/spec/feeds/data/blocklist_de_sip-ip-reputation.txt

@@ -0,0 +1,9 @@
+107.150.50.146
+162.252.87.211
+173.245.67.198
+178.32.229.159
+188.138.25.3
+192.151.156.90
+192.227.225.18
+198.204.224.10
+198.50.244.50

data/spec/feeds/data/blocklist_de_ssh-ip-reputation.txt

@@ -0,0 +1,10 @@
+1.214.212.74
+1.93.23.52
+1.93.24.74
+1.93.24.83
+1.93.24.85
+1.93.25.153
+1.93.25.165
+1.93.25.251
+1.93.26.10
+1.93.26.11

data/spec/feeds/data/blocklist_de_strongips-ip-reputation.txt

@@ -0,0 +1,11 @@
+120.43.8.11
+121.205.240.222
+188.143.232.211
+193.150.120.140
+91.236.74.111
+176.31.60.119
+27.159.217.240
+112.111.165.113
+178.168.82.65
+142.54.173.130
+175.44.30.134

data/spec/feeds/data/ciarmy-ip-reputation.txt

@@ -0,0 +1,11 @@
+1.93.59.96
+2.22.230.65
+4.53.160.85
+5.79.68.161
+5.104.224.34
+5.199.130.188
+5.248.82.118
+5.254.116.17
+10.0.100.120
+10.0.100.121
+12.192.193.236

data/spec/feeds/data/cruzit-ip-reputation.txt

@@ -0,0 +1,14 @@
+80.67.22.13
+80.67.23.90
+80.67.26.40
+80.67.28.145
+80.67.28.6
+80.67.30.137
+80.76.55.26
+80.76.80.108
+80.77.155.83
+80.80.171.100
+80.82.208.58
+80.82.64.114
+80.82.64.127
+80.82.64.140

data/spec/feeds/data/dan_me_uk_torlist-ip-reputation.txt

@@ -0,0 +1,11 @@
+100.0.180.88
+100.0.67.218
+100.33.8.35
+100.34.32.230
+100.37.110.51
+100.37.192.253
+100.4.189.191
+101.142.87.4
+101.217.233.64
+101.55.12.75
+101.99.64.150

data/spec/feeds/data/dshield_topattackers.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<sources>
+<data><ip>150.164.082.010</ip><attacks>136726</attacks><count>137770</count><firstseen>2014-07-04</firstseen><lastseen>2014-07-23</lastseen></data><data><ip>184.105.139.067</ip><attacks>86532</attacks><count>2365149</count><firstseen>2014-02-23</firstseen><lastseen>2014-07-30</lastseen></data><data><ip>218.077.079.043</ip><attacks>80805</attacks><count>4227189</count><firstseen>2014-06-11</firstseen><lastseen>2014-07-30</lastseen></data><data><ip>173.255.218.186</ip><attacks>80393</attacks><count>314100</count><firstseen>2014-07-16</firstseen><lastseen>2014-07-25</lastseen></data><data><ip>096.126.102.057</ip><attacks>78996</attacks><count>290559</count><firstseen>2014-07-15</firstseen><lastseen>2014-07-25</lastseen></data><data><ip>050.116.010.162</ip><attacks>78916</attacks><count>272788</count><firstseen>2014-07-15</firstseen><lastseen>2014-07-25</lastseen></data><data><ip>050.116.003.246</ip><attacks>76859</attacks><count>239177</count><firstseen>2014-07-15</firstseen><lastseen>2014-07-25</lastseen></data><data><ip>114.112.090.054</ip><attacks>68334</attacks><count>68403</count><firstseen>2014-03-01</firstseen><lastseen>2014-07-10</lastseen></data><data><ip>116.010.191.236</ip><attacks>65450</attacks><count>209602</count><firstseen>2014-04-09</firstseen><lastseen>2014-07-30</lastseen></data><data><ip>116.010.191.228</ip><attacks>65424</attacks><count>209329</count><firstseen>2014-04-04</firstseen><lastseen>2014-07-30</lastseen></data>
+</sources>

data/spec/feeds/data/feodo_domainlist.txt

@@ -0,0 +1,18 @@
+##########################################################################
+# Feodo Domain Blocklist                                                 #
+#                                                                        #
+# For questions please refer to https://feodotracker.abuse.ch/blocklist/ #
+##########################################################################
+# START
+avcctrnrxx.com
+belijvetercat.ru
+beliyvolkalak.ru
+bestofthewest.ru
+buriymishka.ru
+deepandtouch.ru
+djubkafriend.ru
+europastewmk.ru
+giaddkbzcyaoim.com
+godaddy-up.ru
+hawozkino.com
+jvrdwnload.ru

data/spec/feeds/data/feodo_iplist.txt

@@ -0,0 +1,20 @@
+##########################################################################
+# Feodo IP Blocklist                                                     #
+#                                                                        #
+# For questions please refer to https://feodotracker.abuse.ch/blocklist/ #
+##########################################################################
+# START
+103.25.59.120
+103.28.148.51
+109.235.76.136
+114.32.54.164
+119.81.5.242
+122.155.3.6
+149.171.156.234
+173.203.112.215
+173.236.153.210
+173.236.185.238
+173.236.86.214
+176.28.31.137
+182.160.162.65
+182.253.237.6

data/spec/feeds/data/infiltrated_iplist.txt

@@ -0,0 +1,16 @@
+# Tue Jul 8 07:10:01 CDT 2014
+
+99.69.103.21
+99.188.58.18
+95.79.148.122
+95.65.31.161
+95.221.86.160
+95.221.71.219
+95.178.180.145
+95.153.177.1
+95.153.170.102
+94.77.239.126
+94.41.71.52
+94.41.244.143
+94.231.70.53
+94.23.19.116

data/spec/feeds/data/malc0de_domainlist.txt

@@ -0,0 +1,18 @@
+
+// This file will be automatically updated daily and populated with the last 30 days of malicious domains.
+// It will return 127.0.0.1 for all domains found to be distributing malware
+// Additional information to get this working can be found http://www.malwaredomains.com/wordpress/?page_id=6
+// Last updated 2014-07-08	
+
+PRIMARY beespace.com.ua blockeddomain.hosts
+PRIMARY opencandy.com blockeddomain.hosts
+PRIMARY netdna-cdn.com blockeddomain.hosts
+PRIMARY drivers.drp.su blockeddomain.hosts
+PRIMARY dropcanvas.com blockeddomain.hosts
+PRIMARY 52z.com blockeddomain.hosts
+PRIMARY baixaki.com.br blockeddomain.hosts
+PRIMARY nzs.com.br blockeddomain.hosts
+PRIMARY uniblue.com blockeddomain.hosts
+PRIMARY downloadsrv13.com blockeddomain.hosts
+PRIMARY cachelocal.org blockeddomain.hosts
+PRIMARY ttriber.com blockeddomain.hosts

data/spec/feeds/data/malc0de_iplist.txt

@@ -0,0 +1,14 @@
+
+// This file will be automatically updated daily and populated with the last 30 days of malicious IP addresses.
+// Last updated 2014-07-08	
+
+91.188.117.157
+216.151.164.53
+91.222.136.251
+208.111.160.6
+5.79.71.240
+162.159.242.11
+218.75.155.39
+96.17.197.34
+176.32.99.47
+23.66.230.137

data/spec/feeds/data/mirc_domainlist.txt

@@ -0,0 +1,31 @@
+;For more information about this file see http://www.mirc.com/serverslist.html
+
+[timestamp]
+date=13/06/2012
+
+[networks]
+n0=DALnet
+n1=EFnet
+n2=Freenode
+n3=GameSurge
+n4=IRCnet
+n5=Quakenet
+n6=Rizon
+n7=SwiftIRC
+n8=Undernet
+n9=WebChat
+
+[servers]
+n0=Random serverSERVER:irc.dal.net:6660-6667GROUP:DALnet
+n1=Random AU serverSERVER:irc.au.dal.net:6665-6668,7000GROUP:DALnet
+n2=Random EU serverSERVER:irc.eu.dal.net:6665-6668,7000GROUP:DALnet
+n3=Random US serverSERVER:irc.us.dal.net:6665-6668,7000GROUP:DALnet
+n4=US, CA, OrangeSERVER:krypt.ca.us.dal.net:6665-6668,7000GROUP:DALnet
+n5=US, NJ, ChoopaSERVER:choopa.nj.us.dal.net:6667:GROUP:DALnet
+n6=US, VA, RichmondSERVER:punch.va.us.dal.net:6665-6668,7000GROUP:DALnet
+n7=US, WA, SeattleSERVER:serverbuffet.wa.us.dal.net:6665-6668,7000GROUP:DALnet
+n8=Random serverSERVER:irc.efnet.org:6667GROUP:EFnet
+n9=CA, AB, CalgarySERVER:irc.arcti.ca:6665-6669GROUP:EFnet
+n10=CA, ON, TorontoSERVER:irc.teksavvy.ca:6661-6669GROUP:EFnet
+n11=EU, DK, AarhusSERVER:irc.inet.tele.dk:6661-6669GROUP:EFnet
+n12=EU, NL, AmsterdamSERVER:efnet.xs4all.nl:6661-6669GROUP:EFnet

data/spec/feeds/data/nothink_irc_iplist.txt

@@ -0,0 +1,14 @@
+# Provided by nothink.org
+# Malware IRC network traffic blacklist (IP address)
+# Generated 2014-07-07 22:05:01 UTC
+122.160.232.194
+123.240.75.169
+173.163.151.27
+189.107.132.113
+193.107.16.22
+193.136.119.33
+194.14.236.50
+201.48.61.38
+218.61.22.10
+218.61.22.28
+46.166.162.116

data/spec/feeds/data/nothink_ssh_iplist.txt

@@ -0,0 +1,10 @@
+# Provided by nothink.org
+# SSH blacklist, last 24 hours (IP address)
+# Generated 2014-07-08 22:05:01 UTC
+1.93.26.15
+31.196.84.131
+36.39.246.121
+61.144.43.235
+64.111.196.174
+88.191.151.44
+94.32.71.168

data/spec/feeds/data/openbl_iplist.txt

@@ -0,0 +1,12 @@
+# openbl.org/lists/base_90days.txt
+# Wed Jul  9 15:12:00 2014 UTC
+#
+# source ip
+61.174.51.216
+61.174.51.233
+218.108.247.91
+183.46.250.53
+61.174.51.230
+61.174.51.204
+1.93.29.130
+117.21.191.35

data/spec/feeds/data/palevo_domainlist.txt

@@ -0,0 +1,25 @@
+# Palevo C&C Domain Blocklist by abuse.ch
+arta.romail3arnest.info
+asp.spinchats.com
+bff.7oorq8.com
+bff4.7oorq8.com
+computo164.laweb.es
+fitt.prince.kz
+hcuewgbbnfdu1ew.com
+hcuewgbbnfs1uew.com
+internet.estr.es
+legionarios.servecounterstrike.com
+mail3.nad123nad.com
+mariposita.web-personal.org
+masterkey.com.ua
+ms4all.twoplayers.net
+mst.com.ua
+ns.dunno-net.com
+panchitox.laweb.es
+penchatox.sin-ip.es
+rastu.com.ua
+s.24otuwotefsmd.com
+shv4.no-ip.biz
+shv4b.getmyip.com
+ssl.aukro.ua
+symconempkr.com