threatinator 0.1.6 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (197) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +13 -2
  3. data/Gemfile +18 -13
  4. data/Rakefile +1 -1
  5. data/VERSION +1 -1
  6. data/feeds/ET_block-ip_reputation.feed +26 -0
  7. data/feeds/ET_openbadlist-ip_reputation.feed +35 -0
  8. data/feeds/bambenek_c2_masterlist-domain_reputation.feed +15 -0
  9. data/feeds/bambenek_c2_masterlist-ip_reputation.feed +15 -0
  10. data/feeds/bambenek_dga_feed-domain_reputation.feed +15 -0
  11. data/feeds/berkeley-ip_reputation.feed +23 -0
  12. data/feeds/bitcash_cz_blacklist.feed +20 -0
  13. data/feeds/botscout-ip_reputation.feed +24 -0
  14. data/feeds/cert_mxpoison-ip_reputation.feed +21 -0
  15. data/feeds/chaosreigns-ip_reputation.feed +36 -0
  16. data/feeds/cydef_torexit-ip_reputation.feed +24 -0
  17. data/feeds/danger_bruteforce-ip_reputation.feed +23 -0
  18. data/feeds/falconcrest-ip_reputation.feed +18 -0
  19. data/feeds/h3x_asprox.feed +17 -0
  20. data/feeds/hosts-file_hphostspartial-domain_reputation.feed +18 -0
  21. data/feeds/infiltrated_vabl-ip_reputation.feed +29 -0
  22. data/feeds/isc_suspicious_high-domain_reputation.feed +25 -0
  23. data/feeds/isc_suspicious_low-domain_reputation.feed +25 -0
  24. data/feeds/isc_suspicious_medium-domain_reputation.feed +25 -0
  25. data/feeds/malwaredomainlist-url_reputation.feed +16 -0
  26. data/feeds/malwaredomains-domain_reputation.feed +27 -0
  27. data/feeds/malwaredomains_dyndns-domain_reputation.feed +27 -0
  28. data/feeds/malwaredomains_justdomains-domain_reputation.feed +18 -0
  29. data/feeds/multiproxy-ip_reputation.feed +20 -0
  30. data/feeds/openphish-url_reputation.feed +22 -0
  31. data/feeds/packetmail_perimeterbad-ip_reputation.feed +26 -0
  32. data/feeds/phishtank.feed +1 -1
  33. data/feeds/sigmaproject_atma.feed +25 -0
  34. data/feeds/sigmaproject_spyware.feed +24 -0
  35. data/feeds/sigmaproject_webexploit.feed +26 -0
  36. data/feeds/snort_bpf-ip_reputation.feed +19 -0
  37. data/feeds/steeman-ip_reputation.feed +19 -0
  38. data/feeds/trustedsec-ip_reputation.feed +17 -0
  39. data/feeds/virbl-ip_reputation.feed +24 -0
  40. data/feeds/vxvault-url_reputation.feed +22 -0
  41. data/feeds/yoyo_adservers-domain_reputation.feed +16 -0
  42. data/lib/threatinator/actions/run/action.rb +15 -3
  43. data/lib/threatinator/actions/run/coverage_observer.rb +12 -7
  44. data/lib/threatinator/actions/run/status_observer.rb +37 -0
  45. data/lib/threatinator/cli.rb +9 -3
  46. data/lib/threatinator/cli/parser.rb +14 -4
  47. data/lib/threatinator/config.rb +1 -0
  48. data/lib/threatinator/config/logger.rb +14 -0
  49. data/lib/threatinator/event.rb +28 -18
  50. data/lib/threatinator/event_builder.rb +52 -23
  51. data/lib/threatinator/exceptions.rb +3 -6
  52. data/lib/threatinator/feed.rb +1 -1
  53. data/lib/threatinator/feed_runner.rb +63 -7
  54. data/lib/threatinator/logger.rb +66 -0
  55. data/lib/threatinator/logging.rb +20 -0
  56. data/lib/threatinator/model/base.rb +23 -0
  57. data/lib/threatinator/model/collection.rb +64 -0
  58. data/lib/threatinator/model/observables/fqdn_collection.rb +13 -0
  59. data/lib/threatinator/model/observables/ipv4.rb +30 -0
  60. data/lib/threatinator/model/observables/ipv4_collection.rb +14 -0
  61. data/lib/threatinator/model/observables/url_collection.rb +16 -0
  62. data/lib/threatinator/model/validations.rb +1 -0
  63. data/lib/threatinator/model/validations/type.rb +21 -0
  64. data/lib/threatinator/plugins/output/csv.rb +20 -9
  65. data/spec/feeds/ET_block-ip_reputation_spec.rb +50 -0
  66. data/spec/feeds/ET_compromised-ip_reputation_spec.rb +2 -5
  67. data/spec/feeds/ET_openbadlist-ip_reputation_spec.rb +56 -0
  68. data/spec/feeds/alienvault-ip_reputation_spec.rb +2 -5
  69. data/spec/feeds/arbor_fastflux-domain_reputation_spec.rb +0 -3
  70. data/spec/feeds/arbor_ssh-ip_reputation_spec.rb +2 -5
  71. data/spec/feeds/autoshun_shunlist_spec.rb +1 -4
  72. data/spec/feeds/bambenek_c2_masterlist-domain_reputation_spec.rb +39 -0
  73. data/spec/feeds/bambenek_c2_masterlist-ip_reputation_spec.rb +39 -0
  74. data/spec/feeds/bambenek_dga_feed-domain_reputation_spec.rb +39 -0
  75. data/spec/feeds/berkeley-ip_reputation_spec.rb +47 -0
  76. data/spec/feeds/bitcash_cz_blacklist-ip_reputation_spec.rb +50 -0
  77. data/spec/feeds/blocklist_de_apache-ip_reputation_spec.rb +2 -5
  78. data/spec/feeds/blocklist_de_bots-ip_reputation_spec.rb +2 -5
  79. data/spec/feeds/blocklist_de_ftp-ip_reputation_spec.rb +2 -5
  80. data/spec/feeds/blocklist_de_imap-ip_reputation_spec.rb +2 -5
  81. data/spec/feeds/blocklist_de_pop3-ip_reputation_spec.rb +2 -5
  82. data/spec/feeds/blocklist_de_proftpd-ip_reputation_spec.rb +2 -5
  83. data/spec/feeds/blocklist_de_sip-ip_reputation_spec.rb +2 -5
  84. data/spec/feeds/blocklist_de_ssh-ip_reputation_spec.rb +2 -5
  85. data/spec/feeds/blocklist_de_strongips-ip_reputation_spec.rb +2 -5
  86. data/spec/feeds/botscout-ip_reputation_spec.rb +50 -0
  87. data/spec/feeds/cert_mxpoison-ip_reputation_spec.rb +47 -0
  88. data/spec/feeds/chaosreigns-ip_reputation_spec.rb +50 -0
  89. data/spec/feeds/ciarmy-ip_reputation_spec.rb +2 -5
  90. data/spec/feeds/cruzit-ip_reputation_spec.rb +2 -5
  91. data/spec/feeds/cydef_torexit-ip_reputation_spec.rb +47 -0
  92. data/spec/feeds/dan_me_uk_torlist-ip_reputation_spec.rb +2 -5
  93. data/spec/feeds/danger_bruteforce-ip_reputation_spec.rb +47 -0
  94. data/spec/feeds/data/ET_block-ip_reputation.txt +80 -0
  95. data/spec/feeds/data/ET_openbadlist-ip_reputation.txt +62 -0
  96. data/spec/feeds/data/bambenek_c2-dommasterlist.csv +30 -0
  97. data/spec/feeds/data/bambenek_c2-ipmasterlist.csv +27 -0
  98. data/spec/feeds/data/bambenek_dga_feed.csv +42 -0
  99. data/spec/feeds/data/berkeley.txt +29 -0
  100. data/spec/feeds/data/bitcash_cz_blacklist.txt +7 -0
  101. data/spec/feeds/data/botscout-ip-reputation.txt +713 -0
  102. data/spec/feeds/data/cert_mxpoison-ip_reputation.txt +17 -0
  103. data/spec/feeds/data/chaosreigns-ip-reputation.txt +26 -0
  104. data/spec/feeds/data/cydef_torexit-ip_reputation.txt +27 -0
  105. data/spec/feeds/data/danger_bruteforce-ip_reputation.txt +12 -0
  106. data/spec/feeds/data/falconcrest_iplist.txt +345 -0
  107. data/spec/feeds/data/h3x_asprox.txt +20 -0
  108. data/spec/feeds/data/hosts-file_hphostspartial_domainlist.txt +24 -0
  109. data/spec/feeds/data/infiltrated_vabl_iplist.txt +33 -0
  110. data/spec/feeds/data/isc_suspicious_high_domainlist.txt +26 -0
  111. data/spec/feeds/data/isc_suspicious_low_domainlist.txt +34 -0
  112. data/spec/feeds/data/isc_suspicious_medium_domainlist.txt +32 -0
  113. data/spec/feeds/data/malwaredomainlist-url-reputation.txt +8 -0
  114. data/spec/feeds/data/malwaredomains_domainlist.txt +24 -0
  115. data/spec/feeds/data/malwaredomains_dyndns_domainlist.txt +34 -0
  116. data/spec/feeds/data/malwaredomains_justdomains_domainlist.txt +18 -0
  117. data/spec/feeds/data/multiproxy_iplist.txt +15 -0
  118. data/spec/feeds/data/openphish-url-reputation.txt +16 -0
  119. data/spec/feeds/data/packetmail_perimeterbad-ip_reputation.txt +44 -0
  120. data/spec/feeds/data/sigmaproject_atma.return.gz +0 -0
  121. data/spec/feeds/data/sigmaproject_spyware.return.gz +0 -0
  122. data/spec/feeds/data/sigmaproject_webexploit.return.gz +0 -0
  123. data/spec/feeds/data/snort_bpf-ip_reputation.txt +16 -0
  124. data/spec/feeds/data/steeman-ip-reputation.txt +13 -0
  125. data/spec/feeds/data/trustedsec-ip-reputation.txt +12 -0
  126. data/spec/feeds/data/virbl-ip_reputation.txt +14 -0
  127. data/spec/feeds/data/vxvault-url-reputation.txt +15 -0
  128. data/spec/feeds/data/yoyo_adservers.txt +25 -0
  129. data/spec/feeds/dshield_attackers-top1000_spec.rb +1 -4
  130. data/spec/feeds/falconcrest-ip_reputation_spec.rb +37 -0
  131. data/spec/feeds/feodo-domain_reputation_spec.rb +0 -3
  132. data/spec/feeds/feodo-ip_reputation_spec.rb +2 -5
  133. data/spec/feeds/h3x_asprox-ip_reputation_spec.rb +50 -0
  134. data/spec/feeds/hosts-file_hphostspartial-domain_reputation_spec.rb +47 -0
  135. data/spec/feeds/infiltrated-ip_reputation_spec.rb +2 -5
  136. data/spec/feeds/infiltrated_vabl-ip_reputation_spec.rb +47 -0
  137. data/spec/feeds/isc_suspicious_high-domain_reputation_spec.rb +47 -0
  138. data/spec/feeds/isc_suspicious_low-domain_reputation_spec.rb +47 -0
  139. data/spec/feeds/isc_suspicious_medium-domain_reputation_spec.rb +47 -0
  140. data/spec/feeds/malc0de-domain_reputation_spec.rb +0 -3
  141. data/spec/feeds/malc0de-ip_reputation_spec.rb +2 -5
  142. data/spec/feeds/malwaredomainlist_url_reputation_spec.rb +50 -0
  143. data/spec/feeds/malwaredomains-domain_reputation_spec.rb +47 -0
  144. data/spec/feeds/malwaredomains_dyndns-domain_reputation_spec.rb +47 -0
  145. data/spec/feeds/malwaredomains_justdomains-domain_reputation_spec.rb +47 -0
  146. data/spec/feeds/mirc-domain_reputation_spec.rb +0 -3
  147. data/spec/feeds/multiproxy-ip_reputation_spec.rb +47 -0
  148. data/spec/feeds/nothink_irc-ip_reputation_spec.rb +2 -5
  149. data/spec/feeds/nothink_ssh-ip_reputation_spec.rb +2 -5
  150. data/spec/feeds/openbl-ip_reputation_spec.rb +2 -5
  151. data/spec/feeds/openphish_url_reputation_spec.rb +50 -0
  152. data/spec/feeds/packetmail_perimeterbad-ip_reputation_spec.rb +47 -0
  153. data/spec/feeds/palevo-domain_reputation_spec.rb +0 -3
  154. data/spec/feeds/palevo-ip_reputation_spec.rb +2 -5
  155. data/spec/feeds/phishtank_spec.rb +2 -5
  156. data/spec/feeds/sigmaproject_atma_spec.rb +63 -0
  157. data/spec/feeds/sigmaproject_spyware_spec.rb +64 -0
  158. data/spec/feeds/sigmaproject_webexploit_spec.rb +63 -0
  159. data/spec/feeds/snort_bpf-ip_reputation_spec.rb +47 -0
  160. data/spec/feeds/spyeye-domain_reputation_spec.rb +0 -3
  161. data/spec/feeds/spyeye-ip_reputation_spec.rb +2 -5
  162. data/spec/feeds/steeman-ip_reputation_spec.rb +50 -0
  163. data/spec/feeds/t-arend-de_ssh-ip_reputation_spec.rb +2 -5
  164. data/spec/feeds/the_haleys_ssh-ip_reputation_spec.rb +2 -5
  165. data/spec/feeds/trustedsec-ip_reputation_spec.rb +47 -0
  166. data/spec/feeds/virbl-ip_reputation_spec.rb +47 -0
  167. data/spec/feeds/vxvault_url_reputation_spec.rb +50 -0
  168. data/spec/feeds/yourcmc_ssh-ip_reputation_spec.rb +2 -5
  169. data/spec/feeds/yoyo_adservers_spec.rb +47 -0
  170. data/spec/feeds/zeus-domain_reputation_spec.rb +0 -3
  171. data/spec/feeds/zeus-ip_reputation_spec.rb +2 -5
  172. data/spec/spec_helper.rb +2 -0
  173. data/spec/support/factories/event.rb +11 -7
  174. data/spec/support/factories/feed.rb +28 -1
  175. data/spec/support/factories/ipv4.rb +36 -0
  176. data/spec/support/factories/url.rb +34 -0
  177. data/spec/support/shared/feed_runner_observer.rb +136 -0
  178. data/spec/support/shared/feeds.rb +19 -4
  179. data/spec/support/shared/model/collection.rb +164 -0
  180. data/spec/threatinator/actions/run/action_spec.rb +27 -10
  181. data/spec/threatinator/actions/run/coverage_observer_spec.rb +39 -4
  182. data/spec/threatinator/actions/run/status_observer_spec.rb +86 -0
  183. data/spec/threatinator/event_builder_spec.rb +111 -21
  184. data/spec/threatinator/event_spec.rb +237 -13
  185. data/spec/threatinator/event_spec.rb.new +319 -0
  186. data/spec/threatinator/feed_builder_spec.rb +0 -3
  187. data/spec/threatinator/feed_runner_spec.rb +254 -70
  188. data/spec/threatinator/logger_spec.rb +29 -0
  189. data/spec/threatinator/model/observables/fqdn_collection_spec.rb +42 -0
  190. data/spec/threatinator/model/observables/ipv4_collection_spec.rb +36 -0
  191. data/spec/threatinator/model/observables/ipv4_spec.rb +75 -0
  192. data/spec/threatinator/model/observables/url_collection_spec.rb +45 -0
  193. data/spec/threatinator/model/validations/type_spec.rb +37 -0
  194. data/spec/threatinator/plugins/output/csv_spec.rb +4 -3
  195. metadata +216 -19
  196. data/lib/threatinator/property_definer.rb +0 -101
  197. data/spec/threatinator/property_definer_spec.rb +0 -155
data/spec/feeds/data/hosts-file_hphostspartial_domainlist.txt ADDED
@@ -0,0 +1,24 @@
1
+ # hosts-Partial.txt
2
+ #
3
+ # The following hosts were added to hpHosts AFTER the last full release.
4
+ #
5
+ #Last partial update: 9/5/2014 9:32:27 AM
6
+ #Last FULL hpHosts update: 201481651036
7
+ #DEBUG INFO:
8
+ # DB: 2014050993227
9
+ # File: 201416851036
10
+ # First: 1599283 (8/30/2014 5:52:43 PM)
11
+ # Last: 1546551
12
+ 127.0.0.1 0.cordelia8.waslittrefxwpc.eu
13
+ 127.0.0.1 0002.tonsciryqbty.eu
14
+ 127.0.0.1 0025.gaa08056.waslittrefxwpc.eu
15
+ 127.0.0.1 003a32c.rithertningiuao.eu
16
+ 127.0.0.1 004.bloglnewarciniabe.ru
17
+ 127.0.0.1 006e0ed5.bloglnewarcinialy.ru
18
+ 127.0.0.1 0071525d.bevedidnzbep.eu
19
+ 127.0.0.1 007c746.suburonounx.eu
20
+ 127.0.0.1 008845.bevedidnzbep.eu
21
+ 127.0.0.1 008845.tonsciryqbty.eu
22
+ 127.0.0.1 008f9e2.tonsciryqbty.eu
23
+ 127.0.0.1 009.blogfoxnewsators.ru
24
+ 127.0.0.1 009.bloglfoxnewsareb.ru
data/spec/feeds/data/infiltrated_vabl_iplist.txt ADDED
@@ -0,0 +1,33 @@
1
+
2
+ #
3
+ # Prior VABL list can be viewed at www.infiltrated.net/vabl-q1-2011.txt
4
+ # Prior VABL list can be viewed at www.infiltrated.net/vabl-q2-2011.txt
5
+
6
+ # WARNING: The new addition to this list is "APT" which is short for the
7
+ # listed here, it is listed for a reason. Use/block those IP addresses
8
+ # obvious "Advanced Persistent Threat" buzzword. The hosts listed with
9
+ # this flag are either C&C sources, pivots, and so forth. If it is
10
+ # with caution
11
+
12
+
13
+ 108.59.1.205 | BRU | VABL | 20110609 | e22b6e201b3533a0dd1ac8bb47426169 | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
14
+ 108.59.1.205 | BRU | VABL | 20110708 | 8850509672ee7d983d9a511e31b13a9a | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
15
+ 108.59.1.5 | BRU | VABL | 20110726 | 4fd0c880f8cbe31e4efc18890b4ac51a | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
16
+ 108.59.1.5 | BRU | VABL | 20110726 | fb17621acd4b0626c80ba8e66e963518 | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
17
+ 108.59.1.5 | BRU | VABL | 20110727 | 8850509672ee7d983d9a511e31b13a9a | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
18
+ 108.59.1.5 | BRU | VABL | 20110729 | 8850509672ee7d983d9a511e31b13a9a | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
19
+ 108.59.1.5 | BRU | VABL | 20110730 | 8850509672ee7d983d9a511e31b13a9a | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
20
+ 108.59.5.139 | BRU | VABL | 20110720 | 4fd0c880f8cbe31e4efc18890b4ac51a | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
21
+ 108.59.5.139 | BRU | VABL | 20110720 | fb17621acd4b0626c80ba8e66e963518 | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
22
+ 108.59.5.139 | BRU | VABL | 20110725 | 8850509672ee7d983d9a511e31b13a9a | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC
23
+ 108.85.139.165 | BRU | VABL | 20110611 | fb17621acd4b0626c80ba8e66e963518 | 7132 | 108.64.0.0/11 | SBIS-AS | US | ATT.COM | AT&T INTERNET SERVICES
24
+ 109.123.83.130 | BRU | VABL | 20110606 | 8850509672ee7d983d9a511e31b13a9a | 13213 | 109.123.64.0/18 | UK2NET | UK | THECOUNTRYKITTEN.COM | UK2 - LTD
25
+ 109.168.200.104 | ATK | HPOT | 20110818 | fb17621acd4b0626c80ba8e66e963518 | 34060 | 94.176.216.0/22 | TCCFR | RO | ELECTROSIM.RO | JUMP INTERNET SERVICES SRL
26
+ 109.168.200.104 | ATK | HPOT | 20110818 | fb17621acd4b0626c80ba8e66e963518 | 34104 | 91.93.32.0/21 | GLOBAL | TR | TELETEKTELEKOM.COM | GLOBAL ILETISIM HIZMETLERI A.S
27
+ 109.168.200.104 | ATK | HPOT | 20110819 | fb17621acd4b0626c80ba8e66e963518 | 34060 | 94.176.216.0/22 | TCCFR | RO | ELECTROSIM.RO | JUMP INTERNET SERVICES SRL
28
+ 109.168.200.104 | ATK | HPOT | 20110819 | fb17621acd4b0626c80ba8e66e963518 | 34104 | 91.93.32.0/21 | GLOBAL | TR | TELETEKTELEKOM.COM | GLOBAL ILETISIM HIZMETLERI A.S
29
+ 109.169.60.121 | BRU | VABL | 20110618 | bf85b024eec53c533630a4551d9f63a7 | 29761 | 109.169.60.0/23 | OC3-NETWORKS-AS-NUMB | US | BMTRADAGROUP.COM | RAPIDSWITCH LTD
30
+ 109.169.60.121 | BRU | VABL | 20110621 | 8850509672ee7d983d9a511e31b13a9a | 29761 | 109.169.60.0/23 | OC3-NETWORKS-AS-NUMB | US | BMTRADAGROUP.COM | RAPIDSWITCH LTD
31
+ 109.169.60.121 | BRU | VABL | 20110622 | bf85b024eec53c533630a4551d9f63a7 | 29761 | 109.169.60.0/23 | OC3-NETWORKS-AS-NUMB | US | BMTRADAGROUP.COM | RAPIDSWITCH LTD
32
+ 109.169.60.121 | BRU | VABL | 20110711 | 8850509672ee7d983d9a511e31b13a9a | 29761 | 109.169.60.0/23 | OC3-NETWORKS-AS-NUMB | US | AIMSDESPATCH.COM | RAPIDSWITCH LTD
33
+ 109.169.60.121 | BRU | VABL | 20110713 | 4fd0c880f8cbe31e4efc18890b4ac51a | 29761 | 109.169.60.0/23 | OC3-NETWORKS-AS-NUMB | US | AIMSDESPATCH.COM | RAPIDSWITCH LTD
data/spec/feeds/data/isc_suspicious_high_domainlist.txt ADDED
@@ -0,0 +1,26 @@
1
+
2
+ #
3
+ # DShield.org Suspicious Domain List
4
+ # (c) 2014 DShield.org
5
+ # some rights reserved. Details http://creativecommons.org/licenses/by-nc-sa/2.5/
6
+ # use on your own risk. No warranties implied.
7
+ # primary URL: http://www.dshield.org/feeds/suspiciousdomains_High.txt
8
+ #
9
+ # comments: info@dshield.org
10
+ # updated: Fri Sep 12 04:27:04 2014 UTC
11
+ #
12
+ # This list consists of High Level Sensitivity website URLs
13
+ # Columns (tab delimited):
14
+ #
15
+ # (1) site
16
+ #
17
+ Site
18
+ 000007.ru
19
+ 000cc.com
20
+ 09cd.co.kr
21
+ 1-verygoods.ru
22
+ 10kpictures.com
23
+ 114bds.com
24
+ 114oldest.com
25
+ 120a.com
26
+ 123kochi.com
data/spec/feeds/data/isc_suspicious_low_domainlist.txt ADDED
@@ -0,0 +1,34 @@
1
+
2
+ #
3
+ # DShield.org Suspicious Domain List
4
+ # (c) 2014 DShield.org
5
+ # some rights reserved. Details http://creativecommons.org/licenses/by-nc-sa/2.5/
6
+ # use on your own risk. No warranties implied.
7
+ # primary URL: http://www.dshield.org/feeds/suspiciousdomains_Low.txt
8
+ #
9
+ # comments: info@dshield.org
10
+ # updated: Fri Sep 12 04:27:03 2014 UTC
11
+ #
12
+ # This list consists of Low Level Sensitivity website URLs
13
+ # Columns (tab delimited):
14
+ #
15
+ # (1) site
16
+ #
17
+ Site
18
+ 000007.ru
19
+ 000cc.com
20
+ 09cd.co.kr
21
+ 1-verygoods.ru
22
+ 10kpictures.com
23
+ 114bds.com
24
+ 114oldest.com
25
+ 120a.com
26
+ 123kochi.com
27
+ 123mdw.com
28
+ 13grandferi.ru
29
+ 1492tapasbar.com
30
+ 168asia.com
31
+ 18dd.net
32
+ 18xn.com
33
+ 19tenco.com
34
+ 1a-teensbilder.de
data/spec/feeds/data/isc_suspicious_medium_domainlist.txt ADDED
@@ -0,0 +1,32 @@
1
+
2
+ #
3
+ # DShield.org Suspicious Domain List
4
+ # (c) 2014 DShield.org
5
+ # some rights reserved. Details http://creativecommons.org/licenses/by-nc-sa/2.5/
6
+ # use on your own risk. No warranties implied.
7
+ # primary URL: http://www.dshield.org/feeds/suspiciousdomains_Medium.txt
8
+ #
9
+ # comments: info@dshield.org
10
+ # updated: Fri Sep 12 04:27:04 2014 UTC
11
+ #
12
+ # This list consists of Medium Level Sensitivity website URLs
13
+ # Columns (tab delimited):
14
+ #
15
+ # (1) site
16
+ #
17
+ Site
18
+ 000007.ru
19
+ 000cc.com
20
+ 09cd.co.kr
21
+ 1-verygoods.ru
22
+ 10kpictures.com
23
+ 114bds.com
24
+ 114oldest.com
25
+ 120a.com
26
+ 123kochi.com
27
+ 123mdw.com
28
+ 13grandferi.ru
29
+ 1492tapasbar.com
30
+ 168asia.com
31
+ 18dd.net
32
+ 18xn.com
data/spec/feeds/data/malwaredomainlist-url-reputation.txt ADDED
@@ -0,0 +1,8 @@
1
+ "2014/10/07_04:23","www.yehuam.com/dist/video.php?l=1","198.15.122.221","-","Leads to exploit, Malvertising","Registrar Abuse Contact abuse@enom.com","20454"
2
+ "2014/10/07_04:23","exkn0md6fh.qsdgi.com/azomytze3q","5.135.230.183","-","RIG EK","Registrar Abuse Contact abuse@web.com","16276"
3
+ "2014/10/01_09:34","radiology.starlightcapitaladvisors.net/dr/southeast/steve/dropdown.js","85.10.229.207","85-10-229-207.clients.your-server.de.","obfuscated script leads to exploit kit","-","24940"
4
+ "2014/10/01_09:30","avecat.missouritheatre.org:15106/full/cnstats/clients/stories.php?wink=322","87.118.127.230","ns2.km33436-26.keymachine.de.","exploit kit","T Fankhauser / artstaff@stjoearts.org","31103"
5
+ "2014/10/01_09:30","aveconomic.trailswest.org:15106/haddan_files/stories.php","87.118.127.230","ns2.km33436-26.keymachine.de.","exploit kit","T Fankhauser / artstaff@stjoearts.org","31103"
6
+ "2014/09/17_10:11","borneo.aqq79.com/wbxx3.html","217.23.5.88","customer.worldstream.nl.","frame leads to exploit kit","Registrar Abuse Contact domain@west263.com","49981"
7
+ "2014/09/17_10:11","asd.vicentelopez.us/vbign3s2pe","192.99.197.133","-","exploit kit","Virna Springer / virnaspringer2001@mail.com","16276"
8
+ "2014/09/17_10:11","qwe.affairedhonneur.us/depqfie59y","192.99.197.131","-","exploit kit","Ben Bazar / benbazar2011y@mail.com","16276"
data/spec/feeds/data/malwaredomains_domainlist.txt ADDED
@@ -0,0 +1,24 @@
1
+ ## notice notice duplication is not permitted
2
+ ## if you do not accept these terms, then do not use this information.
3
+ ## nextvalidation domain type original_reference-why_it_was_listed dateverified
4
+ ## for noncommercial use only. using this information indicates you agree to be bound by these terms.
5
+ 20161231 brenz.pl attackpage safebrowsing.clients.google.com 20140302 20131228 20110304 20100805 relisted
6
+ 20161231 retro-7-3.cz.cc harmful safebrowsing.clients.google.com 20140703 20131227 20130614 20120724 20110503 relisted
7
+ 20161231 38zu.cn attackpage safebrowsing.google.com 20140703 20140302 20130325 20120426 20110715
8
+ 20161231 pempoo.com attackpage safebrowsing.google.com 20140703 20140307 20131227 20120423 20110712
9
+ 20161230 gumblar.cn attackpage safebrowsing.clients.google.com 20140703 20140226 20131228 20130526 20110711 20100403
10
+ 20160601 cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com malware safebrowsing.google.com 20130611 20131228 20121227 20120724 20110319 relisted
11
+ 20160601 neepelsty.cz.cc attackpage www.google.com/interstitial?url=neepelsty.cz.cc 20130614 20131228 20121227 20120724 20110520 relisted
12
+ 20160601 x0a.in iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
13
+ 20160601 x1g.in iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
14
+ 20160601 x3v.in iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
15
+ 20160601 x5o.ru iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
16
+ 20160601 x6i.ru iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
17
+ 20160601 x6p.in iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
18
+ 20160601 x3b.ru attackpage google.com/safebrowsing 20131226 20110311 20090913
19
+ 20160601 x0c.ru malware hosts-file.net/?s=80.93.90.88&view=history 20131226 20110311 20090830
20
+ 20160601 x3y.ru malware hosts-file.net/?s=80.93.90.88&view=history 20131226 20110311 20090830
21
+ 20160601 x9m.ru malware hosts-file.net/?s=80.93.90.88&view=history 20131226 20110311 20090830
22
+ 20160601 x8l.in iframe safebrowsing.google.com 20131226 20110311 20090826
23
+ 20160601 x8o.ru iframe safebrowsing.google.com 20131226 20110311 20090826
24
+ 20160601 x8v.ru iframe safebrowsing.google.com 20131226 20110311 20090826
data/spec/feeds/data/malwaredomains_dyndns_domainlist.txt ADDED
@@ -0,0 +1,34 @@
1
+
2
+ ## this is a listdynamic dns providers - for informational purposes only, use as a blocklist at your own risk
3
+ ##please send additions or corrrections to malwaredomains2@gmail23.com1 (remove numbers in email address)
4
+ #easydns4u.com
5
+ #freelancedeveloper.com
6
+ #ipupdater.com
7
+ #iwas2.net
8
+ #microtech.co.gg
9
+ #myip.us
10
+ #ohflip.com
11
+ #reidmail.com
12
+ #reidsville-dns.com
13
+ #sysopworld.com
14
+ #thebbs.org
15
+
16
+ 0000000000000000000000.com #from http://freedns.afraid.org
17
+ 020huahai.com malicious siteinspector.comodo.com/
18
+ 021christine.com malicious siteinspector.comodo.com/
19
+ 051.no malicious siteinspector.comodo.com/
20
+ 0815x.com #from http://freedns.afraid.org
21
+ 0bit.org #from http://freedns.afraid.org
22
+ 0wnz-u.com #from http://freedns.afraid.org
23
+ 0x.no #from http://freedns.afraid.org
24
+ 101main.com #from http://dns2go.com
25
+ 101main.net #from http://dns2go.com
26
+ 1040ezdotcom.com malicious siteinspector.comodo.com/
27
+ 120v.ac #from http://freedns.afraid.org
28
+ 1243.ru malicious siteinspector.comodo.com/
29
+ 12wildwood.ca #from http://freedns.afraid.org
30
+ 1313.pl #from http://freedns.afraid.org
31
+ 1337.cx #from http://freedns.afraid.org
32
+ 136k.com #from http://freedns.afraid.org
33
+ 17life.com #from http://freedns.afraid.org
34
+ 18videoclip.com harmful safebrowsing.clients.google.com
data/spec/feeds/data/malwaredomains_justdomains_domainlist.txt ADDED
@@ -0,0 +1,18 @@
1
+ brenz.pl
2
+ retro-7-3.cz.cc
3
+ 38zu.cn
4
+ pempoo.com
5
+ gumblar.cn
6
+ cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com
7
+ neepelsty.cz.cc
8
+ x0a.in
9
+ x1g.in
10
+ x3v.in
11
+ x5o.ru
12
+ x6i.ru
13
+ x6p.in
14
+ x3b.ru
15
+ x0c.ru
16
+ x3y.ru
17
+ x9m.ru
18
+ x8l.in
data/spec/feeds/data/multiproxy_iplist.txt ADDED
@@ -0,0 +1,15 @@
1
+ 122.6.245.14:8090
2
+ 123.184.6.251:8088
3
+ 123.236.215.131:6588
4
+ 172.163.146.56:6588
5
+ 189.37.28.147:6588
6
+ 190.53.89.103:6588
7
+ 200.104.104.91:6588
8
+ 200.126.98.135:6588
9
+ 200.252.201.144:80
10
+ 201.42.59.201:6588
11
+ 202.134.202.226:80
12
+ 211.140.151.214:8080
13
+ 212.12.114.252:3128
14
+ 218.252.37.227:808
15
+ 59.95.1.229:6588
data/spec/feeds/data/openphish-url-reputation.txt ADDED
@@ -0,0 +1,16 @@
1
+ http://22872.in/
2
+ http://www.sikaram.lk/wp-content/uploads/10421312312/19890907.html
3
+ http://www.seventoons.com/includes/languages/espanol/images/sfre/9a8c90c1e89a8d9660b5eb59308d5f15/cas.php?clicid=13698&default=031c2011f7b699ad4676d01035827f44
4
+ http://www.alternativ-credit.fr/includes/html/classic/ibks/bradesco/?WLMFKUGXUPHVZUFEZWIKYHYWGUGPFXEPNGOFZEYGTSTNTWUIYMFIRLZTUUNVRNTNPTMSTZKZKNITNRNPHLKWYKOZMXWSJYKWY
5
+ http://www.alternativ-credit.fr/includes/html/classic/ibks/bradesco/?ZNLROJIJRSSTQWEGUKKYXWQJKMPRLJNOYVHNXTGSJVTNPLTPTKEOLVHGSLXXIURSPFWXHYNKSWJSYNQZKRGXMSRLZVTGRVXPNJTV
6
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/4db64aeb194a008c3589ca0252caf430/14526566c864daf0a9cf4f6cc527b315/884c7f2309881eef92d29429c9b15f32/95a77b9c4a1258900b96726a003351ec/a06ae15727fc9b5a8daf9a61563a9b2a/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
7
+ http://www.jacks-music.co.uk/wp-admin/a/e4f701810e80c05c0533876dd4b4246d/97286d2ffb4c29125e8534b5f34eac1f/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
8
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/4db64aeb194a008c3589ca0252caf430/14526566c864daf0a9cf4f6cc527b315/6f9b49ea7ad3bd488d03146e455585f7/c144bd8041f407331fe66af1d6c07c51/8c3f20513475139edeccc7f47f237552/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
9
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/4db64aeb194a008c3589ca0252caf430/14526566c864daf0a9cf4f6cc527b315/884c7f2309881eef92d29429c9b15f32/95a77b9c4a1258900b96726a003351ec/bfe3005edf73b44b6c18a88ddf633d08/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
10
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/4db64aeb194a008c3589ca0252caf430/14526566c864daf0a9cf4f6cc527b315/d5f8fba1e788b4723fb87c788aae85a7/d5c3a11c45b2d46ff81cd25281d43510/2102dde13e5e7dcb942d34af83a59c31/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
11
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/40001ba92bc71fa1a87cbd6014c6a93c/f855e92746daac9349ec8606bc21dc1c/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
12
+ http://190.86.185.227/Site-Seguro-SSL/Cadastramento/
13
+ http://www.turesidenciapremium.com/Trader/trade/index.html
14
+ http://datosfiscales.com/plugins/connect/portfolio/index.htm
15
+ http://www.thethreetouch.com/thai/store/images/stories/safepay.wellsfargo.com/index.php
16
+ http://www.
data/spec/feeds/data/packetmail_perimeterbad-ip_reputation.txt ADDED
@@ -0,0 +1,44 @@
1
+ # Disclaimer - You may not use this list without acceptance of the below:
2
+ #
3
+ # The following IP addresses have made HTTP/HTTPS requests to files that are either non-existent or denied by configuration to
4
+ # unique and new URLs over the past 30 days.
5
+ #
6
+ # No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts.
7
+ # Use this list at your own risk. By using this list in any capacity or capability you release all claims of damages and shall not hold or perceive any
8
+ # liability against the publisher for: damage, unexpected events or results, decision, or reputation damage, even those resulting from wilful
9
+ # or intentional neglect.
10
+ #
11
+ # No claims made against this data shall be honored; no assertions have been made about the quality, accuracy, usability, actionability,
12
+ # reputation, merit, or hostility of the below findings.
13
+ #
14
+ # If you feel that an IP address is inaccurately listed below please contact me at any RFC822 6.3, RFC1123 5.2.7, or RFC2821 4.5.1
15
+ # address associated with this domain.
16
+ #
17
+ # This list may not be included in any 'for-sale' component and may not be included in pay-wall subscription-based services except
18
+ # for organizations that I have explicitly given permission to by E-Mail which has been GPG signed using Key ID 0x37085D70.
19
+ #
20
+ # Changelog:
21
+ # Thu Sep 04 2014 - Initial Development
22
+ #
23
+ # This file contains these \x09 (TAB) separated fields:
24
+ # date_time string Time the request was received (standard english format)
25
+ # remote_ip string Remote IP-address
26
+ # server_name string The server name according to the UseCanonicalName setting
27
+ # status string Status. For requests that got internally redirected, this is the status of the original request
28
+ # request string The first line of the request
29
+ # http_referer string HTTP Referer
30
+ # user_agent string HTTP User-Agent
31
+ # day string Day in YYYY-MM-DD format
32
+ #
33
+ #
34
+ # This list was last updated on Thu Sep 4 10:16:10 CDT 2014
35
+ #
36
+ [03/Sep/2014:13:11:47 -0500] 192.99.152.38 206.82.85.197 403 GET /cc/process.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
37
+ [03/Sep/2014:10:06:47 -0500] 110.45.241.238 206.82.85.197 403 POST /cfg HTTP/1.1 - - 2014-09-03
38
+ [03/Sep/2014:13:11:47 -0500] 192.99.152.38 206.82.85.197 403 GET /process.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
39
+ [03/Sep/2014:09:48:18 -0500] 62.210.167.201 206.82.85.197 403 GET /mad/inc/config.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
40
+ [03/Sep/2014:05:39:48 -0500] 192.99.166.102 206.82.85.197 403 GET /Panel/bins.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
41
+ [03/Sep/2014:05:39:48 -0500] 192.99.166.102 206.82.85.197 403 GET /jackposprivate12/bins.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
42
+ [03/Sep/2014:05:39:48 -0500] 192.99.166.102 206.82.85.197 403 GET /jack/bins.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
43
+ [03/Sep/2014:18:06:59 -0500] 69.28.85.204 www.hackbraten.tk 403 HEAD /Hackbraten.zip HTTP/1.1 - curl/7.32.0 2014-09-03
44
+
data/spec/feeds/data/snort_bpf-ip_reputation.txt ADDED
@@ -0,0 +1,16 @@
1
+ 212.89.13.111
2
+ 46.242.145.99
3
+ 91.220.62.190
4
+ 91.220.62.112
5
+ 91.213.217.36
6
+ 194.44.157.130
7
+ 193.107.17.62
8
+ 193.106.31.12
9
+ 94.63.149.51
10
+ 93.171.202.70
11
+ 204.16.169.2
12
+ 182.160.162.65
13
+ 91.228.154.199
14
+ 76.74.184.23
15
+ 85.214.26.248
16
+ 80.48.62.18
data/spec/feeds/data/steeman-ip-reputation.txt ADDED
@@ -0,0 +1,13 @@
1
+ # 2104 Block List (IPV4 IP addresses to avoid contact with) - Jeron Steeman - http://jeroen.steeman.org
2
+ # Created: 10/3/2014 4:00:24 PM
3
+ 1.0.253.17
4
+ 1.1.153.136
5
+ 1.10.220.118
6
+ 1.10.221.14
7
+ 1.10.221.78
8
+ 1.10.253.13
9
+ 1.161.123.10
10
+ 1.162.217.96
11
+ 1.168.163.133
12
+ 1.168.242.142
13
+ 1.169.45.13
data/spec/feeds/data/trustedsec-ip-reputation.txt ADDED
@@ -0,0 +1,12 @@
1
+ #
2
+ 100.1.176.8
3
+ 100.42.209.114
4
+ 100.42.227.89
5
+ 100.42.229.73
6
+ 100.42.74.90
7
+ 101.0.4.104
8
+ 101.0.4.108
9
+ 101.0.53.229
10
+ 101.0.5.88
11
+ 101.0.5.90
12
+ 101.108.127.106
data/spec/feeds/data/virbl-ip_reputation.txt ADDED
@@ -0,0 +1,14 @@
1
+ Export date: Fri Sep 5 16:07:01 2014
2
+ 39.31.123.178
3
+ 163.16.166.9
4
+ 5.164.174.1
5
+ 180.4.151.67
6
+ 103.178.151.119
7
+ 193.20.147.167
8
+ 50.242.226.97
9
+ 208.159.51.152
10
+ 181.107.101.162
11
+ 37.84.148.198
12
+ 40.188.94.4
13
+ 171.136.38.9
14
+ 209.167.192.55
data/spec/feeds/data/vxvault-url-reputation.txt ADDED
@@ -0,0 +1,15 @@
1
+ VX Vault last 100 Links
2
+ Mon, 06 Oct 2014 16:14:20 +0200
3
+
4
+ http://alles-99cent.de/public_html/xtcommerce/Judaslods23.exe
5
+ http://46.30.42.178/1/bot.exe
6
+ http://liqweed.alwaysdata.net/z/bot.exe
7
+ http://icbcasia.info/7/serverphp/bot.exe
8
+ http://fiu-eu.org/4/serverphp/bot.exe
9
+ http://esum.org.in/01/serverphp/bot.exe
10
+ http://xoho.in/grace/bot.exe
11
+ http://love.saleb.ru/g0zilla.exe
12
+ http://lnstgram.com/Java32.exe
13
+ http://103.26.128.84/botnet/1/installer.exe
14
+ http://46.30.42.178/1/bot.exe
15
+ http://iappem.com.br/images/109x090191.jpg
data/spec/feeds/data/yoyo_adservers.txt ADDED
@@ -0,0 +1,25 @@
1
+ 101com.com
2
+ 101order.com
3
+ 123found.com
4
+ 180hits.de
5
+ 180searchassistant.com
6
+ 1x1rank.com
7
+ 207.net
8
+ 247media.com
9
+ 24log.com
10
+ 24log.de
11
+ 24pm-affiliation.com
12
+ 2mdn.net
13
+ 2o7.net
14
+ 360yield.com
15
+ 4affiliate.net
16
+ 4d5.net
17
+ 50websads.com
18
+ 518ad.com
19
+ 51yes.com
20
+ 600z.com
21
+ 777partner.com
22
+ 777seo.com
23
+ 77tracking.com
24
+ 7adpower.com
25
+ 7bpeople.com