new: abuse.ch lists - SSLBlacklist, ThreatFox

bgpranking/parsers/abusech_threatfox.py

@@ -0,0 +1,15 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import json
+
+from io import BytesIO
+from typing import List
+
+
+def parse_raw_file(self, f: BytesIO) -> List[str]:
+    to_return = []
+    for entry in json.loads(f.getvalue().decode()).values():
+        ip_port = entry[0]['ioc_value']
+        to_return.append(ip_port.split(':')[0])
+    return to_return

config/modules/RansomwareIPBlockList.json

@@ -1,7 +0,0 @@
-{
-  "url": "https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt",
-  "vendor": "ransomwaretracker",
-  "name": "ipblocklist",
-  "impact": 7,
-  "parser": ".parsers.abusech"
-}

config/modules/SSLBlacklist.json

@@ -0,0 +1,7 @@
+{
+  "url": "https://sslbl.abuse.ch/blacklist/sslipblacklist.txt",
+  "vendor": "abuse.ch",
+  "name": "blacklist",
+  "impact": 7,
+  "parser": ".parsers.abusech"
+}

config/modules/ThreatFoxIOC.json

@@ -0,0 +1,7 @@
+{
+  "url": "https://threatfox.abuse.ch/export/json/ip-port/recent/",
+  "vendor": "abuse.ch",
+  "name": "threatfox",
+  "impact": 5,
+  "parser": ".parsers.abusech_threatfox"
+}