MISP
/
misp-warninglists
mirror of https://github.com/MISP/misp-warninglists
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #154 from Wiscy-Security/main 

Refactoring of code + updates of warninglists
pull/157/head
Alexandre Dulaunoy 2020-07-27 10:07:44 +02:00 committed by GitHub
parent 79dc2cba16 610292e90f
commit 23418c5483
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
47 changed files with 97177 additions and 112104 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
.gitignore vendored Normal file
View File

@ -0,0 +1,20 @@
# files download by generators
alexa_top-1m.csv.zip
amazon_ip-ranges.json
cisco_top-1m.csv.zip
cloudflare_ips-v4.txt
cloudflare_ips-v6.txt
IncludedCACertificateReportPEMCSV.csv
majestic_million.csv
ocsp_crl-hostnames.txt
ocsp_crl-ipv4.txt
ocsp_crl-ipv6.txt
ocsp_ocsp-hostnames.txt
ocsp_ocsp-ipv4.txt
ocsp_ocsp-ipv6.txt
PublicAllIntermediateCertsWithPEMCSV.csv
top500.domains.csv
top500.pages.csv
top-1m.csv.zip
public-dns-nameservers.csv
ms-azure.json

772
lists/alexa/list.json
View File

File diff suppressed because it is too large Load Diff

296
lists/amazon-aws/list.json
View File

@ -12,6 +12,7 @@
"108.128.0.0/13",
"108.128.160.0/23",
"108.128.162.0/24",
"108.136.0.0/15",
"108.166.224.0/21",
"108.166.232.0/21",
"108.166.240.0/21",
@ -39,6 +40,7 @@
"122.248.192.0/18",
"13.112.0.0/14",
"13.112.191.184/29",
"13.113.196.64/26",
"13.113.203.0/24",
"13.124.0.0/16",
"13.124.145.16/29",
@ -64,6 +66,7 @@
"13.232.67.128/27",
"13.232.67.160/27",
"13.233.177.0/29",
"13.233.177.192/26",
"13.234.221.192/26",
"13.234.8.0/23",
"13.235.228.0/24",
@ -74,6 +77,7 @@
"13.236.82.96/27",
"13.239.158.0/29",
"13.244.0.0/15",
"13.244.121.196/30",
"13.248.0.0/20",
"13.248.100.0/24",
"13.248.101.0/24",
@ -120,10 +124,21 @@
"13.251.113.64/26",
"13.251.116.0/23",
"13.32.0.0/15",
"13.34.22.160/27",
"13.34.22.192/27",
"13.34.22.224/27",
"13.34.23.0/27",
"13.34.23.128/27",
"13.34.23.160/27",
"13.34.23.192/27",
"13.34.23.32/27",
"13.34.23.64/27",
"13.34.23.96/27",
"13.35.0.0/16",
"13.48.0.0/15",
"13.48.186.128/27",
"13.48.186.160/27",
"13.48.32.0/24",
"13.48.4.192/29",
"13.48.4.200/30",
"13.48.74.0/24",
@ -150,6 +165,7 @@
"143.204.0.0/16",
"144.220.0.0/16",
"15.161.0.0/16",
"15.161.135.164/30",
"15.164.0.0/15",
"15.164.156.0/23",
"15.164.243.192/27",
@ -179,8 +195,12 @@
"15.177.89.0/24",
"15.177.90.0/24",
"15.177.91.0/24",
"15.184.0.0/16",
"15.185.0.0/16",
"15.188.0.0/16",
"15.188.184.0/24",
"15.188.210.196/30",
"15.188.210.200/30",
"15.188.210.32/27",
"15.188.210.64/27",
"15.193.0.0/19",
@ -198,11 +218,14 @@
"15.200.0.0/16",
"15.200.28.80/30",
"15.206.0.0/15",
"15.207.13.128/25",
"15.221.0.0/24",
"15.221.1.0/24",
"15.221.16.0/22",
"15.221.2.0/24",
"15.221.20.0/22",
"15.221.24.0/21",
"15.221.3.0/24",
"15.221.4.0/23",
"15.221.8.0/21",
"15.222.0.0/15",
@ -211,6 +234,9 @@
"15.223.100.0/24",
"15.223.102.0/23",
"15.228.0.0/15",
"15.230.0.0/24",
"15.230.129.0/24",
"15.230.130.0/24",
"15.230.18.0/24",
"15.230.21.0/24",
"15.230.22.0/24",
@ -222,6 +248,8 @@
"15.230.31.0/24",
"15.230.32.0/24",
"15.230.35.0/24",
"15.230.36.176/28",
"15.230.36.192/32",
"15.230.38.0/24",
"15.230.39.0/31",
"15.230.39.10/31",
@ -351,7 +379,20 @@
"15.230.39.94/31",
"15.230.39.96/31",
"15.230.39.98/31",
"15.230.40.0/24",
"15.230.41.0/24",
"15.230.42.0/24",
"15.230.5.0/24",
"15.230.6.0/24",
"15.230.64.0/26",
"15.230.64.128/26",
"15.230.64.192/26",
"15.230.64.64/26",
"15.230.65.0/26",
"15.230.65.128/26",
"15.230.65.192/26",
"15.230.65.64/26",
"15.230.66.0/26",
"15.236.0.0/15",
"15.254.0.0/16",
"150.222.10.0/24",
@ -374,6 +415,19 @@
"150.222.119.0/24",
"150.222.12.0/24",
"150.222.121.0/24",
"150.222.122.100/31",
"150.222.122.102/31",
"150.222.122.104/31",
"150.222.122.106/31",
"150.222.122.108/31",
"150.222.122.110/31",
"150.222.122.112/31",
"150.222.122.114/31",
"150.222.122.116/31",
"150.222.122.92/31",
"150.222.122.94/31",
"150.222.122.96/31",
"150.222.122.98/31",
"150.222.129.112/31",
"150.222.129.114/31",
"150.222.129.116/31",
@ -405,6 +459,7 @@
"150.222.199.0/25",
"150.222.2.0/24",
"150.222.202.0/24",
"150.222.203.0/24",
"150.222.204.0/24",
"150.222.205.0/24",
"150.222.206.0/24",
@ -572,6 +627,8 @@
"177.72.240.0/21",
"178.236.0.0/20",
"18.130.0.0/16",
"18.130.91.144/30",
"18.130.91.148/30",
"18.132.0.0/14",
"18.132.21.0/24",
"18.132.22.0/23",
@ -582,6 +639,8 @@
"18.140.0.0/15",
"18.141.152.0/24",
"18.141.154.0/23",
"18.141.66.248/30",
"18.141.66.252/30",
"18.142.0.0/15",
"18.144.0.0/15",
"18.144.158.0/27",
@ -595,6 +654,7 @@
"18.166.0.0/15",
"18.175.0.0/16",
"18.176.0.0/15",
"18.176.203.120/30",
"18.178.0.0/16",
"18.179.0.0/16",
"18.179.48.128/27",
@ -636,6 +696,9 @@
"18.228.70.32/29",
"18.229.0.0/16",
"18.229.100.0/26",
"18.229.100.112/30",
"18.229.100.116/30",
"18.229.220.192/26",
"18.229.99.0/24",
"18.230.0.0/16",
"18.230.103.0/24",
@ -726,6 +789,7 @@
"2400:7fc0:2a00::/40",
"2400:7fc0:2c00::/40",
"2400:7fc0:2f00::/40",
"2400:7fc0:4000::/40",
"2400:7fc0:8000::/36",
"2400:7fc0::/40",
"2403:b300:ff00::/64",
@ -740,6 +804,7 @@
"2404:c2c0:2a00::/40",
"2404:c2c0:2c00::/40",
"2404:c2c0:2f00::/40",
"2404:c2c0:4000::/40",
"2404:c2c0:8000::/36",
"2404:c2c0::/40",
"2406:da00:1000::/40",
@ -767,6 +832,14 @@
"2406:da1c::/36",
"2406:da1c:fff:f800::/53",
"2406:da1e::/32",
"2406:da70:1000::/40",
"2406:da70:2000::/40",
"2406:da70:4000::/40",
"2406:da70:6000::/40",
"2406:da70:8000::/40",
"2406:da70:a000::/40",
"2406:da70:c000::/40",
"2406:da70:e000::/40",
"2406:daa0:1000::/40",
"2406:daa0:2000::/40",
"2406:daa0:4000::/40",
@ -887,6 +960,14 @@
"2600:1f1e:fff:f800::/53",
"2600:1f1f::/36",
"2600:1f60:6000::/40",
"2600:1f70:1000::/40",
"2600:1f70:2000::/40",
"2600:1f70:4000::/40",
"2600:1f70:5000::/40",
"2600:1f70:6000::/40",
"2600:1f70:8000::/40",
"2600:1f70:c000::/40",
"2600:1f70:e000::/40",
"2600:1fa0:1000::/40",
"2600:1fa0:2000::/40",
"2600:1fa0:4000::/40",
@ -928,6 +1009,11 @@
"2600:1ffc:8000::/40",
"2600:1ffc:c000::/40",
"2600:1ffc:e000::/40",
"2600:1ffd:807f::/48",
"2600:1ffd:80cb::/48",
"2600:1ffd:80e1::/48",
"2600:1ffd:8190::/48",
"2600:1ffd:857f::/48",
"2600:1ffe:1000::/40",
"2600:1ffe:2000::/40",
"2600:1ffe:4000::/40",
@ -981,6 +1067,7 @@
"2620:107:4000:7700::/56",
"2620:107:4000:7800::/56",
"2620:107:4000:7a00::/56",
"2620:107:4000:a080::/58",
"2620:107:4007::/64",
"2620:107:4008::/45",
"2620:108:7000::/44",
@ -1018,6 +1105,13 @@
"2a05:d01a::/36",
"2a05:d01c::/36",
"2a05:d01e::/36",
"2a05:d03a:2000::/40",
"2a05:d03a:4000::/40",
"2a05:d03a:6000::/40",
"2a05:d03a:8000::/40",
"2a05:d03a:a000::/40",
"2a05:d03a:c000::/40",
"2a05:d03a:e000::/40",
"2a05:d050:2000::/40",
"2a05:d050:4000::/40",
"2a05:d050:6000::/40",
@ -1071,19 +1165,26 @@
"3.0.5.32/29",
"3.10.127.32/27",
"3.10.17.0/25",
"3.10.17.128/25",
"3.10.201.64/27",
"3.101.0.0/16",
"3.101.52.208/30",
"3.101.52.212/30",
"3.104.0.0/14",
"3.104.82.0/23",
"3.105.172.0/22",
"3.11.53.0/24",
"3.112.0.0/14",
"3.112.162.0/23",
"3.112.23.0/29",
"3.112.64.0/23",
"3.112.96.160/27",
"3.113.218.0/26",
"3.113.218.76/30",
"3.12.0.0/16",
"3.12.216.0/22",
"3.12.23.88/30",
"3.12.23.92/30",
"3.120.0.0/14",
"3.120.181.40/29",
"3.122.128.0/23",
@ -1091,11 +1192,15 @@
"3.123.14.0/24",
"3.123.15.0/25",
"3.124.0.0/14",
"3.127.48.244/30",
"3.127.48.248/30",
"3.128.0.0/15",
"3.128.93.0/24",
"3.13.0.0/16",
"3.130.0.0/16",
"3.131.0.0/16",
"3.132.0.0/14",
"3.134.215.0/24",
"3.136.0.0/13",
"3.14.0.0/15",
"3.15.35.0/24",
@ -1111,20 +1216,31 @@
"3.216.144.0/23",
"3.216.148.0/22",
"3.217.228.0/22",
"3.218.180.0/22",
"3.224.0.0/12",
"3.227.250.128/25",
"3.231.2.0/25",
"3.234.232.224/27",
"3.235.112.0/21",
"3.235.189.100/30",
"3.235.189.96/30",
"3.236.169.192/26",
"3.236.48.0/23",
"3.24.0.0/14",
"3.248.0.0/13",
"3.248.186.92/30",
"3.248.244.240/30",
"3.249.28.0/23",
"3.25.43.0/24",
"3.25.44.0/23",
"3.25.47.28/30",
"3.25.47.32/30",
"3.32.0.0/16",
"3.34.0.0/15",
"3.34.37.0/24",
"3.34.38.0/23",
"3.34.89.192/30",
"3.34.89.196/30",
"3.5.0.0/20",
"3.5.128.0/22",
"3.5.132.0/23",
@ -1132,6 +1248,8 @@
"3.5.208.0/22",
"3.5.212.0/23",
"3.6.0.0/15",
"3.6.70.76/30",
"3.7.25.48/30",
"3.8.0.0/14",
"3.8.168.0/23",
"3.8.37.24/29",
@ -1140,6 +1258,8 @@
"3.9.94.0/24",
"3.91.171.128/25",
"3.96.0.0/15",
"3.96.2.68/30",
"3.96.2.72/30",
"34.192.0.0/12",
"34.195.252.0/24",
"34.208.0.0/12",
@ -1196,8 +1316,13 @@
"43.250.193.0/24",
"44.192.0.0/11",
"44.224.0.0/11",
"44.227.178.0/24",
"44.233.54.0/23",
"44.234.108.128/25",
"44.234.54.0/23",
"44.234.73.116/30",
"44.234.73.120/30",
"44.234.90.252/30",
"46.137.0.0/17",
"46.137.128.0/18",
"46.137.192.0/19",
@ -1258,8 +1383,11 @@
"52.144.200.64/26",
"52.144.201.128/26",
"52.144.201.64/26",
"52.144.205.0/26",
"52.144.208.0/31",
"52.144.208.128/26",
"52.144.208.192/26",
"52.144.208.2/31",
"52.144.208.64/26",
"52.144.209.0/26",
"52.144.209.128/26",
@ -1339,6 +1467,8 @@
"52.219.132.0/22",
"52.219.136.0/22",
"52.219.140.0/24",
"52.219.144.0/22",
"52.219.148.0/23",
"52.219.16.0/22",
"52.219.20.0/22",
"52.219.24.0/21",
@ -1455,15 +1585,11 @@
"52.88.0.0/15",
"52.9.0.0/16",
"52.90.0.0/15",
"52.92.0.0/20",
"52.92.128.0/17",
"52.92.16.0/20",
"52.92.252.0/22",
"52.92.32.0/22",
"52.92.40.0/21",
"52.92.48.0/22",
"52.92.60.0/22",
"52.92.72.0/22",
"52.92.76.0/22",
"52.92.88.0/22",
"52.93.0.0/24",
"52.93.1.0/24",
@ -1486,6 +1612,12 @@
"52.93.126.147/32",
"52.93.126.204/32",
"52.93.126.205/32",
"52.93.126.212/32",
"52.93.126.213/32",
"52.93.126.214/32",
"52.93.126.215/32",
"52.93.126.244/32",
"52.93.126.245/32",
"52.93.126.76/32",
"52.93.129.95/32",
"52.93.131.217/32",
@ -1516,16 +1648,140 @@
"52.93.156.0/22",
"52.93.16.0/24",
"52.93.17.0/24",
"52.93.178.128/32",
"52.93.178.129/32",
"52.93.178.130/32",
"52.93.178.131/32",
"52.93.178.132/32",
"52.93.178.133/32",
"52.93.178.134/32",
"52.93.178.135/32",
"52.93.178.136/32",
"52.93.178.137/32",
"52.93.178.138/32",
"52.93.178.139/32",
"52.93.178.140/32",
"52.93.178.141/32",
"52.93.178.142/32",
"52.93.178.143/32",
"52.93.178.144/32",
"52.93.178.145/32",
"52.93.178.146/32",
"52.93.178.147/32",
"52.93.178.148/32",
"52.93.178.149/32",
"52.93.178.150/32",
"52.93.178.151/32",
"52.93.178.152/32",
"52.93.178.153/32",
"52.93.178.154/32",
"52.93.178.155/32",
"52.93.178.156/32",
"52.93.178.157/32",
"52.93.178.158/32",
"52.93.178.159/32",
"52.93.178.160/32",
"52.93.178.161/32",
"52.93.178.162/32",
"52.93.178.163/32",
"52.93.178.164/32",
"52.93.178.165/32",
"52.93.178.166/32",
"52.93.178.167/32",
"52.93.178.168/32",
"52.93.178.169/32",
"52.93.178.170/32",
"52.93.178.171/32",
"52.93.178.172/32",
"52.93.178.173/32",
"52.93.178.174/32",
"52.93.178.175/32",
"52.93.178.176/32",
"52.93.178.177/32",
"52.93.178.178/32",
"52.93.178.179/32",
"52.93.178.180/32",
"52.93.178.181/32",
"52.93.178.182/32",
"52.93.178.183/32",
"52.93.178.184/32",
"52.93.178.185/32",
"52.93.178.186/32",
"52.93.178.187/32",
"52.93.178.188/32",
"52.93.178.189/32",
"52.93.178.190/32",
"52.93.178.191/32",
"52.93.178.192/32",
"52.93.178.193/32",
"52.93.178.194/32",
"52.93.178.195/32",
"52.93.178.196/32",
"52.93.178.197/32",
"52.93.178.198/32",
"52.93.178.199/32",
"52.93.178.200/32",
"52.93.178.201/32",
"52.93.178.202/32",
"52.93.178.203/32",
"52.93.178.204/32",
"52.93.178.205/32",
"52.93.178.206/32",
"52.93.178.207/32",
"52.93.178.208/32",
"52.93.178.209/32",
"52.93.178.210/32",
"52.93.178.211/32",
"52.93.178.212/32",
"52.93.178.213/32",
"52.93.178.214/32",
"52.93.178.215/32",
"52.93.178.216/32",
"52.93.178.217/32",
"52.93.178.218/32",
"52.93.178.219/32",
"52.93.178.220/32",
"52.93.178.221/32",
"52.93.178.222/32",
"52.93.178.223/32",
"52.93.178.224/32",
"52.93.178.225/32",
"52.93.178.226/32",
"52.93.178.227/32",
"52.93.178.228/32",
"52.93.178.229/32",
"52.93.178.230/32",
"52.93.178.231/32",
"52.93.178.232/32",
"52.93.178.233/32",
"52.93.178.234/32",
"52.93.178.235/32",
"52.93.18.178/32",
"52.93.18.179/32",
"52.93.19.236/32",
"52.93.19.237/32",
"52.93.193.192/32",
"52.93.193.193/32",
"52.93.193.194/32",
"52.93.193.195/32",
"52.93.193.196/32",
"52.93.193.197/32",
"52.93.193.198/32",
"52.93.193.199/32",
"52.93.193.200/32",
"52.93.193.201/32",
"52.93.193.202/32",
"52.93.193.203/32",
"52.93.2.0/24",
"52.93.20.0/24",
"52.93.21.14/32",
"52.93.21.15/32",
"52.93.236.0/24",
"52.93.237.0/24",
"52.93.240.146/31",
"52.93.240.148/31",
"52.93.240.150/31",
"52.93.240.152/31",
"52.93.245.0/24",
"52.93.247.0/25",
"52.93.248.0/24",
@ -1628,6 +1884,7 @@
"52.94.249.144/28",
"52.94.249.160/28",
"52.94.249.176/28",
"52.94.249.192/28",
"52.94.249.32/28",
"52.94.249.48/28",
"52.94.249.64/28",
@ -1661,8 +1918,6 @@
"52.95.111.0/24",
"52.95.112.0/20",
"52.95.128.0/21",
"52.95.136.0/23",
"52.95.138.0/24",
"52.95.142.0/23",
"52.95.144.0/24",
"52.95.145.0/24",
@ -1688,6 +1943,8 @@
"52.95.174.0/24",
"52.95.175.0/24",
"52.95.176.0/24",
"52.95.177.0/24",
"52.95.178.0/23",
"52.95.192.0/20",
"52.95.208.0/22",
"52.95.212.0/22",
@ -1699,6 +1956,7 @@
"52.95.228.0/24",
"52.95.229.0/24",
"52.95.230.0/24",
"52.95.235.0/24",
"52.95.239.0/24",
"52.95.24.0/22",
"52.95.240.0/24",
@ -1807,6 +2065,8 @@
"54.222.59.0/24",
"54.222.64.0/23",
"54.222.66.0/23",
"54.222.70.0/24",
"54.222.76.0/22",
"54.223.0.0/16",
"54.224.0.0/15",
"54.226.0.0/15",
@ -1816,7 +2076,6 @@
"54.230.0.0/16",
"54.231.0.0/17",
"54.231.128.0/19",
"54.231.160.0/19",
"54.231.192.0/20",
"54.231.232.0/21",
"54.231.244.0/22",
@ -1851,13 +2110,12 @@
"54.239.1.0/28",
"54.239.1.112/28",
"54.239.1.128/28",
"54.239.1.144/28",
"54.239.1.16/28",
"54.239.1.32/28",
"54.239.1.48/28",
"54.239.1.64/28",
"54.239.1.81/32",
"54.239.1.82/32",
"54.239.1.83/32",
"54.239.1.80/28",
"54.239.1.96/28",
"54.239.100.0/23",
"54.239.104.0/23",
@ -2015,6 +2273,10 @@
"64.252.111.0/24",
"64.252.112.0/24",
"64.252.113.0/24",
"64.252.114.0/24",
"64.252.115.0/24",
"64.252.116.0/24",
"64.252.117.0/24",
"64.252.128.0/18",
"64.252.64.0/18",
"64.252.64.0/24",
@ -2046,8 +2308,13 @@
"64.252.98.0/24",
"64.252.99.0/24",
"65.0.0.0/14",
"65.8.0.0/16",
"65.9.0.0/17",
"65.9.128.0/18",
"67.202.0.0/18",
"68.79.0.0/18",
"69.107.6.112/29",
"69.107.6.120/29",
"70.132.0.0/18",
"70.224.192.0/18",
"71.152.0.0/17",
@ -2059,6 +2326,7 @@
"79.125.0.0/17",
"87.238.80.0/21",
"96.127.0.0/17",
"99.77.128.0/18",
"99.77.128.0/24",
"99.77.129.0/24",
"99.77.130.0/24",
@ -2119,6 +2387,9 @@
"99.78.212.0/22",
"99.78.216.0/22",
"99.78.220.0/22",
"99.78.228.0/22",
"99.78.232.0/21",
"99.78.240.0/20",
"99.79.0.0/16",
"99.79.126.0/24",
"99.79.169.0/24",
@ -2150,6 +2421,7 @@
"99.82.188.0/22",
"99.83.128.0/17",
"99.83.64.0/21",
"99.83.98.0/24",
"99.84.0.0/16",
"99.86.0.0/16"
],
@ -2160,5 +2432,5 @@
],
"name": "List of known Amazon AWS IP address ranges",
"type": "cidr",
"version": 20200519
"version": 20200721
}

785
lists/cisco_top1000/list.json
View File

File diff suppressed because it is too large Load Diff

10014
lists/cisco_top10k/list.json Normal file
View File

File diff suppressed because it is too large Load Diff

20014
lists/cisco_top20k/list.json Normal file
View File

File diff suppressed because it is too large Load Diff

5014
lists/cisco_top5k/list.json Normal file
View File

File diff suppressed because it is too large Load Diff

2
lists/cloudflare/list.json
View File

@ -30,5 +30,5 @@
],
"name": "List of known Cloudflare IP ranges",
"type": "cidr",
"version": 20200210
"version": 20200721
}

56
lists/covid-19-cyber-threat-coalition-whitelist/list.json
View File

@ -3,10 +3,41 @@
"list": [
"2019novelcoronavirusoracle.com",
"3d.nicovideo.jp",
"3dcovid19.tech",
"aanvraagcoronapremie.be",
"account.nicovideo.jp",
"ads.nicovideo.jp",
"againstcovid19.com",
"agir-covid-19.com",
"agir-covid-19.fr",
"agir-covid-19.org",
"agir-covid19.com",
"agir-covid19.fr",
"agir-covid19.org",
"agircovid19.com",
"agircovid19.fr",
"agircovid19.org",
"alliance-covid-19.com",
"alliance-covid-19.fr",
"alliance-covid-19.org",
"alliance-covid19.com",
"alliance-covid19.fr",
"alliance-covid19.org",
"alliance-epidemie.com",
"alliance-epidemie.fr",
"alliance-epidemie.org",
"alliance-pandemie.com",
"alliance-pandemie.fr",
"alliance-pandemie.org",
"alliancecovid19.com",
"alliancecovid19.fr",
"alliancecovid19.org",
"allianceepidemie.com",
"allianceepidemie.fr",
"allianceepidemie.org",
"alliancepandemie.com",
"alliancepandemie.fr",
"alliancepandemie.org",
"alstoncoronavirusflash.com",
"alstoncoronavirusupdates.com",
"amazoncovid-19.com",
@ -19,6 +50,7 @@
"api.live2.nicovideo.jp",
"api.nicoad.nicovideo.jp",
"api.nicovideo.jp",
"app.coronaparty.fr",
"arcgis.com",
"asuntosdelsur.org",
"bag-coronavirus.ch",
@ -99,6 +131,7 @@
"corona.rki.de",
"corona.tuply.co.za",
"coronaboard.kr",
"coronaclock.live",
"coronacrisisbook.com",
"coronainusa.com",
"coronamap.site",
@ -152,7 +185,9 @@
"coronavirusoracle.co",
"coronavirusoracle.net",
"coronavirusoracle.us",
"coronavirusphishing.com",
"coronavirusstories.com",
"coronaworldometers.com",
"covd19oracle.com",
"covid--19-oracle.com",
"covid--19oracle.com",
@ -180,6 +215,7 @@
"covid-19-orcle.com",
"covid-19-racle.com",
"covid-19.alibabacloud.com",
"covid-19.amsterdam",
"covid-19.bccdc.ca",
"covid-19.chinadaily.com.cn",
"covid-19.chinatimes.com",
@ -279,6 +315,7 @@
"covid19-racle.com",
"covid19-survey.org",
"covid19-tokyo.netlify.com",
"covid19.amsterdam",
"covid19.banyumaskab.go.id",
"covid19.baoviet.com.vn",
"covid19.bnpb.go.id",
@ -374,8 +411,10 @@
"covid19responsefund.org",
"covid19stats.alberta.ca",
"covid19stats.live",
"covid19therapists.com",
"covid19tracker.ca",
"covid19vm01.azurewebsites.net",
"covid19washoe.com",
"covid1oracle.com",
"covid9oracle.com",
"covidabruzzo.it",
@ -405,6 +444,15 @@
"dev.nicovideo.jp",
"dic.nicovideo.jp",
"dnastack.com",
"don-covid-19.com",
"don-covid-19.fr",
"don-covid-19.org",
"don-covid19.com",
"don-covid19.fr",
"don-covid19.org",
"doncovid19.com",
"doncovid19.fr",
"doncovid19.org",
"earthflowerscorona.com",
"embed.nicovideo.jp",
"enpremiereligne.fr",
@ -467,6 +515,7 @@
"kawalcovid19.id",
"korona.ws",
"koronavirus.hr",
"koronavirususrpskoj.com",
"kracle-covid-19.com",
"kracle-covid19.com",
"kraclecovid-19.com",
@ -598,6 +647,7 @@
"pccovidupdate.com",
"portal.covid19india.org",
"projectcovid.org",
"promedical-covid19.com",
"public.api.nicovideo.jp",
"racle-covid-19.com",
"racle-covid19.com",
@ -605,6 +655,7 @@
"raclecovid19.com",
"res.ads.nicovideo.jp",
"resources-covid19canada.hub.arcgis.com",
"respuestasalcoronavirus.org",
"sacoronavirus.co.za",
"sagcovidistcor.cf",
"samu-coronavirus.com",
@ -614,6 +665,8 @@
"seiga.dev.nicovideo.jp",
"seiga.nicovideo.jp",
"servicecovid.tpasaigon.vn",
"severeacuterespiratorysyndromecoronavirus.com",
"severeacuterespiratorysyndromecoronavirus2.org",
"sgwuhan.xose.net",
"shiny.john-coene.com",
"site.nicovideo.jp",
@ -633,6 +686,7 @@
"ssl.seiga.nicovideo.jp",
"stayinghome.club",
"stirioficiale.ro",
"stopcoronavirusshop.com",
"stopcov.ge",
"stopcovid19.metro.tokyo.lg.jp",
"studi-soforthilfe-corona.org",
@ -708,5 +762,5 @@
],
"name": "Covid-19 Cyber Threat Coalition's Whitelist",
"type": "hostname",
"version": 20200407
"version": 20200721
}

53
lists/covid-19-krassi-whitelist/list.json
View File

@ -2,33 +2,72 @@
"description": "Krassimir's Covid-19 whitelist of known good Covid-19 related websites.",
"list": [
"akkure4covid.com",
"api.contracovid.com.br",
"app.contracovid.com.br",
"auxilio.caixa.gov.br",
"bag-coronavirus.ch",
"block-covid.org",
"campanhacoronavirus.barro.ce.gov.br",
"ciis.fmrp.usp.br",
"co19.oracle.com",
"combateaocoronavirus.feira.br",
"contracovid.com.br",
"corona-data.ch",
"corona-stats.co.za",
"coronamadrid.com",
"coronavirus.alemparaiba.mg.gov.br",
"coronavirus.amazonas.am.gov.br",
"coronavirus.ceara.gov.br",
"coronavirus.cl",
"coronavirus.datafree.co",
"coronavirus.es",
"coronavirus.es.gov.br",
"coronavirus.fapce.edu.br",
"coronavirus.gob.es",
"coronavirus.informa.poli.ufrj.br",
"coronavirus.itaborai.rj.gov.br",
"coronavirus.jhu.edu",
"coronavirus.ms.gov.br",
"coronavirus.navirai.ms.gov.br",
"coronavirus.pr.gov.br",
"coronavirus.pucgoias.edu.br",
"coronavirus.rj.gov.br",
"coronavirus.ro.gov.br",
"coronavirus.saude.gov.br",
"coronavirus.sc.gov.br",
"coronavirus.to.gov.br",
"covid-19-1-newhavenct.hub.arcgis.com",
"covid-19.es",
"covid-19.gob.es",
"covid-19.iglocska.eu",
"covid-calc.org",
"covid-misp.ncsc.gov.ie",
"covid.apollo247.com",
"covid.saude.gov.br",
"covid19-brazil-api.now.sh",
"covid19-phwstatement.nhs.wales",
"covid19.criciuma.sc.gov.br",
"covid19.doisvizinhos.pr.gov.br",
"covid19.es",
"covid19.figshare.com",
"covid19.gob.es",
"covid19.govt.nz",
"covid19.ifnoar.com.br",
"covid19.lapig.iesa.ufg.br",
"covid19.nhp.gov.in",
"covid19.oracle.com",
"covid19.unimedsudoeste.com.br",
"covid19healthbot.cdc.gov",
"covid19india.org",
"covid19japan.com",
"covid19nasfavelas.meurio.org.br",
"covid19sa.org",
"covidcuritiba.com.br",
"cucovid19.ie",
"foph-coronavirus.ch",
"gov.ie",
"hcacovid19form.com",
"hcacovidresearch.com",
"hispabot-covid19.ai",
"hispabot-covid19.app",
"hispabot-covid19.es",
@ -45,10 +84,20 @@
"hispabotcovid19.org",
"hsecovid19.ie",
"info-coronavirus.be",
"juntoscontracoronavirus.com.br",
"ncov2019.live",
"novocoronavirus.recife.pe.gov.br",
"ofsp-coronavirus.ch",
"pecontracoronavirus.pe.gov.br",
"sacoronavirus.co.za",
"saolucascoronavirus.com.br",
"suzanocoronavirus.com.br",
"ufsp-coronavirus.ch",
"viruscorona.cl"
"unimedcontracoronavirus.com.br",
"vassourascontraocorona.com.br",
"viruscorona.cl",
"vpncovid.sicredi.com.br",
"www.contracovid.com.br"
],
"matching_attributes": [
"domain",
@ -57,5 +106,5 @@
],
"name": "Covid-19 Krassi's Whitelist",
"type": "hostname",
"version": 20200407
"version": 20200721
}

174
lists/disposable-email/list.json
View File

@ -1,10 +1,7 @@
{
"description": "List of disposable email domains",
"list": [
"*.33mail.com",
"0-00.usa.cc",
"0-mail.com",
"001.igg.biz",
"027168.com",
"0815.ru",
"0815.ry",
@ -65,12 +62,13 @@
"1fsdfdsfsdf.tk",
"1mail.ml",
"1pad.de",
"1s.fr",
"1st-forms.com",
"1to1mail.org",
"1usemail.com",
"1webmail.info",
"1zhuan.com",
"2.0-00.usa.cc",
"2012-2016.ru",
"20email.eu",
"20email.it",
"20mail.eu",
@ -81,6 +79,7 @@
"20mm.eu",
"2120001.net",
"21cn.com",
"247web.net",
"24hourmail.com",
"24hourmail.net",
"2anom.com",
@ -94,7 +93,6 @@
"30minutemail.com",
"30wave.com",
"3202.com",
"333.igg.biz",
"33mail.com",
"36ru.com",
"3d-painting.com",
@ -108,6 +106,8 @@
"4gfdsgfdgfd.tk",
"4mail.cf",
"4mail.ga",
"4nextmail.com",
"4nmv.ru",
"4tb.host",
"4warding.com",
"4warding.net",
@ -159,12 +159,10 @@
"a45.in",
"a7996.com",
"aa5zy64.com",
"ab0.igg.biz",
"abacuswe.us",
"abakiss.com",
"abcmail.email",
"abilitywe.us",
"abnamro.usa.cc",
"abovewe.us",
"absolutewe.us",
"abundantwe.us",
@ -243,7 +241,6 @@
"al-qaeda.us",
"albionwe.us",
"alchemywe.us",
"alfaromeo.igg.biz",
"aliaswe.us",
"alienware13.com",
"aligamel.com",
@ -257,6 +254,7 @@
"alldirectbuy.com",
"allegiancewe.us",
"allegrowe.us",
"allemojikeyboard.com",
"allgoodwe.us",
"alliancewe.us",
"allinonewe.us",
@ -282,6 +280,7 @@
"amadeuswe.us",
"amail.club",
"amail.com",
"amail1.com",
"amail4.me",
"amazon-aws.org",
"amberwe.us",
@ -350,7 +349,6 @@
"asdasd.nl",
"asdasd.ru",
"ashleyandrew.com",
"asiarap.usa.cc",
"ask-mail.com",
"asorent.com",
"ass.pp.ua",
@ -358,10 +356,10 @@
"astroempires.info",
"asu.mx",
"asu.su",
"at.hm",
"at0mik.org",
"atnextmail.com",
"attnetwork.com",
"audi.igg.biz",
"augmentationtechnology.com",
"ausgefallen.info",
"auti.st",
@ -374,6 +372,7 @@
"avia-tonic.fr",
"avls.pt",
"awatum.de",
"awdrt.org",
"awiki.org",
"awsoo.com",
"axiz.org",
@ -396,7 +395,6 @@
"bartdevos.be",
"basscode.org",
"bauwerke-online.com",
"baxomale.ht.cx",
"bazaaboom.com",
"bbbbyyzz.info",
"bbhost.us",
@ -418,6 +416,7 @@
"bestchoiceusedcar.com",
"bestoption25.club",
"bestsoundeffects.com",
"besttempmail.com",
"betr.co",
"bgtmail.com",
"bgx.ro",
@ -441,8 +440,8 @@
"blip.ch",
"blnkt.net",
"blogmyway.org",
"blogos.net",
"blogspam.ro",
"blow-job.nut.cc",
"bluedumpling.info",
"bluewerks.com",
"bnote.com",
@ -514,11 +513,12 @@
"carbtc.net",
"cars2.club",
"carsencyclopedia.com",
"cartelera.org",
"caseedu.tk",
"casualdx.com",
"cavi.mx",
"cbair.com",
"cc-cc.usa.cc",
"cbes.net",
"cc.liamria",
"cdpa.cc",
"ceed.se",
@ -528,14 +528,12 @@
"centermail.net",
"cetpass.com",
"cfo2go.ro",
"ch.tc",
"chacuo.net",
"chaichuang.com",
"chalupaurybnicku.cz",
"chammy.info",
"cheaphub.net",
"cheatmail.de",
"chechnya.conf.work",
"chibakenma.ml",
"chickenkiller.com",
"chielo.com",
@ -556,11 +554,13 @@
"cl0ne.net",
"claimab.com",
"clandest.in",
"classesmail.com",
"clearwatermail.info",
"click-email.com",
"clickdeal.co",
"clipmail.eu",
"clixser.com",
"cloudns.cx",
"clrmail.com",
"cmail.club",
"cmail.com",
@ -571,25 +571,25 @@
"cnew.ir",
"cnmsg.net",
"cnsds.de",
"co.cc",
"cobarekyo1.ml",
"cocovpn.com",
"codeandscotch.com",
"codivide.com",
"coieo.com",
"coin-host.net",
"coinlink.club",
"coldemail.info",
"compareshippingrates.org",
"completegolfswing.com",
"comwest.de",
"conf.work",
"consumerriot.com",
"contbay.com",
"cool.fr.nf",
"coolandwacky.us",
"coolimpool.org",
"coreclip.com",
"correo.blogos.net",
"cosmorph.com",
"courriel.fr.nf",
"courrieltemporaire.com",
"coza.ro",
"crankhole.com",
@ -726,8 +726,6 @@
"divismail.ru",
"diwaq.com",
"dlemail.ru",
"dm.w3internet.co.uk",
"dma.in-ulm.de",
"dmarc.ro",
"dndent.com",
"dnses.ro",
@ -793,7 +791,6 @@
"dyceroprojects.com",
"dz17.net",
"e-mail.com",
"e-mail.igg.biz",
"e-mail.org",
"e-marketstore.ru",
"e-tomarigi.com",
@ -831,8 +828,8 @@
"email-jetable.fr",
"email-lab.com",
"email-temp.com",
"email.cbes.net",
"email.net",
"email1.pro",
"email60.com",
"emailage.cf",
"emailage.ga",
@ -840,10 +837,10 @@
"emailage.ml",
"emailage.tk",
"emailate.com",
"emailcu.icu",
"emaildienst.de",
"emaildrop.io",
"emailfake.ml",
"emailfake.nut.cc",
"emailfreedom.ml",
"emailgo.de",
"emailias.com",
@ -854,6 +851,7 @@
"emailmiser.com",
"emailna.co",
"emailo.pro",
"emailondeck.com",
"emailportal.info",
"emailproxsy.com",
"emailresort.com",
@ -877,7 +875,6 @@
"emailto.de",
"emailure.net",
"emailwarden.com",
"emailx.at.hm",
"emailxfer.com",
"emailz.cf",
"emailz.ga",
@ -987,7 +984,6 @@
"fastyamaha.com",
"fatflap.com",
"fbma.tk",
"fbmail.usa.cc",
"fddns.ml",
"fdfdsfds.com",
"fer-gabon.org",
@ -1011,12 +1007,10 @@
"fivemail.de",
"fixmail.tk",
"fizmail.com",
"flashbox.5july.org",
"fleckens.hu",
"flemail.ru",
"flowu.com",
"flu-cc.flu.cc",
"flucc.flu.cc",
"flu.cc",
"fluidsoft.us",
"flurred.com",
"fly-ts.de",
@ -1034,6 +1028,7 @@
"fornow.eu",
"forspam.net",
"forward.cat",
"fosil.pro",
"foxja.com",
"foxtrotter.info",
"fr.nf",
@ -1043,6 +1038,7 @@
"frappina.tk",
"free-email.cf",
"free-email.ga",
"free-temp.net",
"freebabysittercam.com",
"freeblackbootytube.com",
"freecat.net",
@ -1054,7 +1050,6 @@
"freelance-france.eu",
"freeletter.me",
"freemail.ms",
"freemail.tweakly.net",
"freemails.cf",
"freemails.ga",
"freemails.ml",
@ -1092,6 +1087,7 @@
"g3xmail.top",
"g4hdrop.us",
"gafy.net",
"gage.ga",
"galaxy.tv",
"gally.jp",
"gamail.top",
@ -1116,7 +1112,6 @@
"gehensiemirnichtaufdensack.de",
"geldwaschmaschine.de",
"gelitik.in",
"gen.uu.gl",
"genderfuck.net",
"geronra.com",
"geschent.biz",
@ -1166,7 +1161,6 @@
"gmal.com",
"gmatch.org",
"gmial.com",
"gmx.fr.nf",
"gmx1mail.top",
"gmxmail.top",
"gmxmail.win",
@ -1184,7 +1178,6 @@
"gotmail.com",
"gotmail.net",
"gotmail.org",
"gotti.otherinbox.com",
"gowikibooks.com",
"gowikicampus.com",
"gowikicars.com",
@ -1206,6 +1199,8 @@
"gregorygamel.net",
"grish.de",
"griuc.schule",
"grn.cc",
"groupbuff.com",
"grr.la",
"gruz-m.ru",
"gs-arc.org",
@ -1320,16 +1315,13 @@
"hukkmu.tk",
"hulapla.de",
"humaility.com",
"humn.ws.gy",
"hungpackage.com",
"hushmail.cf",
"huskion.net",
"hvastudiesucces.nl",
"hwsye.net",
"i-phone.nut.cc",
"i2pmail.org",
"i6.cloudns.cc",
"i6.cloudns.cx",
"iaoss.com",
"ibnuh.bz",
"icantbelieveineedtoexplainthisshit.com",
@ -1343,6 +1335,7 @@
"iencm.com",
"iffymedia.com",
"ige.es",
"igg.biz",
"ignoremail.com",
"ihateyoualot.info",
"ihazspam.ca",
@ -1350,12 +1343,15 @@
"ikbenspamvrij.nl",
"illistnoise.com",
"ilovespam.com",
"imail1.net",
"imails.info",
"imailt.com",
"imgof.com",
"imgv.de",
"immo-gerance.info",
"imstations.com",
"imul.info",
"in-ulm.de",
"inbax.tk",
"inbound.plus",
"inbox.si",
@ -1410,6 +1406,7 @@
"irabops.com",
"irc.so",
"irish2me.com",
"irishspringrealty.com",
"iroid.com",
"ironiebehindert.de",
"irssi.tv",
@ -1420,29 +1417,23 @@
"isukrainestillacountry.com",
"it7.ovh",
"italy-mail.com",
"itfast.net",
"itunesgiftcodegenerator.com",
"iuemail.men",
"iwi.net",
"ixx.io",
"j-p.us",
"j8k2.usa.cc",
"jafps.com",
"jajxz.com",
"jamesbond.flu.cc",
"jamesbond.igg.biz",
"jamesbond.nut.cc",
"jamesbond.usa.cc",
"janproz.com",
"jaqis.com",
"jdmadventures.com",
"jdz.ro",
"je-recycle.info",
"jeie.igg.biz",
"jellow.ml",
"jellyrolls.com",
"jet-renovation.fr",
"jetable.com",
"jetable.fr.nf",
"jetable.net",
"jetable.org",
"jetable.pp.ua",
@ -1504,8 +1495,6 @@
"kingsq.ga",
"kino-100.ru",
"kiois.com",
"kir.ch.tc",
"kiryubox.cu.cc",
"kismail.ru",
"kisstwink.com",
"kitnastar.com",
@ -1533,8 +1522,6 @@
"krd.ag",
"krsw.tk",
"krypton.tk",
"ks87.igg.biz",
"ks87.usa.cc",
"ksmtrck.tk",
"kuhrap.com",
"kulmeo.com",
@ -1555,7 +1542,6 @@
"lacto.info",
"lags.us",
"lain.ch",
"lajoska.pe.hu",
"lak.pp.ua",
"lakelivingstonrealestate.com",
"lakqs.com",
@ -1577,6 +1563,7 @@
"legalrc.loan",
"lellno.gq",
"lenovog4.com",
"lerbhe.com",
"letmeinonthis.com",
"letthemeatspam.com",
"lez.se",
@ -1613,11 +1600,9 @@
"logular.com",
"loh.pp.ua",
"loin.in",
"lol.ovpn.to",
"lolfreak.net",
"lolmail.biz",
"lookugly.com",
"lopl.co.cc",
"lordsofts.com",
"lortemail.dk",
"losemymail.com",
@ -1645,20 +1630,24 @@
"maggotymeat.ga",
"magicbox.ro",
"maidlow.info",
"mail-card.net",
"mail-easy.fr",
"mail-filter.com",
"mail-help.net",
"mail-hub.info",
"mail-now.top",
"mail-owl.com",
"mail-share.com",
"mail-temporaire.com",
"mail-temporaire.fr",
"mail-tester.com",
"mail.by",
"mail.mezimages.net",
"mail.wtf",
"mail0.ga",
"mail1.top",
"mail114.net",
"mail1a.de",
"mail1web.org",
"mail21.cc",
"mail22.club",
"mail2rss.org",
@ -1667,6 +1656,7 @@
"mail666.ru",
"mail707.com",
"mail72.com",
"mailapp.top",
"mailback.com",
"mailbidon.com",
"mailbiz.biz",
@ -1711,6 +1701,7 @@
"mailhazard.com",
"mailhazard.us",
"mailhex.com",
"mailhub.pro",
"mailhz.me",
"mailimate.com",
"mailin8r.com",
@ -1723,7 +1714,6 @@
"mailinator.net",
"mailinator.org",
"mailinator.us",
"mailinator.usa.cc",
"mailinator0.com",
"mailinator1.com",
"mailinator2.com",
@ -1778,6 +1768,8 @@
"mailslapping.com",
"mailslite.com",
"mailsucker.net",
"mailt.net",
"mailt.top",
"mailtechx.com",
"mailtemp.info",
"mailtemporaire.com",
@ -1792,7 +1784,6 @@
"mailzi.ru",
"mailzilla.com",
"mailzilla.org",
"mailzilla.orgmbx.cc",
"mainerfolg.info",
"makemenaughty.club",
"makemetheking.com",
@ -1812,15 +1803,16 @@
"matamuasu.ga",
"matchpol.net",
"matra.site",
"max-mail.org",
"mbx.cc",
"mcache.net",
"mciek.com",
"mdhc.tk",
"meantinc.com",
"mebelnu.info",
"mechanicalresumes.com",
"medkabinet-uzi.ru",
"meepsheep.eu",
"mega.zik.dj",
"meinspamschutz.de",
"meltedbrownies.com",
"meltmail.com",
@ -1845,7 +1837,6 @@
"migumail.com",
"mihep.com",
"mijnhva.nl",
"milk.gage.ga",
"ministry-of-silly-walks.de",
"minsmail.com",
"mintemail.com",
@ -1873,14 +1864,10 @@
"momentics.ru",
"monachat.tk",
"monadi.ml",
"moncourrier.fr.nf",
"monemail.fr.nf",
"moneypipe.net",
"monmail.fr.nf",
"monumentmail.com",
"moonwake.com",
"moot.es",
"mor19.uu.gl",
"moreawesomethanyou.com",
"moreorcs.com",
"morriesworld.ml",
@ -1893,8 +1880,6 @@
"moza.pl",
"mozej.com",
"mp-j.ga",
"mp-j.igg.biz",
"mp.igg.biz",
"mr24.co",
"msgos.com",
"mspeciosa.com",
@ -1950,6 +1935,8 @@
"mytempmail.com",
"mytrashmail.com",
"mywarnernet.net",
"mywrld.site",
"mywrld.top",
"myzx.com",
"n1nja.org",
"nabuma.com",
@ -1960,7 +1947,6 @@
"naslazhdai.ru",
"nationalgardeningclub.com",
"nawmin.info",
"nbox.notif.me",
"nbzmr.com",
"negated.com",
"neomailbox.com",
@ -1968,6 +1954,7 @@
"nepwk.com",
"nervmich.net",
"nervtmich.net",
"net1mail.com",
"netmails.com",
"netmails.net",
"netricity.nl",
@ -1978,6 +1965,7 @@
"newbpotato.tk",
"newfilm24.ru",
"newideasfornewpeople.info",
"newmail.top",
"next.ovh",
"nextmail.info",
"nextstopvalhalla.com",
@ -2011,7 +1999,6 @@
"nomail.cf",
"nomail.ga",
"nomail.pw",
"nomail.xl.cx",
"nomail2me.com",
"nomorespamemails.com",
"nonspam.eu",
@ -2019,11 +2006,11 @@
"nonze.ro",
"noref.in",
"norseforce.com",
"nospam.ze.tc",
"nospam4.us",
"nospamfor.us",
"nospamthanks.info",
"nothingtoseehere.ca",
"notif.me",
"notmailinator.com",
"notrnailinator.com",
"notsharingmy.info",
@ -2035,8 +2022,7 @@
"nubescontrol.com",
"nullbox.info",
"nurfuerspam.de",
"nut-cc.nut.cc",
"nutcc.nut.cc",
"nut.cc",
"nutpa.net",
"nuts2trade.com",
"nwldx.com",
@ -2069,6 +2055,7 @@
"olypmall.ru",
"omail.pro",
"omnievents.org",
"one-mail.top",
"one-time.email",
"one2mail.info",
"oneoffemail.com",
@ -2084,14 +2071,17 @@
"oonies-shoprus.ru",
"oopi.org",
"opayq.com",
"openavz.com",
"opendns.ro",
"opentrash.com",
"opmmedia.ga",
"opp24.com",
"optimaweb.me",
"opwebw.com",
"oranek.com",
"ordinaryamerican.net",
"oreidresume.com",
"orgmbx.cc",
"oroki.de",
"oshietechan.link",
"otherinbox.com",
@ -2099,7 +2089,6 @@
"ourpreviewdomain.com",
"outlawspam.com",
"outmail.win",
"ovi.usa.cc",
"ovpn.to",
"owlpic.com",
"ownsyou.de",
@ -2122,7 +2111,7 @@
"pavilionx2.com",
"payperex2.com",
"payspun.com",
"pcusers.otherinbox.com",
"pe.hu",
"pecinan.com",
"pecinan.net",
"pecinan.org",
@ -2135,7 +2124,6 @@
"phone-elkey.ru",
"photo-impact.eu",
"photomark.net",
"phpbb.uu.gl",
"pi.vu",
"piaa.me",
"pig.pp.ua",
@ -2159,6 +2147,7 @@
"pokiemobile.com",
"polarkingxx.ml",
"politikerclub.de",
"polyfaust.net",
"pooae.com",
"poofy.org",
"pookmail.com",
@ -2172,6 +2161,7 @@
"postonline.me",
"poutineyourface.com",
"powered.name",
"powerencry.com",
"powlearn.com",
"ppetw.com",
"pqoia.com",
@ -2192,12 +2182,14 @@
"procrackers.com",
"profast.top",
"projectcl.com",
"promailt.com",
"proprietativalcea.ro",
"propscore.com",
"protempmail.com",
"proxymail.eu",
"proxyparking.com",
"prtnx.com",
"prtshr.com",
"prtz.eu",
"psh.me",
"psles.com",
@ -2219,11 +2211,13 @@
"qiq.us",
"qisdo.com",
"qisoa.com",
"qmrbe.com",
"qoika.com",
"qq.my",
"qsl.ro",
"qtum-ico.com",
"quadrafit.com",
"quick-mail.cc",
"quickemail.info",
"quickinbox.com",
"quickmail.nl",
@ -2234,7 +2228,6 @@
"ra3.us",
"rabin.ca",
"rabiot.reisen",
"radiku.ye.vc",
"raetp9.com",
"rainbowly.ml",
"raketenmann.de",
@ -2258,7 +2251,6 @@
"recode.me",
"reconmail.com",
"recyclemail.dk",
"reddit.usa.cc",
"redfeathercrow.com",
"reftoken.net",
"regbypass.com",
@ -2273,6 +2265,7 @@
"reptilegenetics.com",
"resgedvgfed.tk",
"revolvingdoorhoax.org",
"rfc822.org",
"rhyta.com",
"richfinances.pw",
"riddermark.de",
@ -2281,6 +2274,7 @@
"riski.cf",
"rklips.com",
"rkomo.com",
"rm2rf.com",
"rma.ec",
"rmqkr.net",
"rnailinator.com",
@ -2295,6 +2289,7 @@
"royal.net",
"royaldoodles.org",
"royalmarket.life",
"royandk.com",
"rppkn.com",
"rsvhr.com",
"rtrtr.com",
@ -2335,6 +2330,7 @@
"schafmail.de",
"schmeissweg.tk",
"schrott-email.de",
"scrsot.com",
"sd3.in",
"secmail.pw",
"secretemail.de",
@ -2342,10 +2338,6 @@
"secure-mail.cc",
"secured-link.net",
"securehost.com.es",
"securemail.flu.cc",
"securemail.igg.biz",
"securemail.nut.cc",
"securemail.usa.cc",
"seekapps.com",
"seekjobs4u.com",
"sejaa.lv",
@ -2417,7 +2409,6 @@
"sluteen.com",
"sly.io",
"smallker.tk",
"smap.4nmv.ru",
"smapfree24.com",
"smapfree24.de",
"smapfree24.eu",
@ -2455,7 +2446,6 @@
"soon.it",
"spacebazzar.ru",
"spam-be-gone.com",
"spam.2012-2016.ru",
"spam.la",
"spam.org.es",
"spam.su",
@ -2472,7 +2462,6 @@
"spambog.ru",
"spambooger.com",
"spambox.info",
"spambox.irishspringrealty.com",
"spambox.me",
"spambox.org",
"spambox.us",
@ -2524,7 +2513,6 @@
"spamwc.ga",
"spamwc.gq",
"spamwc.ml",
"speed.1s.fr",
"speedgaus.net",
"sperma.cf",
"spikio.com",
@ -2580,13 +2568,13 @@
"svxr.org",
"sweetpotato.ml",
"sweetxxx.de",
"swift-mail.net",
"swift10minutemail.com",
"sylvannet.com",
"symphonyresume.com",
"syosetu.gq",
"syujob.accountants",
"szerz.com",
"t.psh.me",
"tafmail.com",
"tafoi.gr",
"taglead.com",
@ -2597,6 +2585,7 @@
"tapchicuoihoi.com",
"taphear.com",
"tarzanmail.cf",
"tastrg.com",
"tb-on-line.net",
"tech69.com",
"techemail.com",
@ -2609,13 +2598,13 @@
"teleworm.com",
"teleworm.us",
"tellos.xyz",
"temp-link.net",
"temp-mail.com",
"temp-mail.de",
"temp-mail.org",
"temp-mail.pp.ua",
"temp-mail.ru",
"temp-mails.com",
"temp.headstrong.de",
"tempail.com",
"tempalias.com",
"tempe-mail.com",
@ -2641,6 +2630,7 @@
"tempomail.org",
"temporarily.de",
"temporarioemail.com.br",
"temporary-mail.net",
"temporaryemail.net",
"temporaryemail.us",
"temporaryforwarding.com",
@ -2709,6 +2699,7 @@
"tmail.ws",
"tmailinator.com",
"tmails.net",
"tmpemails.com",
"tmpeml.info",
"tmpjr.me",
"tmpmail.net",
@ -2725,6 +2716,8 @@
"top1mail.ru",
"top1post.ru",
"topinrock.cf",
"topmail2.com",
"topmail2.net",
"topofertasdehoy.com",
"topranklist.de",
"toprumours.com",
@ -2768,6 +2761,7 @@
"trashmail.org",
"trashmail.ws",
"trashmailer.com",
"trashmailgenerator.de",
"trashmails.com",
"trashymail.com",
"trashymail.net",
@ -2788,8 +2782,10 @@
"tryalert.com",
"tryninja.io",
"tryzoe.com",
"ttirv.org",
"ttszuo.xyz",
"tualias.com",
"tuofs.com",
"turoid.com",
"turual.com",
"tvchd.com",
@ -2801,6 +2797,7 @@
"txtadvertise.com",
"tyhe.ro",
"tyldd.com",
"tympe.net",
"uacro.com",
"uber-mail.com",
"ubismail.net",
@ -2818,6 +2815,7 @@
"ultrada.ru",
"umail.net",
"undo.it",
"unicodeworld.com",
"unids.com",
"unimark.org",
"unit7lahaina.com",
@ -2831,9 +2829,8 @@
"uroid.com",
"us.af",
"us.to",
"usa-cc.usa.cc",
"usa.cc",
"used-product.fr",
"username.e4ward.com",
"ushijima1129.cf",
"ushijima1129.ga",
"ushijima1129.gq",
@ -2925,7 +2922,6 @@
"walkmail.net",
"walkmail.ru",
"wallm.com",
"wasteland.rfc822.org",
"watch-harry-potter.com",
"watchever.biz",
"watchfull.net",
@ -2935,18 +2931,17 @@
"wbml.net",
"web-contact.info",
"web-ideal.fr",
"web-inc.net",
"web-mail.pp.ua",
"web2mailco.com",
"webcontact-france.eu",
"webemail.me",
"webm4il.info",
"webmail.igg.biz",
"webmail24.top",
"webtrip.ch",
"webuser.in",
"wee.my",
"wef.gr",
"wefjo.grn.cc",
"weg-werf-email.de",
"wegwerf-email-addressen.de",
"wegwerf-email-adressen.de",
@ -2982,7 +2977,6 @@
"whatsaas.com",
"whiffles.org",
"whopy.com",
"whtjddn.33mail.com",
"whyspam.me",
"wibblesmith.com",
"wickmail.net",
@ -3008,12 +3002,12 @@
"wralawfirm.com",
"writeme.us",
"wronghead.com",
"ws.gy",
"wudet.men",
"wuespdj.xyz",
"wupics.com",
"wuzup.net",
"wuzupmail.net",
"www.e4ward.com",
"wwwnew.eu",
"wxnw.net",
"x24.com",
@ -3027,7 +3021,6 @@
"xemaps.com",
"xemne.com",
"xents.com",
"xing886.uu.gl",
"xjoi.com",
"xl.cx",
"xmail.com",
@ -3065,7 +3058,6 @@
"ye.vc",
"yedi.org",
"yep.it",
"yert.ye.vc",
"yhg.biz",
"ynmrealty.com",
"yodx.ro",
@ -3077,7 +3069,6 @@
"yopmail.gq",
"yopmail.net",
"yopmail.pp.ua",
"yopmail.usa.cc",
"yordanmail.cf",
"you-spam.com",
"yougotgoated.com",
@ -3110,6 +3101,7 @@
"zasod.com",
"zaym-zaym.ru",
"zdenka.net",
"ze.tc",
"zebins.com",
"zebins.eu",
"zehnminuten.de",
@ -3151,5 +3143,5 @@
],
"name": "List of disposable email domains",
"type": "substring",
"version": 20190724
"version": 20200720
}

1762
lists/majestic_million/list.json
View File

File diff suppressed because it is too large Load Diff

13388
lists/microsoft-azure/list.json
View File

File diff suppressed because it is too large Load Diff

33
lists/microsoft-office365-ip/list.json
View File

@ -1,33 +1,23 @@
{
"description": "Office 365 URLs and IP address ranges",
"description": "Office 365 IP address ranges",
"list": [
"104.146.128.0/17",
"104.215.11.144/32",
"104.215.62.195/32",
"104.42.230.91/32",
"104.47.0.0/17",
"13.107.128.0/22",
"13.107.136.0/22",
"13.107.140.6/32",
"13.107.18.10/31",
"13.107.3.0/24",
"13.107.6.152/31",
"13.107.6.156/31",
"13.107.6.171/32",
"13.107.64.0/18",
"13.107.7.190/31",
"13.107.9.156/31",
"13.70.151.216/32",
"13.71.127.197/32",
"13.72.245.115/32",
"13.73.1.120/32",
"13.75.126.169/32",
"13.80.125.22/32",
"13.89.240.113/32",
"13.91.91.243/32",
"131.253.33.215/32",
"132.245.0.0/16",
"138.91.237.237/32",
"150.171.32.0/22",
"150.171.40.0/22",
"157.55.145.0/25",
@ -42,6 +32,7 @@
"2603:1006::/40",
"2603:1007:200::/48",
"2603:1010:200::c7/128",
"2603:1010:2:2::a/128",
"2603:1010:2::cb/128",
"2603:1016:1400::/48",
"2603:1016:2400::/40",
@ -50,9 +41,11 @@
"2603:1020:200::682f:a0fd/128",
"2603:1020:201:9::c6/128",
"2603:1020:400::26/128",
"2603:1020:600::12f/128",
"2603:1020:600::1f0/128",
"2603:1020:600::a1/128",
"2603:1020:700::a2/128",
"2603:1020:800:2::45/128",
"2603:1020:800:2::6/128",
"2603:1020:900::8/128",
"2603:1026:2400::/40",
@ -61,6 +54,7 @@
"2603:1027:1::/48",
"2603:1027::/48",
"2603:1030:1000::21a/128",
"2603:1030:7:5::25/128",
"2603:1030:7::749/128",
"2603:1030:800:5::bfee:ad3c/128",
"2603:1030:f00::17/128",
@ -72,6 +66,7 @@
"2603:1040:200::4f3/128",
"2603:1040:400::5e/128",
"2603:1040:401::762/128",
"2603:1040:601::2/128",
"2603:1040:601::60f/128",
"2603:1040:a01::1e/128",
"2603:1040:c01::28/128",
@ -118,6 +113,7 @@
"2a01:111:2035:8::/64",
"2a01:111:f100:1002::4134:c440/128",
"2a01:111:f100:2000::a83e:3019/128",
"2a01:111:f100:2000::a83e:33a8/128",
"2a01:111:f100:2002::8975:2d79/128",
"2a01:111:f100:2002::8975:2d98/128",
"2a01:111:f100:2002::8975:2da8/128",
@ -125,10 +121,13 @@
"2a01:111:f100:3002::8987:3552/128",
"2a01:111:f100:4002::9d37:c021/128",
"2a01:111:f100:4002::9d37:c3de/128",
"2a01:111:f100:6000::4134:a6c7/128",
"2a01:111:f100:6000::4134:b84b/128",
"2a01:111:f100:7000::6fdd:5245/128",
"2a01:111:f100:7000::6fdd:6cd5/128",
"2a01:111:f100:7000::6fdd:6fc4/128",
"2a01:111:f100:8000::4134:941b/128",
"2a01:111:f100:9001::1761:914f/128",
"2a01:111:f100:a004::bfeb:88cf/128",
"2a01:111:f400::/48",
"2a01:111:f402::/48",
@ -149,27 +148,17 @@
"40.90.218.198/32",
"40.92.0.0/15",
"40.96.0.0/13",
"51.140.155.234/32",
"51.140.203.190/32",
"51.141.51.76/32",
"52.100.0.0/14",
"52.104.0.0/14",
"52.108.0.0/14",
"52.112.0.0/14",
"52.120.0.0/14",
"52.163.126.215/32",
"52.170.21.67/32",
"52.172.185.18/32",
"52.174.56.180/32",
"52.178.161.139/32",
"52.178.94.2/32",
"52.183.75.62/32",
"52.184.165.82/32",
"52.228.25.96/32",
"52.238.106.116/32",
"52.238.119.141/32",
"52.238.78.88/32",
"52.242.23.189/32",
"52.244.160.207/32",
"52.244.203.72/32",
"52.244.207.172/32",
@ -185,5 +174,5 @@
],
"name": "List of known Office 365 IP address ranges",
"type": "cidr",
"version": 20200519
"version": 20200721
}

66
lists/microsoft-office365/list.json
View File

@ -11,6 +11,7 @@
".appex.bing.com",
".aria.microsoft.com",
".assets-yammer.com",
".azure-apim.net",
".azureedge.net",
".azurerms.com",
".blob.core.windows.net",
@ -20,6 +21,7 @@
".config.office.net",
".entrust.net",
".events.data.microsoft.com",
".flow.microsoft.com",
".geotrust.com",
".helpshift.com",
".hockeyapp.net",
@ -28,16 +30,15 @@
".keydelivery.mediaservices.windows.net",
".localytics.com",
".log.optimizely.com",
".loki.delve.office.com",
".lync.com",
".mail.protection.outlook.com",
".manage.microsoft.com",
".manage.office.com",
".measure.office.com",
".media.azure.net",
".microsoft.com",
".microsoftonline-p.com",
".microsoftonline.com",
".microsoftusercontent.com",
".msappproxy.net",
".msauth.net",
".msauthimages.net",
@ -64,6 +65,7 @@
".outlookmobile.com",
".phonefactor.net",
".portal.cloudappsecurity.com",
".powerapps.com",
".protection.office.com",
".protection.outlook.com",
".public-trust.com",
@ -76,7 +78,6 @@
".sharepointonline.com",
".skype.com",
".skypeforbusiness.com",
".staffhub.office.com",
".streaming.mediaservices.windows.net",
".svc.ms",
".symcb.com",
@ -102,7 +103,6 @@
"admin.microsoft.com",
"admin.onedrive.com",
"adminwebservice.microsoftonline.com",
"aia.entrust.net",
"ajax.aspnetcdn.com",
"ajax.microsoft.com",
"aka.ms",
@ -110,8 +110,6 @@
"amsglob0cdnstream11.azureedge.net",
"amsglob0cdnstream12.azureedge.net",
"analytics.localytics.com",
"apc.delve.office.com",
"api.diagnostics.office.com",
"api.dropboxapi.com",
"api.localytics.com",
"api.login.yahoo.com",
@ -126,11 +124,8 @@
"appsforoffice.microsoft.com",
"assets.onestore.ms",
"attachments.office.net",
"aus.delve.office.com",
"auth.gfx.ms",
"autologon.microsoftazuread-sso.com",
"az416426.vo.msecnd.net",
"az826701.vo.msecnd.net",
"becws.microsoftonline.com",
"bit.ly",
"broadcast.officeapps.live.com",
@ -140,29 +135,21 @@
"c.bing.net",
"c.live.com",
"c1.microsoft.com",
"cacert.a.omniroot.com",
"cacert.omniroot.com",
"cacerts.digicert.com",
"can.delve.office.com",
"ccs.login.microsoftonline.com",
"cdn.forms.office.net",
"cdn.odc.officeapps.live.com",
"cdn.onenote.net",
"cdn.optimizely.com",
"cdn.sharepointonline.com",
"cdnprod.myanalytics.microsoft.com",
"cdp1.public-trust.com",
"cert.int-x3.letsencrypt.org",
"cl2.apple.com",
"click.email.microsoftonline.com",
"client.hip.live.com",
"clientconfig.microsoftonline-p.net",
"companymanager.microsoftonline.com",
"compass-ssl.microsoft.com",
"config.office.com",
"connect.facebook.net",
"contentstorage.osi.office.net",
"crl.entrust.net",
"crl.globalsign.com",
"crl.globalsign.net",
"crl.identrust.com",
@ -173,8 +160,6 @@
"data.flurry.com",
"dc.applicationinsights.microsoft.com",
"dc.services.visualstudio.com",
"delve-gcc.office.com",
"delve.office.com",
"device.login.microsoftonline.com",
"dgps.support.microsoft.com",
"directory.services.live.com",
@ -183,36 +168,23 @@
"ecn.dev.virtualearth.net",
"en-us.appex-rf.msn.com",
"enterpriseregistration.windows.net",
"eur.delve.office.com",
"eus-www.sway-cdn.com",
"eus-www.sway-extensions.com",
"evintl-aia.verisign.com",
"evintl-crl.verisign.com",
"evintl-ocsp.verisign.com",
"evsecure-aia.verisign.com",
"evsecure-crl.verisign.com",
"evsecure-ocsp.verisign.com",
"excel.officeapps.live.com",
"excelbingmap.firstpartyapps.oaspapps.com",
"excelcs.officeapps.live.com",
"firstpartyapps.oaspapps.com",
"foodanddrink.services.appex.bing.com",
"forms.microsoft.com",
"forms.office.com",
"g.live.com",
"gbr.delve.office.com",
"go.microsoft.com",
"graph.facebook.com",
"graph.microsoft.com",
"graph.windows.net",
"home.office.com",
"ind.delve.office.com",
"informationprotection.hosting.portal.azure.net",
"insertmedia.bing.office.net",
"isrg.trustid.ocsp.identrust.com",
"jpn.delve.office.com",
"kor.delve.office.com",
"lam.delve.office.com",
"login-us.microsoftonline.com",
"login.live.com",
"login.microsoft.com",
@ -222,8 +194,6 @@
"login.windows.net",
"logincert.microsoftonline.com",
"loginex.microsoftonline.com",
"loki.delve-gcc.office.com",
"loki.delve.office.com",
"lpcres.delve.office.com",
"m.facebook.com",
"mail.google.com",
@ -237,7 +207,6 @@
"msdn.microsoft.com",
"myanalytics-gcc.microsoft.com",
"myanalytics.microsoft.com",
"nam.delve.office.com",
"nexus.microsoftonline-p.com",
"nexus.officeapps.live.com",
"nexusrules.officeapps.live.com",
@ -246,11 +215,9 @@
"ocos-office365-s2s.msedge.net",
"ocsa.officeapps.live.com",
"ocsp.digicert.com",
"ocsp.entrust.net",
"ocsp.globalsign.com",
"ocsp.int-x3.letsencrypt.org",
"ocsp.msocsp.com",
"ocsp.omniroot.com",
"ocsp2.globalsign.com",
"ocspx.digicert.com",
"ocsredir.officeapps.live.com",
@ -290,7 +257,6 @@
"privatecdn.sharepointonline.com",
"prod.firstpartyapps.oaspapps.com.akadns.net",
"prod.msocdn.com",
"products.office.com",
"protection.office.com",
"provisioningapi.microsoftonline.com",
"publiccdn.sharepointonline.com",
@ -300,22 +266,16 @@
"r3.res.office365.com",
"r3.res.outlook.com",
"r4.res.office365.com",
"res.delve.office.com",
"rink.hockeyapp.net",
"roaming.officeapps.live.com",
"rtc.officeapps.live.com",
"s.ytimg.com",
"s0.assets-yammer.com",
"s1.symcb.com",
"s2.symcb.com",
"sa.symcb.com",
"sas.office.microsoft.com",
"sd.symcb.com",
"sdk.hockeyapp.net",
"secure.aadcdn.microsoftonline-p.com",
"secure.globalsign.com",
"secure.meetup.com",
"securescore.office.com",
"shared.officeapps.live.com",
"shellprod.msocdn.com",
"signup.live.com",
@ -324,36 +284,24 @@
"smtp.office365.com",
"social.yahooapis.com",
"spoprod-a.akamaihd.net",
"sr.symcb.com",
"sr.symcd.com",
"ssw.live.com",
"staffhub.ms",
"staffhub.office.com",
"staffhub.uservoice.com",
"staffhubweb.azureedge.net",
"static.sharepointonline.com",
"statics.teams.microsoft.com",
"storage.live.com",
"store.office.com",
"su.symcb.com",
"su.symcd.com",
"suite.office.net",
"support.content.office.net",
"support.microsoft.com",
"support.office.com",
"sway.com",
"sway.office.com",
"tasks.office.com",
"teams.microsoft.com",
"technet.microsoft.com",
"telemetryservice.firstpartyapps.oaspapps.com",
"templates.office.com",
"templateservice.office.com",
"testconnectivity.microsoft.com",
"tse1.mm.bing.net",
"uci.officeapps.live.com",
"vassg142.crl.omniroot.com",
"vassg142.ocsp.omniroot.com",
"videocontent.osi.office.net",
"videoplayercdn.osi.office.net",
"view.atdmt.com",
@ -366,10 +314,8 @@
"web.localytics.com",
"web.microsoftstream.com",
"webanalytics.localytics.com",
"webshell.suite.office.com",
"wikipedia.firstpartyapps.oaspapps.com",
"word-edit.officeapps.live.com",
"word-view.officeapps.live.com",
"wordcs.officeapps.live.com",
"workplaceanalytics.cdn.office.net",
"workplaceanalytics.office.com",
@ -396,7 +342,7 @@
"domain|ip",
"hostname"
],
"name": "List of known Office 365 URLs address ranges",
"name": "List of known Office 365 URLs",
"type": "string",
"version": 20200519
"version": 20200721
}

53
lists/mozilla-CA/list.json
View File

@ -5,11 +5,9 @@
"015ed86bbd6f3d8ea131f812e098736a",
"0226c3015e08303743a9d07dcf37e6bf",
"02ed0eb28c14da45165c566791700d6451d7fb56f0b2ab1d3b8eb070e56edff5",
"02faf3e291435468607857694df5e45b68851868",
"0376ab1d54c5f9803ce4b2e201a0ee7eef7b57b636e8a93c9b8d4860c96f5fa7",
"039eedb80be7a03c6953893b20d2d9323a4c2afd",
"04048028bf1f2864d48f9ad4d83294366a828856553f3b14303f90147f5d40ef",
"04e5803f55ff5987a432d215a5e5aae6",
"0563b8630d62d75abbc8ab1e4bdfb5a899b24d43",
"06083f593f15a104a069a46ba903d006b7970991",
"063e4afac491dfd332f3089b8542e94617d893d7fe944e10a7937ee29d9693c0",
@ -25,14 +23,14 @@
"0d44dd8c3c8c1a1a58756481e90f2e2affb3d26e",
"0e5c306227eb5bbcd7ae62bae9d5df77",
"0f36385b811a25c39b314e83cae9346670cc74b4",
"0f993c8aef97baaf5687140ed59ad1821bb4afacf0aa9a58b5d57a338a3afbcb",
"0ff9407618d3d76a4b98f0a8359e0cfd27accced",
"10ff00ffcfc9f8c77ac0ee358ec90f47",
"1164c189b024b18cb1077e899e519e99",
"11fc9fbd7330028afd3ff358b9cb20f0",
"125609aa301da0a249b97a8239cb6a34216f44dcac9f3954b14292f2e8c8608f",
"132d0d45534b6997cdb2d5c339e25576609b5cc6",
"136335439334a7698016a0d324de72284e079d7b5220bb8fbd747816eebebaca",
"1465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658",
"14884e862637b026af59625c4077ec3529ba9601",
"15d5b8774619ea7d54ce1ca6d0b0c403e037a917f131e8a04e1e6b7a71babce5",
"15f0ba00a3ac7af3ac884c072b1011a077bd77c097f40164b2f8598abd83860c",
"16af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb",
@ -48,9 +46,6 @@
"1b8eea5796291ac939eab80a811a7373c0937967",
"1ba5b2aa8c65401a82960118f80bec4f62304d83cec4713a19c39c011ea46db4",
"1bfe69d191b71933a372a80fe155e5b5",
"1d3554048578b03f42424dbf20730a3f",
"1e0e56190ad18b2598b20444ff668a0417995f3f",
"1e42950233926bb95fc07fdad6b24bfc",
"1f24c630cda418ef2069ffad4fdd5f463a1b69aa",
"1f4914f7d874951dddae02c0befd3a2d82755185",
"204285dcf7eb764195578e136bd4b7d1e98e46a5",
@ -60,9 +55,9 @@
"22d5d8df8f0231d18df79db7cf8a2d64c93f6c3a",
"2399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c",
"2477d9a891d13bfa882dc2fff8cd3393",
"24f91c0705a0a5338641b365fb0d9d9709b56297cff1857e73c02c1636d486aa",
"2530cc8e98321502bad96f9b1fba1b099e2d299e0f4548bb914f363bc0d4531f",
"2601fbd827a7179a4554381a43013b03",
"26f993b4ed3d2827b0b94ba7e9151da38d92e532",
"2792231d0af5407ce9e66b9dd8f5e76c",
"2796bae63f1801e277261ba0d77770028f20eee4",
"27de36fe72b70003009df4f01e6c0424",
@ -94,7 +89,7 @@
"339b6b1450249b557a01877284d9e02fc3d2d8e9",
"3417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc65",
"34fcb8d036db9e14b3c2f2db8fe494c7",
"363f3c849eab03b0a2a0f636d7b86d04d3ac7fcfe26a0a9121ab9795f6e176df",
"358df39d764af9e1b766e9c972df352ee15cfac227af6ad1d70e8e4a6edcba02",
"3679ca35668772304d30a5fb873b0fa77bb70d54",
"36b12b49f9819ed74c9ebc380fc6568f5dacb2f7",
"3706a5b0fc899dbaf46b8c1a64cdd5ba",
@ -126,7 +121,6 @@
"435e88d47d1a4a7efd842e52eb01d46f",
"43c6bfaeecfead2f18c6886830fcc8e6",
"43df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f339",
"43f257412d440d627476974f877da8f1fc2444565a367ae60eddc27a412531ae",
"44b545aa8a25e65a73ca15dc27fc36d24c1cb9953a066539b11582dc487b4833",
"44ed9a0ea4093b00f2ae4ca3c661b08b",
"45140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda",
@ -150,7 +144,6 @@
"517f611e29916b5382fb72e744d98dc3cc536d64",
"51c6e70849066ef392d45ca00d6da3628fc35239",
"52f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234",
"54455f7129c20b1447c418f997168f24c58fc5023bf5da5be2eb6e1dd8902ed5",
"552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988",
"55926084ec963a64b96e2abe01ce0ba86a64fbfebcc7aab5afc155b37fd76066",
"55a6723ecbf2eccdc3237470199d2abe11e381d1",
@ -163,11 +156,9 @@
"5922a1e15aea163521f898396a4646b0441b0fa9",
"5953226583420154c0ce42b95a7cf290",
"59769007f7685d0fcd50872f9f95d5755a5b2b457d81f3692b610a98672f0e1b",
"59af82799186c7b47507cbcf035746eb04ddb716",
"5a2fc03f0c83b090bbfa40604b0988446c7636183df9846e17101a447fb8efd6",
"5a885db19c01d912c5759388938cafbbdf031ab2d48e91ee15589b42971d039c",
"5a8cef45d7a69859767a8c8b4496b578cf474b1a",
"5b0469eca583946318a786d0e4f26e19",
"5c48dcf74272ec56946d1ccc71358075",
"5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e",
"5cc3d78e4e1d5e45547a04e6873e64f90cf9536d1ccc2ef800f355c4c5fd70fd",
@ -184,12 +175,9 @@
"62dd0be9b9f50a163ea0f8e75c053b1eca57ea55c8688f647c6881f2c8357b95",
"63ccd93d34355c6f53a3e20870481fb4",
"64b00955cfb1d599e2be13aba65dea4d",
"65be102be26928650e0ef54dc8f4f15af5f98e8b",
"657cfe2fa73faa38462571f332a2363a46fce7020951710702cdfbb6eeda3305",
"6631bf9ef74f9eb6c9d5a60cba6abed1f7bdef7b",
"668c83947da63b724bece1743c31a0e6aed0db8ec5b31be377bb784f91b6716f",
"6724902e4801b02296401046b4b1672ca975fd2b",
"67650df17e8e7e5b8240a4f4564bcfe23d69c6f0",
"687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2",
"6969562e4080f424a1e7199f14baf3ee58ab6abb",
"69c10d4f07a31bc3fe563d04bc11f6a6",
"69ddd7ea90bb57c93e135dc85ea6fcd5480b603239bdc454fc758b2a26cf7f79",
@ -202,14 +190,12 @@
"6e3a55a4190c195c93843cc0db722e313061f0b1",
"6e85f1dc1a00d322d5b2b2ac6b370545",
"70a73f7f376b60074248904534b11482d5bf0e698ecc498df52577ebf2e93b9a",
"70d530f1da9497d4d774dfbeed68de96",
"71cca5391f9e794b04802530b363e121da8a3043bb26662fea4dca7fc951a4bd",
"72e44a87e369408077eabce3f4fff0e1",
"733a747aecbba396a6c2e4e2c89bc0c3",
"739f4c4b735b79e9faba1cef6ecbd5c9",
"73a5e64a3bff8316ff0edccc618a906e4eae4d74",
"73c176434f1bc6d5adf45b0e76e727287c8de57616c1e6e6141a2b2cbc7d8e4c",
"74014a91b108c458ce47cdf0dd115308",
"74207441729cdd92ec7931d823108dc28192e2bb",
"7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf",
"743af0529bd032a0f44a83cdd4baa97b7c2ec49a",
"749dea6024c4fd22533ecc3a72d9294f",
@ -218,14 +204,12 @@
"75e0abb6138512271c04f85fddde38e4b7242efe",
"7600295eefe85b9e1fd624db76062aaaae59818a54d2774cd4c0b2c01131e1b3",
"76e27ec14fdb82c1c0a675b505be3d29b4eddbbb",
"77474fc630e40f4c47643f84bab8c6954a8a41ec",
"786a74ac76ab147f9c6a3050ba9ea87efe9ace3c",
"78f2fcaa601f2fb4ebc937ba532e7549",
"7908b40314c138100b518d0735807ffbfcf8518a0095337105ba386b153dd927",
"79e4a9840d7d3a96d7c04fe2434c892e",
"7c62ff749d31535e684ad578aa1ebf23",
"7c7f65310c81df8dba3e99e25cad6efb",
"7ca50ff85b9a7d6d30ae545ae342a28a",
"7d05ebb682339f8c9451ee094eebfefa7953a114edb2f44949452fab7d2fc185",
"7d0b83e5fb7cad074f20a9b5df63ed79",
"7e04de896a3e666d00e687d33ffad93be83d349e",
@ -236,25 +220,23 @@
"81e5b417ebc2f5e14b0d417b4992feef",
"821aefd4d24af29fe23d970614707285",
"8292ba5befcd8a6fa63d55f984f6d6b7",
"84f2e3dd83133ea91d19527f02d729bfc15fe667",
"8560f91c3624daba9570b5fea0dbe36ff11a8323be9486854fb3f34a5571198d",
"85666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69",
"85a0dd7dd720adb7ff05f83d542b209dc7ff4528f7d677b18389fea5e5c49e86",
"85a408c09c193e5d51587dcdd61330fd8cde37bf",
"866912c070f1ecacacc2d5bca55ba129",
"86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b",
"8782c6c304353bcfd29692d2593e7d44d934ff11",
"87ce0b7b2a0e4900e158719b37a89372",
"882c8c52b8a23cf3f7bb03eaaeac420b",
"88497f01602f3154246ae28c4d5aef10f1d87ebb76626f4ae0b7f95ba7968799",
"88ef81de202eb018452e43f864725cea5fbd1fc2d9d205730709c5d8b8690f46",
"8953f18323b77c8e05f18c71384e1f88",
"89bc27d5eb178d066a69d5fd8947b4cd",
"89d483034f9e9a48805f7237d4a9a6efcb7c1fd1",
"89df74fe5cf40f4a80f9e3377d54da91e101318e",
"8a866fd1b276b57e578e921c65828a2bed58e9f2f288054134b7f1f4bfc9cc74",
"8ac7ad8f73ac4ec1b5754da540f4fccf7cb58e8c",
"8b624e5d8f44c19bbaa1a3e7ea133969",
"8c7209279ac04e275e16d07fd3b775e80154b5968046e31f52dd25766324e9a7",
"8ccadc0b22cef5be72ac411a11a8d812",
"8cf1758ac619cf94b7f7652087c397c7",
"8cf427fd790c3ad166068de81e57efbb932272d4",
"8d1784d537f3037dec70fe578b519a99e610d7b0",
"8d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f",
@ -274,6 +256,7 @@
"960adf0063e96356750c2965dd0a0867da0b9cbd6e77714aeafb2349ab393da3",
"96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6",
"96c91b0b95b4109842fad0d82279fe60fab91683",
"999a64c37ff47d9fab95f14769891460eec4c3c5",
"9a114025197c5bb95d94e63d55cd43790847b646b23cdf11ada4a00eff15fb48",
"9a6ec012e1a7da9dbe34194d478ad7c0db1822fb071df12981496ed104384113",
"9acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df",
@ -320,16 +303,13 @@
"b0bfd52bb0d7d9bd92bf5d4dc13da255c02c542f378365ea893911f55e55f23c",
"b12e13634586a46f1ab2606837582dc4acfd9497",
"b147bc1857d118a0782dec71e82a9573",
"b172b1a56d95f91fe50287e14d37ea6a4463768a",
"b1bc968bd4f49d622aa89a81f2150152a41d829c",
"b2e1090061aff7f1916fc4ad8d5e3b7c",
"b31eb1b740e36c8402dadc37d44df5d4674952f9",
"b33e777375eea0d3e37e49634959bbc7",
"b478b812250df878635c2aa7ec7d155eaa625ee82916e2cd294361886cd1fbd4",
"b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e",
"b561ebeaa4dee4254b691a98a55747c234c7d971",
"b5e83436c910445848706d2e83d4b805",
"b6191a50d0c3977f7da99bcdaac86a227daeb9679ec70ba3b0c9d92271c170d3",
"b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b804",
"b67e1df058c5496c243b3ded9818edbc",
"b6af43c29b81537df6ef6bc31f1f60150cee4866",
@ -346,6 +326,7 @@
"bc6c5133a7e9d366635415721b219293",
"bd71fdf6da97e4cf62d1647add2581b07d79adf8397eb4ecba9c5e8488821423",
"be6c4da2bbb9ba59b6f3939768374246c3c005993fa98f020d1dedbed48a81d5",
"beb00b30839b9bc32c32e4447905950641f26421b15ed089198b518ae2ea1b99",
"bec94911c2955676db6c0a550986d76e3ba005667c442c9762b4fbb773de228c",
"bf0feefb9e3a581ad5f9e9db7589985743d261085c4d314f6f5d7259aa421612",
"bfd88fe1101c41ae3e801bf8be56350ee9bad1a6b9bd515edc5c6d5b8711ac44",
@ -359,6 +340,7 @@
"c5a1b7ff73ddd6d7343218dffc3cad88",
"c5dfb849ca051355ee2dba1ac33eb028",
"c5e67bbf06d04f43edc47a658afb6b19",
"c741f70f4b2a8d88bf2e71c14122ef53ef10eba0cfa5e64cfa20f418853073e0",
"c8e58dcea842e27ac02a5c7c9e26bf66",
"c9982777281e3d0e153c8400b88503e6",
"c9a8b9e755805e58e35377a725ebafc37b27ccd7",
@ -372,8 +354,6 @@
"cb627d18b58ad56dde331a30456bc65c601a4e9b18dedcea08e7daaa07815ff0",
"cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b",
"cbb5af185e942a2402f9eacbc0ed5bb876eea3c1223623d00447e4f3ba554b65",
"ccab0ea04c2301d6697bdd379fcd12eb24e3949d",
"cd68b6a7c7c4ce75e01d4f5744619209",
"cde025698d47ac9c893590f7fd513d2f",
"ce0b72d19f888ed05003e8e3b88b6740",
"cecddc905099d8dadfc5b1d209b737cbe2c18cfb2c10c0ff0bcf0d3286fc1aa2",
@ -395,7 +375,6 @@
"d69b561148f01c77c54578c10926df5b856976ad",
"d6a5c3ed5ddd3e00c13d87921f1d3fe4",
"d6daa8208d09d2154d24b52fcb346eb258b28a58",
"d7343def1d270928e131025b132bddf7",
"d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4",
"d8a6332ce0036fb185f6634f7d6a066526322827",
"d8c5388ab7301b1b6ed47ae645253a6f9f1a2761",
@ -404,10 +383,13 @@
"d8eb6b41519259e0f3e78500c03db68897c9eefc",
"dac9024f54d8f6df94935fb1732638ca6ad77c13",
"dafaf7fa6684ec068f1450bdc7c281a5bca96457",
"db3517d1f6732a2d5ab97c533ec70779ee3270a62fb4ac4238372460e6f01e88",
"dc0081dc692f3e2fb03bf63d5a918e49",
"dc32c3a76d2557c768099dea2da9a2d1",
"dd6936fe21f8f077c123a1a521c12224f72255b73e03a7260693e8a24b0fa389",
"dda103e64a9310d1bff01942cbfeed67",
"ddfb16cd4931c973a2037d3fc83a4d7d775d05e4",
"de1ff69e84aea7b421ce1e587dd18498",
"de28f4a4ffe5b92fa3c503d1a349a7f9962a8212",
"de3f40bd5093d39b6c60f6dabc076201008976c9",
"df3c24f9bfd666761b268073fe06d1cc8d4f82a4",
@ -429,7 +411,6 @@
"e75e72ed9f560eec6eb4800073a43fc3ad19195a392282017895974a99026b6c",
"e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd2",
"eaa962c4fa4a6bafebe415196d351ccd888d4f53f3fa8ae6d7c466a94e6042bb",
"eb04cf5eb1f39afa762f2bb120f296cba520c1b97db1589565b81cb9a17b7244",
"ebc5570c29018c4d67b1aa127baf12f703b4611ebc17b7dab5573894179b93fa",
"ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99",
"ebf59d290d61f9421f7cc2ba6de31509",
@ -438,7 +419,6 @@
"ee2931bc327e9ae6e8b5f751b4347190",
"eec5496b988ce98625b934092eec2908bed0b0f316c2d4730c84eaf1f3d34881",
"ef3cb417fc8ebf6f97876c9e4ece39de1ea5fe649141d1028b7d11c0b2298ced",
"f09b122c7114f4a09bd4ea4f4a99d558b46e4c25cd81140d29c05613914c3841",
"f18b538d1be903b6a6f056435b171589caf36bf2",
"f1bc636a54e0b527f5cde71ae34d6e4a",
"f1c1b50ae5a20dd8030ec9f6bc24823dd367b5255759b4e71b61fce9f7375d73",
@ -460,7 +440,6 @@
"fc06af7be81af19ab4e8d2701fc0f5ba",
"fd73dad31c644ff1b43bef0ccdda96710b9cd9875eca7e31707af3e96d522bbd",
"fe45659b79035b98a161b5512eacda580948224d",
"fe863d0822fe7a2353fa484d5924e875656d3dc9fb58771f6f616f9d571bc592",
"ff856a2d251dcd88d36656f450126798cfabaade40799c722de4d2b5db36a73a",
"ffbdcde782c8435e3c6f26865ccaa83a455bc30a"
],
@ -477,5 +456,5 @@
],
"name": "Fingerprint of trusted CA certificates",
"type": "string",
"version": 20190724
"version": 20200721
}

4814
lists/mozilla-IntermediateCA/list.json
View File

File diff suppressed because it is too large Load Diff

25201
lists/public-dns-hostname/list.json
View File

File diff suppressed because it is too large Load Diff

40248
lists/public-dns-v4/list.json
View File

File diff suppressed because it is too large Load Diff

291
lists/public-dns-v6/list.json
View File

@ -1,279 +1,32 @@
{
"description": "Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set",
"list": [
"2001:1488:800:400::130",
"2001:14b8:100:350::2",
"2001:14b8:100:8350::1",
"2001:14b8:100:8350::8",
"2001:1608:10:167:342::eb52",
"2001:1608:10:195:3:dead:beef:cafe",
"2001:1608:10:25::1c04:b12f",
"2001:1608:10:25::9249:d69b",
"2001:1620:2777:1::10",
"2001:1620:2777:1::11",
"2001:1620:2777::2",
"2001:19f0:5001:133:5400:ff:fe30:d565",
"2001:19f0:5801:11:5400:ff:fe2d:7724",
"2001:19f0:7001:929:5400:ff:fe30:50af",
"2001:19f0:8001:5e:5400:ff:fe35:c3ae",
"2001:1a68::d911:2244",
"2001:1bc0::ffff:aaaa:2",
"2001:1bc0::ffff:bbbb:2",
"2001:2040:39::5",
"2001:418:3ff::1:53",
"2001:418:3ff::53",
"2001:41d0:52:cff::1325",
"2001:41d0:52:f00::413",
"2001:41d0:8:be92::1",
"2001:41d0:a:1011::1",
"2001:41d0:a:28::1",
"2001:41d0:203:4b1f:2:2:2:2",
"2001:428:101:100:205:171:2:65",
"2001:428:101:100:205:171:3:65",
"2001:428::1",
"2001:450:2005:1::4",
"2001:450:2005:2::4",
"2001:450:2005:2::5",
"2001:450:2005:3::5",
"2001:468:c80:2101:0:100:0:22",
"2001:468:c80:4101:0:100:0:42",
"2001:470:0:45::2",
"2001:470:0:69::2",
"2001:470:0:6e::2",
"2001:470:0:78::2",
"2001:470:0:7d::2",
"2001:470:0:8c::2",
"2001:470:0:90::2",
"2001:470:0:9d::2",
"2001:470:0:c0::2",
"2001:470:1f14:fd8::2",
"2001:470:20::2",
"2001:470:26:1c8::1",
"2001:470:6d:80:224:1dff:fe84:797",
"2001:470:6d:80:a5f6:5a97:a53:71cb",
"2001:470:6d:80:c4f1:32a:4521:c34",
"2001:470:6d:f1e:1337:360:dead:beef",
"2001:470:8e08::",
"2001:470:d:bb7::8888",
"2001:470:f032:1::254",
"2001:4860:4860::8844",
"2001:4860:4860::8888",
"2001:4870:6082:3::100",
"2001:4870:6082:3::5",
"2001:4870:8000:3::100",
"2001:4870:8000:3::5",
"2001:4ce8::53",
"2001:4dd0:fd5e::53",
"2001:4f8:0:2::14",
"2001:550:1:1::d",
"2001:5b8:1::5",
"2001:610:1108:5010::130",
"2001:638:902:1::10",
"2001:648:2ffc:100::211",
"2001:678:1::206",
"2001:67c:15e8:d1::18",
"2001:67c:15e8:d1::19",
"2001:67c:240c:214::4",
"2001:67c:240c:214::5",
"2001:470:1f1a:78e::2",
"2001:470:2351::1",
"2001:4b8:2:101::602",
"2001:4b8:3:201::902",
"2001:67c:28a4::",
"2001:67c:2b0::1",
"2001:67c:2b0::2",
"2001:67c:2b24:1000::10",
"2001:67c:2b24:1000::11",
"2001:6b0:3f::a",
"2001:7b8:1509::1",
"2001:840:0:200::1",
"2001:840:200::",
"2001:840:2010:413::100",
"2001:910:800::12",
"2001:910:800::40",
"2001:978:1:1::d",
"2001:978:1:2::d",
"2001:b000:168::1",
"2001:b08:2:280::4:1",
"2001:bf0::2",
"2001:ec0:1::1",
"2001:ec0:3::3",
"2400:6180:0:d0::38:d001",
"2400:8900::f03c:91ff:fe70:c452",
"2402:2f80:5::",
"2402:9e80:1::1:e554",
"2403:5680::1:200f",
"2407:9000:0:4::2",
"2600:3c00::20:b1ff",
"2600:3c02::f03c:91ff:fe84:cb54",
"2600:3c02::f03c:91ff:fee0:5e5",
"2600::1",
"2600::2",
"2602:3f:e75c:1bff::1",
"2602:ffb6:2:0:f816:3eff:fe23:ae28",
"2602:ffc5:30::1:d69b",
"2604:a880:1:20::c5b:1001",
"2604:a880:400:d0::6d6:2001",
"2605:f700:c0:1::1089:53ef",
"2606:4700:4700::1001",
"2606:4700:4700::1111",
"2607:fa88:1::2",
"2610:130:100:3::200",
"2610:a1:1018::22",
"2610:a1:1018::23",
"2610:a1:1018::24",
"2610:a1:1018::25",
"2610:a1:1018::26",
"2610:a1:1018::27",
"2610:a1:1018::28",
"2610:a1:1018::29",
"2610:a1:1018::30",
"2610:a1:1018::31",
"2610:a1:1018::32",
"2610:a1:1018::33",
"2001:b000:168::2",
"2001:de4::102",
"2606:ed00:2:babe::10",
"2607:5300:203:1797::53",
"2607:f130:0:d7::d41",
"2610:a1:1018::34",
"2610:a1:1018::35",
"2610:a1:1018::5",
"2610:a1:1019::22",
"2610:a1:1019::23",
"2610:a1:1019::24",
"2610:a1:1019::25",
"2610:a1:1019::26",
"2610:a1:1019::27",
"2610:a1:1019::28",
"2610:a1:1019::29",
"2610:a1:1019::30",
"2610:a1:1019::31",
"2610:a1:1019::32",
"2610:a1:1019::33",
"2610:a1:1019::34",
"2610:a1:1019::35",
"2610:a1:1019::5",
"2620:0:ccc::2",
"2620:0:ccd::2",
"2620:74:1b::1:1",
"2620:74:1c::2:2",
"2a00-1508-0-4--9.puntcat.ip6.guifi.net.",
"2a00-1dc0-cafe--ad86-fa7e.static.host.",
"2a00-1dc0-cafe--c6af-c19d.static.host.",
"2a00:12d8:7002::2",
"2a00:1508:0:4::9",
"2a00:1ca8:a7::1e9",
"2a00:1dc0:cafe::ad86:fa7e",
"2a00:1dc0:cafe::c6af:c19d",
"2a00:5881:8100:1000::3",
"2a00:5884:8218::1",
"2a00:dcc0:eda:88:245:71:858e:a15",
"2a00:dcc0:eda:98:183:193:d85a:389b",
"2a00:dcc7:2202:11::7b28",
"2a00:dcc7:2202:14::2",
"2a00:f48:100c:7b::2",
"2a00:f48:100c:7e::2",
"2a01:4f8:131:1278::2",
"2a01:4f8:141:4281::3000",
"2a01:4f8:151:90e9::2",
"2a01:4f8:151:90e9::b",
"2a01:4f8:161:4109::6",
"2a01:4f8:191:306c::2",
"2a02:2178:1:2::2",
"2a02:2ca0:64:22::2",
"2a02:6b8::feed:ff",
"2a02:7aa0:1201::f60e:2719",
"2a02:7aa0:1619::4f50:a69",
"2a02:940:0:4293::100",
"2a02:e00:fffd:139::9",
"2a03:b0c0:0:1010::62:f001",
"2a03:b0c0:3:d0::7c:5001",
"2a04:92c7:7:7::14ae:460a",
"2a04:9dc0:c1:7::cb9:f785",
"2a05:b0c6:5e4::53",
"2a05:dfc7:5::53",
"2a05:dfc7:5::5353",
"2c0f:fda8:5::2ed1:d2ec",
"::ffff:9538:1aed",
"::ffff:9e45:abfe",
"ClemenTroniQ89-1-pt.tunnel.tserv11.ams1.ipv6.he.net.",
"anyone.dnsrec.meo.ws.",
"anytwo.dnsrec.meo.ws.",
"b-root.cesidian.info.",
"canopus.ne2000.nl.",
"cl-849.hel-01.fi.sixxs.net.",
"crt-public-dns-a.cesidianroot.eu.",
"cznic-public-dns-1.nic.cz.",
"dlfw-rdns-01.dlfw.twtelecom.net.",
"dns.yandex.ru.",
"dns01.jordbruksverket.se.",
"dns02.jordbruksverket.se.",
"dns1.host.net.",
"dns1.lon.gblx.net.",
"dns1.phx.gblx.net.",
"dns1.totbb.net.",
"dns2.phx.gblx.net.",
"dns2.roc.gblx.net.",
"dns2.totbb.net.",
"dnsdist.mysrvr.net.",
"dnsres1.nic.cz.",
"eu-res1.dns.cogentco.com.",
"eu-res2.dns.cogentco.com.",
"freya.stelas.de.",
"google-public-dns-b.google.com.",
"hntp1.hinet.net.",
"homens.b-hs.de.",
"host19-65-static.59-88-b.business.telecomitalia.it.",
"jeru.cns.ipv6.vt.edu.",
"log.bzh.",
"lpc1.stu.neva.ru.",
"lucy.s.imvry.pw.",
"mail2.cesidianroot.eu.",
"na-res1.dns.cogentco.com.",
"ns-3.iastate.edu.",
"ns.ipv6.uni-leipzig.de.",
"ns0.fdn.org.",
"ns1.ams.dns.lchi.mp.",
"ns1.ata.dns.lchi.mp.",
"ns1.fdn.fr.",
"ns1.hnd.dns.lchi.mp.",
"ns1.init7.net.",
"ns1.nl.dns.d0wn.biz.",
"ns1.probe-networks.de.",
"ns1.sea.dns.lchi.mp.",
"ns1.sg.dns.d0wn.biz.",
"ns1.shodan.io.",
"ns1.syd.dns.lchi.mp.",
"ns1.twtelecom.net.",
"ns10.init7.net.",
"ns11.init7.net.",
"ns2.all.de.",
"ns2.itandtel.at.",
"ns2.powertech.no.",
"ns2.probe-networks.de.",
"ns2.shodan.io.",
"ns2.sprintlink.net.",
"ns2.twtelecom.net.",
"ns532549.ip-149-56-26.net.",
"open-root.cesidian.info.",
"or.isc.org.",
"ordns.he.net.",
"plfgr.eu.org.",
"primary.server.edv-froehlich.de.",
"proxyvm.stejau.de.",
"public-dns-a.primawebtools.de.",
"recursif.arn-fai.net.",
"resolver.qwest.net.",
"resolver1.dns.trex.fi.",
"resolver1.ipv6-sandbox.opendns.com.",
"resolver2.dns.trex.fi.",
"resolver2.ipv6-sandbox.opendns.com.",
"rickhunter.ns.ielo.net.",
"rns1.grnet.gr.",
"secondary.server.edv-froehlich.de.",
"services.donotuse.de.",
"spcr-2.machadosbsmarketing.com.br.",
"test.cesidian.info.",
"tserv1.ams1.he.net.",
"tserv1.dal1.he.net.",
"tserv1.fmt2.he.net.",
"tserv1.fra1.he.net.",
"tserv1.mia1.he.net.",
"tserv1.tor1.he.net.",
"x.ns.gin.ntt.net.",
"y.ns.gin.ntt.net.",
"yardbird.cns.ipv6.vt.edu.",
"zen.stack.nl."
"2a00:aa40:0:225::2",
"2a01:238:42f6:ac00:2a29:4f7f:b6d:ef46",
"2a01:3a0:53:53::",
"2a01:4f8:141:316d::117",
"2a01:4f8:151:34aa::198",
"2a01:4f8:c0c:1e44::1",
"2a01:4f8:c17:739a::2",
"2a02:2970:1002::18",
"2a02:c205:3001:4558::1",
"2a03:8600:1001::2"
],
"matching_attributes": [
"ip-src",
@ -282,5 +35,5 @@
],
"name": "List of known IPv6 public DNS resolvers",
"type": "string",
"version": 20181114
"version": 20200720
}

3
lists/tlds/list.json
View File

@ -1170,7 +1170,6 @@
"SX",
"SY",
"SYDNEY",
"SYMANTEC",
"SYSTEMS",
"SZ",
"TAB",
@ -1520,5 +1519,5 @@
],
"name": "TLDs as known by IANA",
"type": "string",
"version": 20200706
"version": 20200721
}

62782
lists/tranco/list.json
View File

File diff suppressed because it is too large Load Diff

276
lists/tranco10k/list.json
View File

File diff suppressed because it is too large Load Diff

79
lists/university_domains/list.json
View File

@ -66,6 +66,7 @@
"acu.edu",
"acu.edu.au",
"acu.edu.ng",
"ad.unc.edu",
"ada.edu.az",
"adamson.edu.ph",
"adanabtu.edu.tr",
@ -209,6 +210,7 @@
"alfaisal.edu",
"alfred.edu",
"alfredtech.edu",
"algebra.hr",
"algonquincollege.com",
"alhikmah.edu.ng",
"alhosnu.ae",
@ -385,6 +387,7 @@
"asfh-berlin.de",
"ash-college.ac.il",
"ashesi.edu.gh",
"ashford.edu",
"ashitech.ac.jp",
"ashiya-u.ac.jp",
"ashland.edu",
@ -600,7 +603,7 @@
"bayburt.edu.tr",
"baycollege.edu",
"baylor.edu",
"bazeuniversity.edu.n",
"bazeuniversity.edu.ng",
"bbauindia.org",
"bbc.edu",
"bbk.ac.uk",
@ -694,7 +697,6 @@
"bigsandy.kctcs.edu",
"bihe.org",
"biit.edu.pk",
"bilecik..edu.tr",
"bilecik.edu.tr",
"bilgi.edu.tr",
"bilkent.edu.tr",
@ -793,6 +795,7 @@
"brazcubas.br",
"brcc.edu",
"brenau.edu",
"brescia.edu",
"brexgata.eu",
"briar-cliff.edu",
"bridgemont.edu",
@ -1014,6 +1017,7 @@
"ccs.edu.sd",
"ccsf.edu",
"ccsn.edu",
"ccsnh.edu",
"ccsu.edu",
"ccsuniversity.ac.in",
"ccsuniversity.org",
@ -1165,6 +1169,7 @@
"cku.edu.tw",
"clackamas.edu",
"claeh.edu.uy",
"claremontmckenna.edu",
"clarendoncollege.edu",
"claretiano.edu.br",
"clarion.edu",
@ -1514,11 +1519,13 @@
"dcatholic.ac.kr",
"dcc.edu",
"dcc.edu.sa",
"dcc.ufmg.br",
"dcc.vccs.edu",
"dccc.edu",
"dcccd.edu",
"dceonline.net",
"dcet.edu.pk",
"dcmail.ca",
"dct.ch",
"dct.gotevot.edu.sa",
"dct.udn.vn",
@ -1532,6 +1539,7 @@
"deakin.edu.au",
"deanza.edu",
"deccancollegepune.ac.in",
"defiance.edu",
"dehaagsehogeschool.nl",
"dehaghan.ac.ir",
"dei.ac.in",
@ -1674,7 +1682,6 @@
"dupage.edu",
"duq.edu",
"dur.ac.uk",
"durhamc.on.ca",
"durhamtech.edu",
"dusit.ac.th",
"duth.gr",
@ -1866,12 +1873,10 @@
"enseeiht.fr",
"ensem.u-nancy.fr",
"enserb.u-bordeaux.fr",
"enserg.fr",
"ensg.ign.fr",
"ensg.u-nancy.fr",
"ensic.u-nancy.fr",
"ensica.fr",
"ensieg.inpg.fr",
"ensieta.fr",
"ensitm.fr",
"ensm-ales.fr",
@ -1945,7 +1950,7 @@
"esn.ac.lk",
"espam-formationuc.org",
"espci.fr",
"espe.edu.e",
"espe.edu.ec",
"espoch.edu",
"espol.edu.ec",
"essca.asso.fr",
@ -2008,6 +2013,8 @@
"famu.cz",
"famu.edu",
"fandm.edu",
"fanshawec.ca",
"fanshaweonline.ca",
"farmingdale.edu",
"faryab.edu.af",
"fashir.edu.sd",
@ -2020,6 +2027,7 @@
"faytechcc.edu",
"fbcusl.8k.com",
"fbsc.edu.sa",
"fbu.edu.tr",
"fc.edu",
"fcetakoka-edu.net",
"fcu.edu.tw",
@ -2039,7 +2047,6 @@
"feu.edu.ph",
"ffhs.ch",
"fgcu.edu",
"fh-Kempten.de",
"fh-aachen.de",
"fh-aargau.ch",
"fh-aschaffenburg.de",
@ -2070,12 +2077,12 @@
"fh-htachur.ch",
"fh-htwchur.ch",
"fh-hwz.ch",
"fh-ingolstadt.de",
"fh-isny.de",
"fh-jena.de",
"fh-joanneum.at",
"fh-kaernten.ac.at",
"fh-karlsruhe.de",
"fh-kempten.de",
"fh-kiel.de",
"fh-kl.de",
"fh-koblenz.de",
@ -2414,6 +2421,7 @@
"greenleaf.edu",
"greenriver.edu",
"grenoble-em.com",
"grenoble-inp.fr",
"gretsauniversity.ac.ke",
"grinnell.edu",
"grossmont.edu",
@ -2460,6 +2468,7 @@
"gujaratuniversity.org.in",
"gukit.ru",
"gulbargauniversity.kar.nic.in",
"gulfcoast.edu",
"gulfuniversity.net",
"gums.ac.ir",
"gumushane.edu.tr",
@ -2714,7 +2723,6 @@
"hlju.edu.cn",
"hm.edu",
"hmc.edu",
"hmg.inpg.fr",
"hmu.edu.vn",
"hnaubenin.org",
"hnbgu.ac.in",
@ -2802,6 +2810,7 @@
"hti.edu.eg",
"htu.se",
"htus.ac.kr",
"htw-berlin.de",
"htw-dresden.de",
"htw-saarland.de",
"htwk-leipzig.de",
@ -2827,6 +2836,7 @@
"hull.ac.uk",
"humanities.mn",
"humber.ca",
"humbermail.ca",
"humboldt.edu",
"humg.edu.vn",
"hums.ac.ir",
@ -2884,7 +2894,7 @@
"iate.obninsk.ru",
"iau-ahar.ac.ir",
"iau-arak.ac.ir",
"iau-boukan.ac.i",
"iau-boukan.ac.ir",
"iau-garmsar.ac.ir",
"iau-lahijan.ac.ir",
"iau-saveh.ac.ir",
@ -2920,6 +2930,7 @@
"ibbu.edu.ng",
"ibc.ac.th",
"ibc.edu",
"ibch.ru",
"iberoamericana.edu.co",
"ibi.spb.ru",
"ibnesina.edu.af",
@ -3003,6 +3014,7 @@
"iitd.ernet.in",
"iitg.ac.in",
"iitg.ernet.in",
"iitgn.ac.in",
"iith.ac.in",
"iiti.ac.in",
"iitj.ac.in",
@ -3028,6 +3040,7 @@
"illinois.edu",
"illinoisstate.edu",
"ilsacollege.edu.na",
"ilstu.edu",
"imamreza.ac.ir",
"imamu.edu.sa",
"imau.edu.cn",
@ -3592,7 +3605,7 @@
"kettering.edu",
"keu.edu.af",
"kfb-berlin.de",
"kfh-Freiburg.de",
"kfh-freiburg.de",
"kfh-mainz.de",
"kfhnw.de",
"kfs.edu.eg",
@ -4168,6 +4181,7 @@
"mahidol.ac.th",
"mahsa.edu.my",
"mahshahriau.ac.ir",
"mail.xhu.edu.cn",
"maimonides.edu.ar",
"maine.edu",
"majancollege.edu.om",
@ -4218,6 +4232,7 @@
"marywood.edu",
"masdar.ac.ae",
"maseno.ac.ke",
"massasoit.edu",
"massasoit.mass.edu",
"massbay.edu",
"massey.ac.nz",
@ -4256,11 +4271,11 @@
"mch.mii.lt",
"mchenry.edu",
"mci.edu",
"mckenna.edu",
"mclennan.edu",
"mcm.edu",
"mcmaster.ca",
"mcneese.edu",
"mcpherson.edu",
"mcst.edu.sa",
"mctc.edu",
"mcu.ac.in",
@ -4444,6 +4459,7 @@
"mofidu.ac.ir",
"mogadishuuniversity.com",
"mohave.edu",
"mohawkcollege.ca",
"mokpo.ac.kr",
"mokwon.ac.kr",
"molloy.edu",
@ -4547,7 +4563,7 @@
"mtech.edu",
"mtholyoke.edu",
"mti.edu.eg",
"mtroyal.ab.ca",
"mtroyal.ca",
"mtsac.edu",
"mtsu.edu",
"mtu.ac.kr",
@ -4592,6 +4608,7 @@
"musashi.ac.jp",
"musashino-music.ac.jp",
"musashino-wu.ac.jp",
"musc.edu",
"muscatcollege.edu.om",
"musicacademy.edu.az",
"musik-kons.dk",
@ -4622,8 +4639,10 @@
"my.ipleiria.pt",
"mybrcc.edu",
"mylambton.ca",
"mylaurier.ca",
"mylcp.net",
"myongji.ac.kr",
"myscc.ca",
"myseneca.ca",
"myu.ac.jp",
"mzumbe.ac.tz",
@ -4763,6 +4782,7 @@
"neu.edu.tr",
"neu.edu.vn",
"neub.edu.bd",
"neumann.edu",
"neuq.edu.cn",
"nevada.edu",
"nevsehir.edu.tr",
@ -5097,7 +5117,6 @@
"octech.edu",
"odc.edu",
"odessa.edu",
"odtu.edu.tr",
"odu.edu",
"odu.edu.tr",
"oduduwauniversity.edu.ng",
@ -5106,7 +5125,6 @@
"ogi.edu",
"ogu.edu.tr",
"ohio.edu",
"ohiou.edu",
"ohkagakuen-u.ac.jp",
"ohlone.edu",
"ohsu.edu",
@ -5412,6 +5430,7 @@
"politecjic.edu.co",
"polito.it",
"polito.uz",
"polk.edu",
"polnep.ac.id",
"polsl.gliwice.pl",
"poltek-malang.ac.id",
@ -5588,6 +5607,7 @@
"qhnu.edu.cn",
"qhrtvu.edu.cn",
"qhu.edu.cn",
"qmul.ac.uk",
"qmw.ac.uk",
"qom-iau.ac.ir",
"qom.ac.ir",
@ -5749,6 +5769,7 @@
"rsmu.da.ru",
"rsmu.ru",
"rsu.ac.th",
"rsu.edu",
"rsu.edu.sd",
"rsu.ru",
"rsuh.ru",
@ -6219,6 +6240,7 @@
"smtu.ru",
"smu.ac.kr",
"smu.ac.uk",
"smu.ca",
"smu.edu",
"smu.edu.in",
"smu.edu.ph",
@ -6358,6 +6380,7 @@
"ssus.ac.in",
"ssvv.up.nic.in",
"st-and.ac.uk",
"st-andrews.ac.uk",
"st-georgen.uni-frankfurt.de",
"st-patricks.ac.uk",
"staffs.ac.uk",
@ -6374,6 +6397,7 @@
"stchas.edu",
"stcl.edu",
"stclairc.on.ca",
"stclairconnect.ca",
"stclements.edu.nu",
"stcloudstate.edu",
"stedwards.edu",
@ -6418,8 +6442,10 @@
"stu.ac.kr",
"stu.edu",
"stu.edu.cn",
"stu.gcu.edu.cn",
"stu.lipetsk.ru",
"stu.ru",
"stu.xhu.edu.cn",
"stuba.sk",
"stud.hs-hannover.de",
"student.42.fr",
@ -6699,6 +6725,7 @@
"thenicc.edu",
"theonest.edu.lb",
"thh-friedensau.de",
"thi.de",
"thierryschool.org",
"thiqaruni.org",
"thk.edu.tr",
@ -6774,7 +6801,7 @@
"tohoku-pharm.ac.jp",
"tohoku.ac.jp",
"tohomusic.ac.jp",
"tohtech.ac.j",
"tohtech.ac.jp",
"tohwa-u.ac.jp",
"toin.ac.jp",
"tojo.ac.jp",
@ -6883,7 +6910,6 @@
"tu-dortmund.de",
"tu-dresden.de",
"tu-freiberg.de",
"tu-harburg.de",
"tu-ilmenau.de",
"tu-sofia.bg",
"tu-varna.acad.bg",
@ -6907,6 +6933,7 @@
"tufts.edu",
"tugab.bg",
"tugraz.at",
"tuhh.de",
"tui.edu",
"tuiasi.ro",
"tuins.ac.jp",
@ -6946,6 +6973,7 @@
"tvcc.edu",
"tvu.ac.uk",
"tvuni.in",
"tvz.hr",
"twcpe.ac.jp",
"twcu.ac.jp",
"twmu.ac.jp",
@ -7027,6 +7055,7 @@
"uaf.edu.pk",
"uaf.mx",
"uafam.edu.do",
"uafs.edu",
"uag.mx",
"uagraria.edu.ec",
"uagrm.edu.bo",
@ -7615,6 +7644,7 @@
"ulk.ac.rw",
"ull.es",
"ulm.edu",
"uloyola.es",
"ulpgc.es",
"ulsa.edu.mx",
"ulsab.edu.mx",
@ -8120,6 +8150,7 @@
"unimonte.br",
"unimontes.br",
"unimoron.edu.ar",
"unin.hr",
"unina.it",
"unina2.it",
"uninav.it",
@ -8260,6 +8291,7 @@
"univ-emir.dz",
"univ-evry.fr",
"univ-fianar.mg",
"univ-grenoble-alpes.fr",
"univ-guelma.dz",
"univ-ibntofail.ac.ma",
"univ-inpt.fr",
@ -8519,6 +8551,7 @@
"untagsmg.ac.id",
"untan.ac.id",
"untar.ac.id",
"unthsc.edu",
"untirta.ac.id",
"untref.edu.ar",
"untumbes.edu.pe",
@ -8679,7 +8712,6 @@
"upm.ro",
"upmc.com",
"upmc.edu",
"upmf-grenoble.fr",
"upmin.edu.ph",
"upn.mx",
"upnfm.edu.hn",
@ -8743,6 +8775,7 @@
"urca.br",
"urcamp.tche.br",
"uregina.ca",
"urfu.ru",
"uri.br",
"uri.edu",
"urich.edu",
@ -8887,7 +8920,6 @@
"usthb.dz",
"ustmb.ac.ir",
"ustpaul.ca",
"ustu.ru",
"usu.ac.id",
"usu.br",
"usu.edu",
@ -8981,6 +9013,7 @@
"utp.edu.my",
"utp.edu.pe",
"utp.edu.pl",
"utpb.edu",
"utpl.edu.ec",
"utpp.edu.kh",
"utrgv.edu",
@ -9093,6 +9126,7 @@
"vancouver.wsu.edu",
"vanderbilt.edu",
"vaneduc.edu.ar",
"vaniercollege.qc.ca",
"vassar.edu",
"vbspu.ac.in",
"vbu.co.in",
@ -9106,6 +9140,7 @@
"venturacollege.edu",
"ver.ucc.mx",
"veritas.edu.ng",
"vern.hr",
"vernoncollege.edu",
"vesalius.edu",
"vet-alfort.fr",
@ -9336,7 +9371,7 @@
"windesheim.nl",
"windsor.edu",
"windward.hawaii.edu",
"winona.msus.edu",
"winona.edu",
"winthrop.edu",
"wiregrass.edu",
"wisc.edu",
@ -9453,8 +9488,6 @@
"www-ecpm.u-strasbg.fr",
"www-engees.u-strasbg.fr",
"www-ensais.u-strasbg.fr",
"www-ensimag.imag.fr",
"www-enspg.inpg.fr",
"www-ensps.u-strasbg.fr",
"www-ulp.u-strasbg.fr",
"www-urs.u-strasbg.fr",
@ -9637,5 +9670,5 @@
],
"name": "University domains",
"type": "hostname",
"version": 20190725
"version": 20200721
}

20523
lists/vpn-ipv4/list.json
View File

File diff suppressed because it is too large Load Diff

1275
lists/vpn-ipv6/list.json
View File

File diff suppressed because it is too large Load Diff

28
lists/wikimedia/list.json
View File

@ -1,6 +1,19 @@
{
"description": "Wikimedia address ranges (http://noc.wikimedia.org/conf/reverse-proxy.php.txt)",
"list": [
"10.128.0.0/24",
"10.132.0.0/24",
"10.192.0.0/22",
"10.192.16.0/22",
"10.192.32.0/22",
"10.192.48.0/22",
"10.20.0.0/24",
"10.64.0.0/22",
"10.64.16.0/22",
"10.64.32.0/22",
"10.64.48.0/22",
"2001:df2:e500:101::/64",
"202.63.61.242",
"208.80.153.0/27",
"208.80.153.32/27",
"208.80.153.64/27",
@ -9,15 +22,28 @@
"208.80.154.128/26",
"208.80.154.64/26",
"208.80.155.96/27",
"217.94.171.96",
"2620:0:860:101::/64",
"2620:0:860:102::/64",
"2620:0:860:103::/64",
"2620:0:860:104::/64",
"2620:0:860:1::/64",
"2620:0:860:2::/64",
"2620:0:860:3::/64",
"2620:0:860:4::/64",
"2620:0:861:101::/64",
"2620:0:861:102::/64",
"2620:0:861:103::/64",
"2620:0:861:107::/64",
"2620:0:861:1::/64",
"2620:0:861:2::/64",
"2620:0:861:3::/64",
"2620:0:861:4::/64",
"2620:0:862:102::/64",
"2620:0:862:1::/64",
"2620:0:863:101::/64",
"62.214.230.86",
"68.124.59.186",
"91.198.174.0/25"
],
"matching_attributes": [
@ -27,5 +53,5 @@
],
"name": "List of known Wikimedia address ranges",
"type": "cidr",
"version": 20190912
"version": 20200721
}

49
tools/generate-amazon-aws.py
View File

@ -1,29 +1,38 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import json
import datetime
import urllib.request
import json
res = urllib.request.urlopen('https://ip-ranges.amazonaws.com/ip-ranges.json')
from generator import download_to_file, get_version, write_to_file
res_body = res.read()
j = json.loads(res_body.decode("utf-8"))
l = []
for prefix in j['prefixes']:
l.append(prefix['ip_prefix'])
def process(file, dst):
with open(file, 'r') as json_file:
amazon_aws_ip_list = json.load(json_file)
l = []
for prefix in j['ipv6_prefixes']:
l.append(prefix['ipv6_prefix'])
warninglist = {}
warninglist['name'] = 'List of known Amazon AWS IP address ranges'
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = 'Amazon AWS IP address ranges (https://ip-ranges.amazonaws.com/ip-ranges.json)'
warninglist['type'] = 'cidr'
warninglist['list'] = sorted(set(l))
warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip"]
for prefix in amazon_aws_ip_list['prefixes']:
l.append(prefix['ip_prefix'])
print(json.dumps(warninglist))
for prefix in amazon_aws_ip_list['ipv6_prefixes']:
l.append(prefix['ipv6_prefix'])
warninglist = {
'name': 'List of known Amazon AWS IP address ranges',
'version': get_version(),
'description': 'Amazon AWS IP address ranges (https://ip-ranges.amazonaws.com/ip-ranges.json)',
'type': 'cidr',
'list': l,
'matching_attributes': ["ip-src", "ip-dst", "domain|ip"]
}
write_to_file(warninglist, dst)
if __name__ == '__main__':
amazon_url = "https://ip-ranges.amazonaws.com/ip-ranges.json"
amazon_file = "amazon_ip-ranges.json"
amazon_dst = "amazon-aws"
download_to_file(amazon_url, amazon_file)
process(amazon_file, amazon_dst)

40
tools/generate-cisco-top1m.py
View File

@ -1,40 +0,0 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import zipfile
import datetime
import json
cisco_url = "http://s3-us-west-1.amazonaws.com/umbrella-static/top-1m.csv.zip"
cisco_file = "top-1m.csv.zip"
user_agent = {"User-agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0"}
r = requests.get(cisco_url, headers=user_agent)
with open(cisco_file, 'wb') as fd:
for chunk in r.iter_content(4096):
fd.write(chunk)
with zipfile.ZipFile(cisco_file, 'r') as cisco_lists:
for name in cisco_lists.namelist():
if name == "top-1m.csv":
with cisco_lists.open(name) as top:
top1000 = top.readlines()[:1000]
else:
continue
cisco_warninglist = {}
version = int(datetime.date.today().strftime('%Y%m%d'))
cisco_warninglist['description'] = 'Event contains one or more entries from the top 1000 of the most used website (Cisco Umbrella).'
d = datetime.datetime.now()
cisco_warninglist['version'] = version
cisco_warninglist['name'] = 'Top 1000 website from Cisco Umbrella'
cisco_warninglist['type'] = 'hostname'
cisco_warninglist['matching_attributes'] = ['hostname', 'domain']
cisco_warninglist['list'] = []
for site in top1000:
v = str(site).split(',')[1]
cisco_warninglist['list'].append(v.rstrip())
cisco_warninglist['list'] = sorted(set(cisco_warninglist['list']))
print(json.dumps(cisco_warninglist))

77
tools/generate-cisco.py Executable file
View File

@ -0,0 +1,77 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import zipfile
from generator import download_to_file, get_version, write_to_file
def process(file):
top1k, top5k, top10k, top20k = get_lists(file)
cisco_dst_1k = 'cisco_top1000'
cisco_1k_warninglist = {
'name': 'Top 1000 websites from Cisco Umbrella',
'description': 'Event contains one or more entries from the top 1000 of the most used websites (Cisco Umbrella).'
}
generate(top1k, cisco_1k_warninglist, cisco_dst_1k)
cisco_dst_5k = 'cisco_top5k'
cisco_5k_warninglist = {
'name': 'Top 5000 websites from Cisco Umbrella',
'description': 'Event contains one or more entries from the top 5000 of the most used websites (Cisco Umbrella).'
}
generate(top5k, cisco_5k_warninglist, cisco_dst_5k)
cisco_dst_10k = 'cisco_top10k'
cisco_10k_warninglist = {
'name': 'Top 10 000 websites from Cisco Umbrella',
'description': 'Event contains one or more entries from the top 10 000 of the most used websites (Cisco Umbrella).'
}
generate(top10k, cisco_10k_warninglist, cisco_dst_10k)
cisco_dst_20k = 'cisco_top20k'
cisco_20k_warninglist = {
'name': 'Top 20 000 websites from Cisco Umbrella',
'description': 'Event contains one or more entries from the top 20 000 of the most used websites (Cisco Umbrella).'
}
generate(top20k, cisco_20k_warninglist, cisco_dst_20k)
def generate(sites, warninglist, dst):
warninglist['version'] = get_version()
warninglist['type'] = 'hostname'
warninglist['matching_attributes'] = [
'hostname', 'domain', 'url', 'domain|ip']
warninglist['list'] = []
for site in sites:
v = site.decode('UTF-8').split(',')[1]
warninglist['list'].append(v.strip().replace('\\r\\n', ''))
write_to_file(warninglist, dst)
def get_lists(file):
with zipfile.ZipFile(file, 'r') as cisco_lists:
for name in cisco_lists.namelist():
if name == "top-1m.csv":
with cisco_lists.open(name) as cisco_list:
all = cisco_list.readlines()
top1k = all[:1000]
top5k = all[:5000]
top10k = all[:10000]
top20k = all[:20000]
else:
continue
return top1k, top5k, top10k, top20k
if __name__ == '__main__':
cisco_url = "http://s3-us-west-1.amazonaws.com/umbrella-static/top-1m.csv.zip"
cisco_file = "cisco_top-1m.csv.zip"
download_to_file(cisco_url, cisco_file)
process(cisco_file)

60
tools/generate-cloudflare.py
View File

@ -1,33 +1,39 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import json
import os
import requests
import datetime
import io
base_url="https://www.cloudflare.com/"
uri_list=['ips-v4','ips-v6']
dict=dict()
dict['list']=list()
def source_read_and_add(input_file):
output_list=list()
for line in input_file.splitlines():
output_list.append(line)
return output_list
from generator import download_to_file, get_version, write_to_file
for uri in uri_list:
url = base_url + uri
r=requests.get(url)
dict['list'] += source_read_and_add(r.text)
def process(files, dst):
warninglist = {
'name': "List of known Cloudflare IP ranges",
'version': get_version(),
'description': "List of known Cloudflare IP ranges (https://www.cloudflare.com/ips/)",
'type': "cidr",
'list': [],
'matching_attributes': ["ip-dst", "ip-src", "domain|ip"]
}
dict['type'] = "cidr"
dict['matching_attributes']=["ip-dst","ip-src","domain|ip"]
dict['name']="List of known Cloudflare IP ranges"
dict['version']= int(datetime.date.today().strftime('%Y%m%d'))
dict['description']="List of known Cloudflare IP ranges (https://www.cloudflare.com/ips/)"
dict['list']=list(set(dict['list']))
for file in files:
with open(file, 'r') as f:
ips = f.readlines()
for ip in ips:
warninglist['list'].append(ip.strip())
print(json.dumps(dict))
write_to_file(warninglist, dst)
if __name__ == '__main__':
cf_base_url = "https://www.cloudflare.com/"
uri_list = ['ips-v4', 'ips-v6']
cf_dst = 'cloudflare'
to_process = list()
for uri in uri_list:
url = cf_base_url+uri
file = 'cloudflare_{}.txt'.format(uri)
download_to_file(url, file)
to_process.append(file)
process(to_process, cf_dst)

66
tools/generate-covid.py
View File

@ -1,43 +1,35 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import json
import datetime
url = 'https://raw.githubusercontent.com/krassi/covid19-related/master/whitelist-domains.txt'
r = requests.get(url)
whitelist = r.text
whitelist = list(set(whitelist.split()))
warninglist = {
'name': 'Covid-19 Krassi\'s Whitelist',
'description': 'Krassimir\'s Covid-19 whitelist of known good Covid-19 related websites.',
'type': 'hostname',
'matching_attributes': ['domain', 'hostname', 'url'],
'version': int(datetime.date.today().strftime('%Y%m%d')),
'list': sorted(whitelist)
}
with open('../lists/covid-19-krassi-whitelist/list.json', 'w+') as data_file:
json.dump(warninglist, data_file, indent=2, sort_keys=True)
url = 'https://raw.githubusercontent.com/Cyber-Threat-Coalition/goodlist/master/hostnames.txt'
r = requests.get(url)
whitelist = r.text
whitelist = list(set(whitelist.split()))
warninglist = {
'name': 'Covid-19 Cyber Threat Coalition\'s Whitelist',
'description': 'The Cyber Threat Coalition\'s whitelist of COVID-19 related websites.',
'type': 'hostname',
'matching_attributes': ['domain', 'hostname', 'url'],
'version': int(datetime.date.today().strftime('%Y%m%d')),
'list': sorted(whitelist)
}
with open('../lists/covid-19-cyber-threat-coalition-whitelist/list.json', 'w+') as data_file:
json.dump(warninglist, data_file, indent=2, sort_keys=True)
from generator import download, get_version, write_to_file
def process(url, warninglist, dst):
whitelist = download(url).text
whitelist = list(set(whitelist.split()))
warninglist['type'] = 'hostname'
warninglist['matching_attributes'] = ['domain', 'hostname', 'url']
warninglist['version'] = get_version()
warninglist['list'] = whitelist
write_to_file(warninglist, dst)
if __name__ == '__main__':
covid_krassi_url = 'https://raw.githubusercontent.com/krassi/covid19-related/master/whitelist-domains.txt'
covid_krassi_dst = 'covid-19-krassi-whitelist'
covid_krassi_warninglist = {
'name': 'Covid-19 Krassi\'s Whitelist',
'description': 'Krassimir\'s Covid-19 whitelist of known good Covid-19 related websites.'
}
process(covid_krassi_url, covid_krassi_warninglist, covid_krassi_dst)
covid_cyber_threat_coalition_url = 'https://raw.githubusercontent.com/Cyber-Threat-Coalition/goodlist/master/hostnames.txt'
covid_cyber_threat_coalition_dst = 'covid-19-cyber-threat-coalition-whitelist'
covid_cyber_threat_coalition_warninglist = {
'name': 'Covid-19 Cyber Threat Coalition\'s Whitelist',
'description': 'The Cyber Threat Coalition\'s whitelist of COVID-19 related websites.'
}
process(covid_cyber_threat_coalition_url,
covid_cyber_threat_coalition_warninglist, covid_cyber_threat_coalition_dst)

61
tools/generate-crl-ip-list.py
View File

@ -1,32 +1,41 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import json
import os
import requests
import datetime
base_url="https://raw.githubusercontent.com/threatstop/crl-ocsp-whitelist/master/"
uri_list=['crl-hostnames.txt','crl-ipv4.txt','crl-ipv6.txt','ocsp-hostnames.txt','ocsp-ipv4.txt','ocsp-ipv6.txt']
dict=dict()
dict['list']=list()
def source_read_and_add(input_file):
output_list=list()
for item in input_file:
item=item.rstrip()
output_list.append(item)
return output_list
from generator import download_to_file, get_version, write_to_file
for uri in uri_list:
url = base_url + uri
r=requests.get(url)
dict['list'] += source_read_and_add(r.text)
def process(files, dst):
dict['type'] = "string"
dict['matching_attributes']=["hostname","domain","ip-dst","ip-src","url", "domain|ip"]
dict['name']="CRL Warninglist"
dict['version']= int(datetime.date.today().strftime('%Y%m%d'))
dict['description']="CRL Warninglist from threatstop (https://github.com/threatstop/crl-ocsp-whitelist/)"
dict['list']=list(set(dict['list']))
warninglist = {
'type': "string",
'matching_attributes': ["hostname", "domain", "ip-dst", "ip-src", "url", "domain|ip"],
'name': "CRL Warninglist",
'version': get_version(),
'description': "CRL Warninglist from threatstop (https://github.com/threatstop/crl-ocsp-whitelist/)",
'list': []
}
print(json.dumps(dict))
for file in files:
with open(file, 'r') as f:
ips = f.readlines()
for ip in ips:
warninglist['list'].append(ip.strip())
write_to_file(warninglist, dst)
if __name__ == '__main__':
crl_ip_base_url = 'https://raw.githubusercontent.com/threatstop/crl-ocsp-whitelist/master/'
uri_list = ['crl-hostnames.txt', 'crl-ipv4.txt', 'crl-ipv6.txt',
'ocsp-hostnames.txt', 'ocsp-ipv4.txt', 'ocsp-ipv6.txt']
crl_ip_dst = 'crl-ip-hostname'
to_process = list()
for uri in uri_list:
url = crl_ip_base_url + uri
file = 'ocsp_{}'.format(uri)
download_to_file(url, file)
to_process.append(file)
process(to_process, crl_ip_dst)

40
tools/generate-disposal.py
View File

@ -2,26 +2,26 @@
# -*- coding: utf-8 -*-
import requests
import json
import datetime
url = 'https://raw.githubusercontent.com/martenson/disposable-email-domains/master/disposable_email_blocklist.conf'
r = requests.get(url, stream=True)
domain = []
for ip in r.iter_lines():
v = ip.decode('utf-8')
if not v.startswith("#"):
if v: domain.append(v)
warninglist = {}
warninglist['name'] = 'List of disposable email domains'
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = 'List of disposable email domains'
warninglist['list'] = sorted(set(domain))
warninglist['type'] = 'substring'
warninglist['matching_attributes'] = ["email-src", "email-dst", "whois-registrant-email", "domain|ip", "dns-soa-email"]
with open('../lists/disposable-email/list.json', 'w') as data_file:
json.dump(warninglist, data_file, indent=4, sort_keys=True)
from generator import process_stream, get_version, write_to_file
def process(url, dst):
warninglist = {
'name': 'List of disposable email domains',
'version': get_version(),
'description': 'List of disposable email domains',
'list': process_stream(url),
'type': 'substring',
'matching_attributes': ["email-src", "email-dst", "whois-registrant-email", "domain|ip", "dns-soa-email"]
}
write_to_file(warninglist, dst)
if __name__ == '__main__':
disposal_url = 'https://raw.githubusercontent.com/martenson/disposable-email-domains/master/disposable_email_blocklist.conf'
disposal_dst = 'disposable-email'
process(disposal_url, disposal_dst)

56
tools/generate-microsoft-azure.py
View File

@ -1,25 +1,45 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import xml.etree.ElementTree as ET
import json
import datetime
url = 'https://download.microsoft.com/download/0/1/8/018E208D-54F8-44CD-AA26-CD7BC9524A8C/PublicIPs_20171226.xml'
r = requests.get(url)
office365 = ET.fromstring(r.text)
l = []
for region in office365.iter('Region'):
for subnet in region.iter('IpRange'):
l.append(subnet.get('Subnet'))
from bs4 import BeautifulSoup
warninglist = {}
warninglist['name'] = 'List of known Microsoft Azure Datacenter IP Ranges'
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = 'Microsoft Azure Datacenter IP Ranges'
warninglist['list'] = sorted(set(l))
warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip"]
warninglist['type'] = 'cidr'
from generator import download, download_to_file, get_version, write_to_file
print(json.dumps(warninglist))
def get_json_url(page):
soup = BeautifulSoup(page.text, 'html.parser')
retry_link_text = soup.find(class_='link-align')
retry_links = retry_link_text.find_all('a')
return retry_links[0].get('href')
def process(file, dst):
warninglist = {
'name': 'List of known Microsoft Azure Datacenter IP Ranges',
'version': get_version(),
'description': 'Microsoft Azure Datacenter IP Ranges',
'list': [],
'matching_attributes': ["ip-src", "ip-dst", "domain|ip"],
'type': 'cidr'
}
with open(file, 'r') as json_file:
ms_azure_ip_list = json.load(json_file)
for value in ms_azure_ip_list['values']:
warninglist['list'] += value['properties']['addressPrefixes']
write_to_file(warninglist, dst)
if __name__ == '__main__':
ms_azure_url = 'https://www.microsoft.com/en-us/download/confirmation.aspx?id=56519'
ms_azure_file = 'ms-azure.json'
ms_azure_dst = 'microsoft-azure'
ms_azure_json_url = get_json_url(download(ms_azure_url))
download_to_file(ms_azure_json_url, ms_azure_file)
process(ms_azure_file, ms_azure_dst)

84
tools/generate-office365.py
View File

@ -1,42 +1,58 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import json
import datetime
url = 'https://endpoints.office.com/endpoints/worldwide?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7'
r = requests.get(url)
service_list = r.json()
lurls= []
lips = []
for service in service_list:
for url in service.get('urls', []):
lurls.append(url.replace('*', ''))
for ip in service.get('ips', []):
lips.append(ip)
warninglist = {}
warninglist['name'] = 'List of known Office 365 URLs address ranges'
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = 'Office 365 URLs and IP address ranges'
warninglist['type'] = 'string'
warninglist['list'] = sorted(set(lurls))
warninglist['matching_attributes'] = ["domain", "domain|ip", "hostname"]
from generator import download, get_version, write_to_file
with open('../lists/microsoft-office365/list.json', 'w') as data_file:
json.dump(warninglist, data_file, indent=4, sort_keys=True)
def process(url):
lurls, lips = get_lists(url)
warninglist = {}
warninglist['name'] = 'List of known Office 365 IP address ranges'
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = 'Office 365 URLs and IP address ranges'
warninglist['list'] = sorted(set(lips))
warninglist['type'] = 'cidr'
warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip"]
# URLs of services
office365_urls_dst = 'microsoft-office365'
office365_urls_warninglist = {
'name': 'List of known Office 365 URLs',
'description': 'Office 365 URLs and IP address ranges',
'type': 'string',
'matching_attributes': ["domain", "domain|ip", "hostname"]
}
generate(lurls, office365_urls_dst, office365_urls_warninglist)
# IPs of services
office365_ips_dst = 'microsoft-office365-ip'
office365_ips_warninglist = {
'name': 'List of known Office 365 IP address ranges',
'description': 'Office 365 IP address ranges',
'type': 'cidr',
'matching_attributes': ["ip-src", "ip-dst", "domain|ip"]
}
generate(lips, office365_ips_dst, office365_ips_warninglist)
with open('../lists/microsoft-office365-ip/list.json', 'w') as data_file:
json.dump(warninglist, data_file, indent=4, sort_keys=True)
def generate(data_list, dst, warninglist):
warninglist['version'] = get_version()
warninglist['list'] = data_list
write_to_file(warninglist, dst)
def get_lists(url):
service_list = download(url).json()
lurls = []
lips = []
for service in service_list:
for url in service.get('urls', []):
if url.find(".*.") == -1:
lurls.append(url.replace('*', ''))
for ip in service.get('ips', []):
lips.append(ip)
return lurls, lips
if __name__ == '__main__':
office365_url = 'https://endpoints.office.com/endpoints/worldwide?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7'
process(office365_url)

134
tools/generate-publicdns.py
View File

@ -1,69 +1,85 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import csv
import datetime
import logging
import ipaddress
import json
import os
import requests
import logging
servers_url = 'http://public-dns.info/nameservers.csv'
csv_path = 'nameservers.csv'
dns4_path = 'list4.json'
dns6_path = 'list6.json'
if os.path.isfile(csv_path):
logging.warning('Not erasing local csv file')
else:
req = requests.get(servers_url)
with open(csv_path, 'wb') as fd:
for chunk in req.iter_content(4096):
fd.write(chunk)
ip4_list = []
ip6_list = []
with open(csv_path) as csv_file:
servers_list = csv.reader(csv_file, delimiter=',', quotechar='"')
for row in servers_list:
if row[5] == '':
try:
ip = ipaddress.ip_address(row[0])
if ip.version == 4:
list = ip4_list
else:
list = ip6_list
list.append(ip.compressed)
if len(row[1]) > 0 and row[1] != '.':
list.append(row[1])
except ValueError as exc:
logging.warning(str(exc))
version = int(datetime.date.today().strftime('%Y%m%d'))
out4_list = {}
out4_list['name'] = 'List of known IPv4 public DNS resolvers'
out4_list['version'] = version
out4_list['description'] = 'Event contains one or more public IPv4 DNS resolvers as attribute with an IDS flag set'
out4_list['matching_attributes'] = ['ip-src', 'ip-dst', 'domain|ip']
out4_list['list'] = sorted(set(ip4_list))
from generator import download_to_file, get_version, write_to_file
out6_list = {}
out6_list['name'] = 'List of known IPv6 public DNS resolvers'
out6_list['version'] = version
out6_list['description'] = 'Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set'
out6_list['matching_attributes'] = ['ip-src', 'ip-dst', 'domain|ip']
out6_list['list'] = sorted(set(ip6_list))
def process(file):
lipv4, lipv6, lhostname = get_lists(file)
# Public DNS Domains
publicdns_hostname_dst = 'public-dns-hostname'
publicdns_hostname_warninglist = {
'description': 'Event contains one or more public DNS resolvers (expressed as hostname) as attribute with an IDS flag set',
'name': 'List of known public DNS resolvers expressed as hostname',
'type': 'hostname',
'matching_attributes': ['hostname', 'domain', 'url', 'domain|ip']
}
generate(lhostname, publicdns_hostname_warninglist, publicdns_hostname_dst)
# Public DNS IPv4
publicdns_ipv4_dst = 'public-dns-v4'
publicdns_ipv4_warninglist = {
'description': 'Event contains one or more public IPv4 DNS resolvers as attribute with an IDS flag set',
'name': 'List of known IPv4 public DNS resolvers',
'type': 'string',
'matching_attributes': ['ip-src', 'ip-dst', 'domain|ip']
}
generate(lipv4, publicdns_ipv4_warninglist, publicdns_ipv4_dst)
# Public DNS IPv4
publicdns_ipv6_dst = 'public-dns-v6'
publicdns_ipv6_warninglist = {
'description': 'Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set',
'name': 'List of known IPv6 public DNS resolvers',
'type': 'string',
'matching_attributes': ['ip-src', 'ip-dst', 'domain|ip']
}
generate(lipv6, publicdns_ipv6_warninglist, publicdns_ipv6_dst)
# print(json.dumps(out4_list, indent=True))
with open(dns4_path, 'w') as dns4_file:
dns4_file.write(json.dumps(out4_list, indent=4, sort_keys=True))
def generate(data_list, warninglist, dst):
with open(dns6_path, 'w') as dns6_file:
dns6_file.write(json.dumps(out6_list, indent=4, sort_keys=True))
warninglist['version'] = get_version()
warninglist['list'] = data_list
write_to_file(warninglist, dst)
def get_lists(file):
with open(file) as csv_file:
servers_list = csv.reader(csv_file, delimiter=',', quotechar='"')
lipv4 = []
lipv6 = []
lhostname = []
for row in servers_list:
if row[7] in (None, ""):
try:
ip = ipaddress.ip_address(row[0])
if ip.version == 4:
lipv4.append(ip.compressed)
elif ip.version == 6:
lipv6.append(ip.compressed)
if row[1] not in (None, "", '.'):
lhostname.append(row[1])
except ValueError as exc:
logging.warning(str(exc))
return lipv4, lipv6, lhostname
if __name__ == '__main__':
publicdns_url = 'https://public-dns.info/nameservers.csv'
publicdns_file = 'public-dns-nameservers.csv'
download_to_file(publicdns_url, publicdns_file)
process(publicdns_file)

45
tools/generate-tlds.py
View File

@ -1,27 +1,30 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import json
import datetime
from generator import download, get_version, write_to_file
url = 'https://data.iana.org/TLD/tlds-alpha-by-domain.txt'
r = requests.get(url)
tlds = []
for tld in r.text.splitlines():
if tld.startswith('#'):
continue
tlds.append(tld)
warninglist = {
'name': 'TLDs as known by IANA',
'version': int(datetime.date.today().strftime('%Y%m%d')),
'description': 'Event contains one or more TLDs as attribute with an IDS flag set',
'list': sorted(set(tlds)),
'matching_attributes': ["hostname", "domain", "domain|ip"],
'type': 'string',
}
def process(url, dst):
warninglist = {
'name': 'TLDs as known by IANA',
'version': get_version(),
'description': 'Event contains one or more TLDs as attribute with an IDS flag set',
'list': [],
'matching_attributes': ["hostname", "domain", "domain|ip"],
'type': 'string'
}
with open('../lists/tlds/list.json', 'w') as data_file:
json.dump(warninglist, data_file, indent=2, sort_keys=True)
data_file.write("\n")
r = download(url)
for tld in r.text.splitlines():
if tld.startswith('#'):
continue
warninglist['list'].append(tld)
write_to_file(warninglist, dst)
if __name__ == '__main__':
tlds_url = 'https://data.iana.org/TLD/tlds-alpha-by-domain.txt'
tlds_dst = 'tlds'
process(tlds_url, tlds_dst)

45
tools/generate-university-domain-list.py
View File

@ -1,27 +1,32 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
from generator import download, get_version, write_to_file
import requests
import datetime
import json
def process(url, dst):
json_output=dict()
json_output['type']="hostname"
json_output['name']="University domains"
json_output['matching_attributes']=['hostname','domain','url','domain|ip']
json_output['version']= int(datetime.date.today().strftime('%Y%m%d'))
json_output['description']="List of University domains from https://raw.githubusercontent.com/Hipo/university-domains-list/master/world_universities_and_domains.json"
json_output['list']=list()
university_list = download(url).json()
warninglist = {
'type': "hostname",
'name': "University domains",
'matching_attributes': ['hostname', 'domain', 'url', 'domain|ip'],
'version': get_version(),
'description': "List of University domains from https://raw.githubusercontent.com/Hipo/university-domains-list/master/world_universities_and_domains.json",
'list': []
}
for university in university_list:
for domain in university.get('domains'):
if domain not in warninglist['list']:
warninglist['list'].append(domain)
write_to_file(warninglist, dst)
if __name__ == '__main__':
university_url = 'https://raw.githubusercontent.com/Hipo/university-domains-list/master/world_universities_and_domains.json'
university_dst = 'university_domains'
url="https://raw.githubusercontent.com/Hipo/university-domains-list/master/world_universities_and_domains.json"
university_list_file=requests.get(url)
university_list_json=university_list_file.json()
for university in university_list_json:
for domain in university.get('domains'):
if domain not in json_output['list']:
json_output['list'].append(domain)
print(json.dumps(json_output))
process(university_url, university_dst)

60
tools/generate-vpn.py
View File

@ -1,49 +1,27 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import json
import datetime
url = 'https://raw.githubusercontent.com/ejrv/VPNs/master/vpn-ipv4.txt'
r = requests.get(url, stream=True)
ipsv4 = []
for ip in r.iter_lines():
v = ip.decode('utf-8')
if not v.startswith("#"):
if v: ipsv4.append(v)
warninglist = {}
warninglist['name'] = 'Specialized list of IPv4 addresses belonging to common VPN providers and datacenters'
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = 'Specialized list of IPv4 addresses belonging to common VPN providers and datacenters'
warninglist['list'] = sorted(set(ipsv4))
warninglist['type'] = 'cidr'
warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip"]
from generator import process_stream, get_version, write_to_file
with open('../lists/vpn-ipv4/list.json', 'w') as data_file:
json.dump(warninglist, data_file, indent=4, sort_keys=True)
def process(url, dst):
warninglist = {
'name': 'Specialized list of {} addresses belonging to common VPN providers and datacenters'.format(dst.split('-')[1].replace('ip', 'IP')),
'version': get_version(),
'description': 'Specialized list of {} addresses belonging to common VPN providers and datacenters'.format(dst.split('-')[1].replace('ip', 'IP')),
'list': process_stream(url),
'type': 'cidr',
'matching_attributes': ["ip-src", "ip-dst", "domain|ip"]
}
write_to_file(warninglist, dst)
url = 'https://raw.githubusercontent.com/ejrv/VPNs/master/vpn-ipv6.txt'
r = requests.get(url, stream=True)
ipsv6 = []
for ip in r.iter_lines():
v = ip.decode('utf-8')
if not v.startswith("#"):
if v: ipsv6.append(v)
warninglist = {}
warninglist['name'] = 'Specialized list of IPv6 addresses belonging to common VPN providers and datacenters'
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = 'Specialized list of IPv6 addresses belonging to common VPN providers and datacenters'
warninglist['list'] = sorted(set(ipsv6))
warninglist['type'] = 'cidr'
warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip"]
with open('../lists/vpn-ipv6/list.json', 'w') as data_file:
json.dump(warninglist, data_file, indent=4, sort_keys=True)
if __name__ == '__main__':
vpn_base_url = 'https://raw.githubusercontent.com/ejrv/VPNs/master/'
uri_list = ['vpn-ipv4', 'vpn-ipv6']
for uri in uri_list:
url = vpn_base_url + uri + '.txt'
uri.split('-')[1].replace('ip', 'IP')
process(url, uri)

55
tools/generate-wikimedia.py
View File

@ -1,34 +1,37 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import json
import datetime
import urllib.request
import codecs
import ipaddress
import re
import ipaddress
res = urllib.request.urlopen('http://noc.wikimedia.org/conf/reverse-proxy.php.txt')
from generator import download, get_version, write_to_file
res_body = res.read()
decoded = res_body.decode("unicode_escape", "utf-8")
l = []
for line in decoded.split('\n'):
if re.search("public", line):
matched = re.findall(r'\'(.*?)\'', line)
if matched:
try:
ipaddress.ip_network(matched[0])
l.append(matched[0])
except ValueError:
pass
warninglist = {}
warninglist['name'] = 'List of known Wikimedia address ranges'
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = 'Wikimedia address ranges (http://noc.wikimedia.org/conf/reverse-proxy.php.txt)'
warninglist['type'] = 'cidr'
warninglist['list'] = sorted(set(l))
warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip"]
def process(url, dst):
warninglist = {
'name': 'List of known Wikimedia address ranges',
'version': get_version(),
'description': 'Wikimedia address ranges (http://noc.wikimedia.org/conf/reverse-proxy.php.txt)',
'type': 'cidr',
'list': [],
'matching_attributes': ["ip-src", "ip-dst", "domain|ip"]
}
print(json.dumps(warninglist))
matched = re.findall(
r'\'(.*?)\'', codecs.decode(download(url).content, 'UTF-8'))
for ip in matched:
try:
ipaddress.ip_network(ip)
warninglist['list'].append(ip)
except ValueError:
pass
write_to_file(warninglist, dst)
if __name__ == '__main__':
wikimedia_url = 'http://noc.wikimedia.org/conf/reverse-proxy.php.txt'
wikimedia_dst = 'wikimedia'
process(wikimedia_url, wikimedia_dst)

63
tools/generate_alexa.py
View File

@ -1,39 +1,40 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import zipfile
import datetime
import json
alexa_url = "http://s3.amazonaws.com/alexa-static/top-1m.csv.zip"
alexa_file = "top-1m.csv.zip"
user_agent = {"User-agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0"}
r = requests.get(alexa_url, headers=user_agent)
with open(alexa_file, 'wb') as fd:
for chunk in r.iter_content(4096):
fd.write(chunk)
with zipfile.ZipFile(alexa_file, 'r') as alexa_lists:
for name in alexa_lists.namelist():
if name == "top-1m.csv":
with alexa_lists.open(name) as top:
top1000 = top.readlines()[:1000]
else:
continue
from generator import download_to_file, get_version, write_to_file
alexa_warninglist = {}
version = int(datetime.date.today().strftime('%Y%m%d'))
alexa_warninglist['description'] = "Event contains one or more entries from the top 1000 of the most used website (Alexa)."
d = datetime.datetime.now()
alexa_warninglist['version'] = version
alexa_warninglist['name'] = "Top 1000 website from Alexa"
alexa_warninglist['type'] = 'hostname'
alexa_warninglist['list'] = []
alexa_warninglist['matching_attributes'] = ['hostname', 'domain']
def process(file, dst):
with zipfile.ZipFile(file, 'r') as alexa_lists:
for name in alexa_lists.namelist():
if name == "top-1m.csv":
with alexa_lists.open(name) as top:
top1000 = top.readlines()[:1000]
else:
continue
for site in top1000:
v = site.decode('UTF-8').split(',')[1]
alexa_warninglist['list'].append(v.rstrip())
alexa_warninglist['list'] = sorted(set(alexa_warninglist['list']))
print(json.dumps(alexa_warninglist))
warninglist = {
'description': "Event contains one or more entries from the top 1000 of the most used website (Alexa).",
'version': get_version(),
'name': "Top 1000 website from Alexa",
'type': 'hostname',
'list': [],
'matching_attributes': ['hostname', 'domain', 'url', 'domain|ip']
}
for site in top1000:
v = site.decode('UTF-8').split(',')[1]
warninglist['list'].append(v.rstrip())
write_to_file(warninglist, dst)
if __name__ == "__main__":
alexa_url = "http://s3.amazonaws.com/alexa-static/top-1m.csv.zip"
alexa_file = "alexa_top-1m.csv.zip"
alexa_dst = "alexa"
download_to_file(alexa_url, alexa_file)
process(alexa_file, alexa_dst)

58
tools/generate_majestic-million.py
View File

@ -1,40 +1,34 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import datetime
import logging
import json
import os
import requests
from generator import download_to_file, get_version, write_to_file
servers_url = 'http://downloads.majestic.com/majestic_million.csv'
csv_path = 'majestic_million.csv'
hostname_path = 'list.json'
if os.path.isfile(csv_path):
logging.warning('Not erasing local csv file')
else:
req = requests.get(servers_url)
with open(csv_path, 'wb') as fd:
for chunk in req.iter_content(4096):
fd.write(chunk)
def process(file, dst):
host_list = []
with open(csv_path, newline='\n', encoding='utf-8', errors='replace') as csv_file:
top10k = csv_file.readlines()[:10000]
with open(file, newline='\n', encoding='utf-8', errors='replace') as csv_file:
sites = csv_file.readlines()[:10000]
version = int(datetime.date.today().strftime('%Y%m%d'))
out_list = {}
warninglist = {
'name': 'Top 10K websites from Majestic Million',
'version': get_version(),
'description': 'Event contains one or more entries from the top 10K of the most used websites (Majestic Million).',
'matching_attributes': ['hostname', 'domain'],
'type': 'hostname',
'list': []
}
out_list['name'] = 'Top 10K websites from Majestic Million'
out_list['version'] = version
out_list['description'] = 'Event contains one or more entries from the top 10K of the most used websites (Majestic Million).'
out_list['matching_attributes'] = ['hostname', 'domain']
out_list['type'] = 'hostname'
out_list['list'] = sorted(set(host_list))
for site in sites:
v = site.split(',')[2]
warninglist['list'].append(v.rstrip())
for hostname in top10k:
v = hostname.split(',')[2]
out_list['list'].append(v.rstrip())
out_list['list'] = sorted(set(out_list['list']))
with open(hostname_path, 'w', newline='\n') as hostname_file:
hostname_file.write(json.dumps(out_list, indent=2, sort_keys=False))
write_to_file(warninglist, dst)
if __name__ == '__main__':
majestic_url = 'http://downloads.majestic.com/majestic_million.csv'
majestic_file = 'majestic_million.csv'
majestic_dst = 'majestic_million'
download_to_file(majestic_url, majestic_file)
process(majestic_file, majestic_dst)

65
tools/generate_mozilla_certificates.py
View File

@ -1,55 +1,56 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import csv
import datetime
import io
import json
import requests
from OpenSSL.crypto import load_certificate, FILETYPE_PEM
from OpenSSL.crypto import FILETYPE_PEM, load_certificate
Included_CA_url = 'https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReportPEMCSV'
Included_CA_file = 'IncludedCACertificateReportPEMCSV.csv'
Included_CA_dst = 'mozilla-CA'
CA_known_intermediate_url = 'https://ccadb-public.secure.force.com/mozilla/PublicAllIntermediateCertsWithPEMCSV'
CA_known_intermediate_file = 'PublicAllIntermediateCertsWithPEMCSV.csv'
CA_known_intermediate_dst = 'mozilla-IntermediateCA'
from generator import download_to_file, get_version, write_to_file
def download(url, file):
r = requests.get(url)
with open(file, 'wb') as fd:
for chunk in r.iter_content(4096):
fd.write(chunk)
def gethash(cert, digest):
return cert.digest(digest).decode('ASCII').replace(':', '').lower()
def process(file, dst, type):
hashes = set()
with open(file, 'r') as f_in:
for obj in csv.DictReader(f_in):
pem = obj['PEM Info'].strip("'").replace('\r','').replace('\n\n','\n')
pem = obj['PEM Info'].strip("'").replace(
'\r', '').replace('\n\n', '\n')
try:
name = obj['Certificate Name']
obj['Certificate Name']
except:
name = obj['Common Name or Certificate Name']
obj['Common Name or Certificate Name']
cert = load_certificate(FILETYPE_PEM, pem)
hashes.add(gethash(cert, 'md5'))
hashes.add(gethash(cert, 'sha1'))
hashes.add(obj['SHA-256 Fingerprint'].lower())
warninglist = {}
warninglist['name'] = 'Fingerprint of {type}'.format(type=type)
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = "Fingerprint of {type} taken from Mozilla's lists at https://wiki.mozilla.org/CA".format(type=type)
warninglist['list'] = sorted(hashes)
warninglist['type'] = 'string'
warninglist['matching_attributes'] = ["md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256", "x509-fingerprint-md5", "x509-fingerprint-sha1", "x509-fingerprint-sha256"]
with open('../lists/{dst}/list.json'.format(dst=dst), 'w') as data_file:
json.dump(warninglist, data_file, indent=2, sort_keys=True)
data_file.write("\n")
warninglist = {
'name': 'Fingerprint of {type}'.format(type=type),
'version': get_version(),
'description': "Fingerprint of {type} taken from Mozilla's lists at https://wiki.mozilla.org/CA".format(
type=type),
'list': hashes,
'type': 'string',
'matching_attributes': ["md5", "sha1", "sha256", "filename|md5", "filename|sha1",
"filename|sha256", "x509-fingerprint-md5", "x509-fingerprint-sha1", "x509-fingerprint-sha256"]
}
write_to_file(warninglist, dst)
if __name__ == '__main__':
download(Included_CA_url, Included_CA_file)
Included_CA_url = 'https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReportPEMCSV'
Included_CA_file = 'IncludedCACertificateReportPEMCSV.csv'
Included_CA_dst = 'mozilla-CA'
CA_known_intermediate_url = 'https://ccadb-public.secure.force.com/mozilla/PublicAllIntermediateCertsWithPEMCSV'
CA_known_intermediate_file = 'PublicAllIntermediateCertsWithPEMCSV.csv'
CA_known_intermediate_dst = 'mozilla-IntermediateCA'
download_to_file(Included_CA_url, Included_CA_file)
process(Included_CA_file, Included_CA_dst, 'trusted CA certificates')
download(CA_known_intermediate_url, CA_known_intermediate_file)
process(CA_known_intermediate_file, CA_known_intermediate_dst, 'known intermedicate of trusted certificates')
download_to_file(CA_known_intermediate_url, CA_known_intermediate_file)
process(CA_known_intermediate_file, CA_known_intermediate_dst,
'known intermedicate of trusted certificates')

86
tools/generate_tranco.py
View File

@ -1,39 +1,63 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import zipfile
import datetime
import json
tranco_url = 'https://tranco-list.eu/top-1m.csv.zip'
tranco_file = 'top-1m.csv.zip'
user_agent = {'User-agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0'}
r = requests.get(tranco_url, headers=user_agent)
with open(tranco_file, 'wb') as fd:
for chunk in r.iter_content(4096):
fd.write(chunk)
with zipfile.ZipFile(tranco_file, 'r') as tranco_lists:
for name in tranco_lists.namelist():
if name == 'top-1m.csv':
with tranco_lists.open(name) as tranco:
sites = tranco.readlines()
else:
continue
from generator import download_to_file, get_version, write_to_file
tranco_warninglist = {}
version = int(datetime.date.today().strftime('%Y%m%d'))
tranco_warninglist['description'] = "Event contains one or more entries from the top 1,000,000 most-used sites (Tranco)."
d = datetime.datetime.now()
tranco_warninglist['version'] = version
tranco_warninglist['name'] = "Top 1,000,000 most-used sites from Tranco"
tranco_warninglist['type'] = 'hostname'
tranco_warninglist['list'] = []
tranco_warninglist['matching_attributes'] = ['hostname', 'domain', 'url', 'domain|ip']
def process(file):
top10k, all_sites = get_lists(file)
for site in sites:
v = site.decode('UTF-8').split(',')[1]
tranco_warninglist['list'].append(v.rstrip())
tranco_warninglist['list'] = sorted(set(tranco_warninglist['list']))
print(json.dumps(tranco_warninglist))
# Top 1M
tranco_dst = "tranco"
tranco_warninglist = {
'description': "Event contains one or more entries from the top 1,000,000 most-used sites (https://tranco-list.eu/).",
'name': "Top 1,000,000 most-used sites from Tranco"
}
generate(all_sites, tranco_warninglist, tranco_dst)
# Top 10K
tranco_10k_dst = "tranco10k"
tranco_10k_warninglist = {
'description': "Event contains one or more entries from the top 10K most-used sites (https://tranco-list.eu/).",
'name': "Top 10K most-used sites from Tranco"
}
generate(top10k, tranco_10k_warninglist, tranco_10k_dst)
def generate(sites, warninglist, dst):
warninglist['type'] = 'hostname'
warninglist['version'] = get_version()
warninglist['matching_attributes'] = [
'hostname', 'domain', 'url', 'domain|ip']
warninglist['list'] = []
for site in sites:
v = site.decode('UTF-8').split(',')[1]
warninglist['list'].append(v.rstrip())
write_to_file(warninglist, dst)
def get_lists(file):
with zipfile.ZipFile(file, 'r') as tranco_lists:
for name in tranco_lists.namelist():
if name == 'top-1m.csv':
with tranco_lists.open(name) as tranco:
all_sites = tranco.readlines()
top10k = all_sites[:10000]
else:
continue
return top10k, all_sites
if __name__ == '__main__':
tranco_url = 'https://tranco-list.eu/top-1m.csv.zip'
tranco_file = 'tranco_top-1m.csv.zip'
download_to_file(tranco_url, tranco_file)
process(tranco_file)

39
tools/generate_tranco10k.py
View File

@ -1,39 +0,0 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import zipfile
import datetime
import json
tranco_url = 'https://tranco-list.eu/top-1m.csv.zip'
tranco_file = 'top-1m.csv.zip'
user_agent = {'User-agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0'}
r = requests.get(tranco_url, headers=user_agent)
with open(tranco_file, 'wb') as fd:
for chunk in r.iter_content(4096):
fd.write(chunk)
with zipfile.ZipFile(tranco_file, 'r') as tranco_lists:
for name in tranco_lists.namelist():
if name == 'top-1m.csv':
with tranco_lists.open(name) as tranco:
sites = tranco.readlines()[:10000]
else:
continue
tranco_warninglist = {}
version = int(datetime.date.today().strftime('%Y%m%d'))
tranco_warninglist['description'] = "Event contains one or more entries from the top 10K most-used sites (Tranco)."
d = datetime.datetime.now()
tranco_warninglist['version'] = version
tranco_warninglist['name'] = "Top 10K most-used sites from Tranco"
tranco_warninglist['type'] = 'hostname'
tranco_warninglist['list'] = []
tranco_warninglist['matching_attributes'] = ['hostname', 'domain', 'url', 'domain|ip']
for site in sites:
v = site.decode('UTF-8').split(',')[1]
tranco_warninglist['list'].append(v.rstrip())
tranco_warninglist['list'] = sorted(set(tranco_warninglist['list']))
print(json.dumps(tranco_warninglist))

76
tools/generator.py Normal file
View File

@ -0,0 +1,76 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import datetime
import json
from inspect import currentframe, getframeinfo
from os import path
import logging
import requests
from dateutil.parser import parse as parsedate
def download_to_file(url, file):
user_agent = {"User-agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0"}
try:
r = requests.head(url, headers=user_agent)
url_datetime = parsedate(r.headers['Last-Modified']).astimezone()
file_datetime = datetime.datetime.fromtimestamp(
path.getmtime(file)).astimezone()
if(url_datetime > file_datetime):
actual_download_to_file(url, file, user_agent)
except KeyError as ex:
logging.warning(str(ex))
actual_download_to_file(url, file, user_agent)
def actual_download_to_file(url, file, user_agent):
r = requests.get(url, headers=user_agent)
with open(file, 'wb') as fd:
for chunk in r.iter_content(4096):
fd.write(chunk)
def process_stream(url):
r = requests.get(url, stream=True)
data_list = []
for line in r.iter_lines():
v = line.decode('utf-8')
if not v.startswith("#"):
if v:
data_list.append(v)
return data_list
def download(url):
user_agent = {
"User-agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0"}
return requests.get(url, headers=user_agent)
def get_abspath_list_file(dst):
rel_path = getframeinfo(currentframe()).filename
current_folder = path.dirname(path.abspath(rel_path))
real_path = path.join(
current_folder, '../lists/{dst}/list.json'.format(dst=dst))
return path.abspath(path.realpath(real_path))
def get_version():
return int(datetime.date.today().strftime('%Y%m%d'))
def unique_sorted_warninglist(warninglist):
warninglist['list'] = sorted(set(warninglist['list']))
return warninglist
def write_to_file(warninglist, dst):
with open(get_abspath_list_file(dst), 'w') as data_file:
json.dump(unique_sorted_warninglist(warninglist),
data_file, indent=2, sort_keys=True)
data_file.write("\n")