Merge branch 'master' of github.com:MISP/misp-warninglists

README.md

@@ -23,6 +23,8 @@ are available in one of the list. The list can be globally enabled or disabled i
 - [lists/rfc5735](lists/rfc5735) - RFC 5735 CIDR blocks - Special Use IPv4 Addresses
 - [lists/second-level-tlds](lists/second-level-tlds) - Mozilla list of second level top-level domains
 - [lists/tlds](lists/tlds) - top-level domains
+- [lists/whats-my-ip](lists/whats-my-ip) - "What's my IP" service
+- [lists/url-shortener](lists/url-shortener) - URL shorteners services
 
 # Format of a warning list
 

lists/url-shortener/list.json

@@ -0,0 +1,73 @@
+{
+  "name": "List of known URL Shorteners domains",
+  "version": 2,
+  "description": "Event contains one or more entries of known Shorteners domains",
+  "matching_attributes": [ "domain", "hostname", "domain|ip", "url", "uri" ],
+  "list": [
+        "1url.com",
+        "adcraft.co",
+        "adcrun.ch",
+        "adflav.com",
+        "adf.ly",
+        "aka.gr",
+        "bc.vc",
+        "bee4.biz",
+        "bit.do",
+        "bit.ly",
+        "bitly.com",
+        "buff.ly",
+        "buzurl.com",
+        "cektkp.com",
+        "cur.lv",
+        "cutt.us",
+        "db.tt",
+        "dft.ba",
+        "filoops.info",
+        "fun.ly",
+        "fzy.co",
+        "gog.li",
+        "golinks.co",
+        "goo.gl",
+        "hit.my",
+        "id.tl",
+        "is.gd",
+        "ity.im",
+        "j.mp",
+        "linkto.im",
+        "link.zip.net",
+        "lnk.co",
+        "lnkd.in",
+        "mcaf.ee",
+        "nov.io",
+        "ow.ly",
+        "p6l.org",
+        "picz.us",
+        "po.st",
+        "prettylinkpro.com",
+        "q.gs",
+        "qr.ae",
+        "qr.net",
+        "scrnch.me",
+        "shortquik.com",
+        "sk.gy",
+        "su.pr",
+        "t.co",
+        "tinyarrows.com",
+        "tinyurl.com",
+        "tota2.com",
+        "tr.im",
+        "tweez.me",
+        "twitthis.com",
+        "u.bb",
+        "u.to",
+        "v.gd",
+        "vzturl.com",
+        "x.co",
+        "xlinkz.info",
+        "xtu.me",
+        "yourls.org",
+        "yu2.it",
+        "zpag.es"
+  ]
+}
+

lists/whats-my-ip/list.json

@@ -0,0 +1,40 @@
+{
+  "name": "List of known domains to know external IP",
+  "version": 2,
+  "description": "Event contains one or more entries of known 'what's is my ip' domains",
+  "matching_attributes": [ "domain", "hostname", "domain|ip", "uri", "url" ],
+  "list": [
+        "api.ipify.org",
+        "checkip.dyndns.com",
+        "icanhazip.com",
+        "ifcfg.me",
+        "ifconfig.co",
+        "ip4.me",
+        "ip-adress.eu",
+        "ip.anysrc.net",
+        "ipchicken.com",
+        "ipecho.net",
+        "ipinfo.info",
+        "ip-secrets.com",
+        "myexternalip.com",
+        "myipaddress.com",
+        "my-ip-address.net",
+        "myipnumber.com",
+        "vermiip.es",
+        "whatismybrowser.com",
+        "whatismyipaddress.com",
+        "whatismyip.com",
+        "whatismyip.com.br",
+        "whatismyip.li",
+        "whatismyip.net",
+        "whatismyip.org",
+        "whatismypublicip.com",
+        "whatsmyip.ie",
+        "whatsmyip.net",
+        "whatsmyip.org",
+        "wtfismyip.com",
+        "ip-score.com",
+        "xmyip.com"
+  ]
+}
+