MISP
/
misp-warninglists
mirror of https://github.com/MISP/misp-warninglists
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #1 from MISP/master 

Pull update
pull/22/head
devnull- 2017-02-16 21:55:05 +01:00 committed by GitHub
parent 04f4797f64 e04a0c3bdd
commit 4d186724d1
20 changed files with 75870 additions and 105415 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
.travis.yml
View File

@ -1,12 +1,16 @@
language: bash language: python
cache: pip
python:
- "3.6"
sudo: required sudo: required
dist: trusty
install: install:
- sudo apt-get update -qq - sudo apt-get update -qq
- sudo apt-get install -y -qq jq - sudo apt-get install -y -qq jq moreutils
- pip install jsonschema
script: script:
- cat */*/*.json | jq . >/dev/null - ./validate_all.sh

10
README.md
View File

@ -10,6 +10,7 @@ are available in one of the list. The list can be globally enabled or disabled i
# lists # lists
- [lists/alexa](lists/alexa) - Top 1000 websites from Alexa - [lists/alexa](lists/alexa) - Top 1000 websites from Alexa
- [lists/eicar.com](lists/eicar.com) - hashes for EICAR test virus
- [lists/empty-hashes](lists/empty-hashes) - hash values of empty files - [lists/empty-hashes](lists/empty-hashes) - hash values of empty files
- [lists/google](lists/google) - known domains and hostnames from Google - [lists/google](lists/google) - known domains and hostnames from Google
- [lists/ipv6-linklocal](ipv6-linklocal) - IPv6 link local prefix - [lists/ipv6-linklocal](ipv6-linklocal) - IPv6 link local prefix
@ -21,8 +22,11 @@ are available in one of the list. The list can be globally enabled or disabled i
- [lists/rfc1918](lists/rfc1918) - RFC 1918 network subnets - [lists/rfc1918](lists/rfc1918) - RFC 1918 network subnets
- [lists/rfc3849](lists/rfc3849) - RFC 3849 - Documentation prefix for ipv6 - [lists/rfc3849](lists/rfc3849) - RFC 3849 - Documentation prefix for ipv6
- [lists/rfc5735](lists/rfc5735) - RFC 5735 CIDR blocks - Special Use IPv4 Addresses - [lists/rfc5735](lists/rfc5735) - RFC 5735 CIDR blocks - Special Use IPv4 Addresses
- [lists/rfc6598](lists/rfc6598) - RFC 6598 IANA-Reserved IPv4 Prefix for Shared Address Space (Carrier- Grade NAT (CGN) devices)
- [lists/second-level-tlds](lists/second-level-tlds) - Mozilla list of second level top-level domains - [lists/second-level-tlds](lists/second-level-tlds) - Mozilla list of second level top-level domains
- [lists/tlds](lists/tlds) - top-level domains - [lists/tlds](lists/tlds) - top-level domains
- [lists/whats-my-ip](lists/whats-my-ip) - "What's my IP" service
- [lists/url-shortener](lists/url-shortener) - URL shorteners services
# Format of a warning list # Format of a warning list
@ -48,6 +52,12 @@ are available in one of the list. The list can be globally enabled or disabled i
If matching_attributes are not set, the list is matched against any type of attributes. If matching_attributes are not set, the list is matched against any type of attributes.
## type of warning list
- ```string``` (default) - perfect match of a string in the warning list against matching attributes
- ```substring``` - substring matching of a string in the warning list against matching attributes
- ```hostname``` - hostname matching (e.g. domain matching from URL) of a string in the warning list against matching attributes
# License # License
MISP warning-lists are licensed under [CC0 1.0 Universal (CC0 1.0)](https://creativecommons.org/publicdomain/zero/1.0/) - Public Domain Dedication. If a specific author of a taxonomy wants to license it under a different license, a pull request can be requested. MISP warning-lists are licensed under [CC0 1.0 Universal (CC0 1.0)](https://creativecommons.org/publicdomain/zero/1.0/) - Public Domain Dedication. If a specific author of a taxonomy wants to license it under a different license, a pull request can be requested.

13
jq_all_the_things.sh Executable file
View File

@ -0,0 +1,13 @@
#!/bin/bash
set -e
set -x
# Seeds sponge, from moreutils
for dir in lists/*/list.json
do
cat ${dir} | jq . | sponge ${dir}
done
cat schema.json | jq . | sponge schema.json

1978
lists/alexa/list.json
View File

File diff suppressed because it is too large Load Diff

23
lists/eicar.com/list.json Normal file
View File

@ -0,0 +1,23 @@
{
"name": "List of hashes for EICAR test virus",
"version": 1,
"description": "Event contains one or more entries based on hashes for EICAR test virus",
"matching_attributes": [],
"list": [
"44d88612fea8a8f36de82e1278abb02f",
"6ce6f415d8475545be5ba114f208b0ff",
"e4968ef99266df7c9a1f0637d2389dab",
"3395856ce81f2b7382dee72602f798b642f14140",
"d27265074c9eac2e2122ed69294dbc4d7cce9141",
"bec1b52d350d721c7e22a6d4bb0a92909893a3ae",
"b42ec8b47deb2dc75edebd01132d63f8e8d4cd08e5d26d8bd366bdc5",
"b31bb2cf25d7e654c694ffb85b426d164a210ead66affc3b004702be",
"765dceb9a8c8ff4318e3ccaf7dbb9b05c0a53a819d24a50714aebe6c",
"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",
"2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad",
"e1105070ba828007508566e28a2b8d4c65d192e9eaf3b7868382b7cae747b397",
"cc805d5fab1fd71a4ab352a9c533e65fb2d5b885518f4e565e68847223b8e6b85cb48f3afad842726d99239c9e36505c64b0dc9a061d9e507d833277ada336ab",
"d9305862fe0bf552718d19db43075d88cffd768974627db60fa1a90a8d45563e035a6449663b8f66aac53791d77f37dbb5035159aa08e69fc473972022f80010",
"73d6b0ca9c5554fd2b37ff8af6b51812f3af49962cebd6e042d0883a45794ddb8a53724275d26f3e18cebf1cd1d67740acc920aba16965038c0cc75b87030fbe"
]
}

3
lists/empty-hashes/list.json
View File

@ -2,7 +2,7 @@
"name": "List of known hashes for empty files", "name": "List of known hashes for empty files",
"version": 1, "version": 1,
"description": "Event contains one or more entries of empty files based on known hashed", "description": "Event contains one or more entries of empty files based on known hashed",
"matching_attributes": [ ], "matching_attributes": [],
"list": [ "list": [
"d41d8cd98f00b204e9800998ecf8427e", "d41d8cd98f00b204e9800998ecf8427e",
"da39a3ee5e6b4b0d3255bfef95601890afd80709", "da39a3ee5e6b4b0d3255bfef95601890afd80709",
@ -11,4 +11,3 @@
"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e" "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e"
] ]
} }

779
lists/google/list.json
View File

@ -2,394 +2,397 @@
"name": "List of known google domains", "name": "List of known google domains",
"version": 2, "version": 2,
"description": "Event contains one or more entries of known google domains", "description": "Event contains one or more entries of known google domains",
"matching_attributes": [ "domain", "hostname", "domain|ip" ], "matching_attributes": [
"domain",
"hostname",
"domain|ip"
],
"list": [ "list": [
".google.com", ".google.com",
".google.ad", ".google.ad",
".google.ae", ".google.ae",
".google.com.af", ".google.com.af",
".google.com.ag", ".google.com.ag",
".google.com.ai", ".google.com.ai",
".google.al", ".google.al",
".google.am", ".google.am",
".google.co.ao", ".google.co.ao",
".google.com.ar", ".google.com.ar",
".google.as", ".google.as",
".google.at", ".google.at",
".google.com.au", ".google.com.au",
".google.az", ".google.az",
".google.ba", ".google.ba",
".google.com.bd", ".google.com.bd",
".google.be", ".google.be",
".google.bf", ".google.bf",
".google.bg", ".google.bg",
".google.com.bh", ".google.com.bh",
".google.bi", ".google.bi",
".google.bj", ".google.bj",
".google.com.bn", ".google.com.bn",
".google.com.bo", ".google.com.bo",
".google.com.br", ".google.com.br",
".google.bs", ".google.bs",
".google.bt", ".google.bt",
".google.co.bw", ".google.co.bw",
".google.by", ".google.by",
".google.com.bz", ".google.com.bz",
".google.ca", ".google.ca",
".google.cd", ".google.cd",
".google.cf", ".google.cf",
".google.cg", ".google.cg",
".google.ch", ".google.ch",
".google.ci", ".google.ci",
".google.co.ck", ".google.co.ck",
".google.cl", ".google.cl",
".google.cm", ".google.cm",
".google.cn", ".google.cn",
".google.com.co", ".google.com.co",
".google.co.cr", ".google.co.cr",
".google.com.cu", ".google.com.cu",
".google.cv", ".google.cv",
".google.com.cy", ".google.com.cy",
".google.cz", ".google.cz",
".google.de", ".google.de",
".google.dj", ".google.dj",
".google.dk", ".google.dk",
".google.dm", ".google.dm",
".google.com.do", ".google.com.do",
".google.dz", ".google.dz",
".google.com.ec", ".google.com.ec",
".google.ee", ".google.ee",
".google.com.eg", ".google.com.eg",
".google.es", ".google.es",
".google.com.et", ".google.com.et",
".google.fi", ".google.fi",
".google.com.fj", ".google.com.fj",
".google.fm", ".google.fm",
".google.fr", ".google.fr",
".google.ga", ".google.ga",
".google.ge", ".google.ge",
".google.gg", ".google.gg",
".google.com.gh", ".google.com.gh",
".google.com.gi", ".google.com.gi",
".google.gl", ".google.gl",
".google.gm", ".google.gm",
".google.gp", ".google.gp",
".google.gr", ".google.gr",
".google.com.gt", ".google.com.gt",
".google.gy", ".google.gy",
".google.com.hk", ".google.com.hk",
".google.hn", ".google.hn",
".google.hr", ".google.hr",
".google.ht", ".google.ht",
".google.hu", ".google.hu",
".google.co.id", ".google.co.id",
".google.ie", ".google.ie",
".google.co.il", ".google.co.il",
".google.im", ".google.im",
".google.co.in", ".google.co.in",
".google.iq", ".google.iq",
".google.is", ".google.is",
".google.it", ".google.it",
".google.je", ".google.je",
".google.com.jm", ".google.com.jm",
".google.jo", ".google.jo",
".google.co.jp", ".google.co.jp",
".google.co.ke", ".google.co.ke",
".google.com.kh", ".google.com.kh",
".google.ki", ".google.ki",
".google.kg", ".google.kg",
".google.co.kr", ".google.co.kr",
".google.com.kw", ".google.com.kw",
".google.kz", ".google.kz",
".google.la", ".google.la",
".google.com.lb", ".google.com.lb",
".google.li", ".google.li",
".google.lk", ".google.lk",
".google.co.ls", ".google.co.ls",
".google.lt", ".google.lt",
".google.lu", ".google.lu",
".google.lv", ".google.lv",
".google.com.ly", ".google.com.ly",
".google.co.ma", ".google.co.ma",
".google.md", ".google.md",
".google.me", ".google.me",
".google.mg", ".google.mg",
".google.mk", ".google.mk",
".google.ml", ".google.ml",
".google.com.mm", ".google.com.mm",
".google.mn", ".google.mn",
".google.ms", ".google.ms",
".google.com.mt", ".google.com.mt",
".google.mu", ".google.mu",
".google.mv", ".google.mv",
".google.mw", ".google.mw",
".google.com.mx", ".google.com.mx",
".google.com.my", ".google.com.my",
".google.co.mz", ".google.co.mz",
".google.com.na", ".google.com.na",
".google.com.nf", ".google.com.nf",
".google.com.ng", ".google.com.ng",
".google.com.ni", ".google.com.ni",
".google.ne", ".google.ne",
".google.nl", ".google.nl",
".google.no", ".google.no",
".google.com.np", ".google.com.np",
".google.nr", ".google.nr",
".google.nu", ".google.nu",
".google.co.nz", ".google.co.nz",
".google.com.om", ".google.com.om",
".google.com.pa", ".google.com.pa",
".google.com.pe", ".google.com.pe",
".google.com.pg", ".google.com.pg",
".google.com.ph", ".google.com.ph",
".google.com.pk", ".google.com.pk",
".google.pl", ".google.pl",
".google.pn", ".google.pn",
".google.com.pr", ".google.com.pr",
".google.ps", ".google.ps",
".google.pt", ".google.pt",
".google.com.py", ".google.com.py",
".google.com.qa", ".google.com.qa",
".google.ro", ".google.ro",
".google.ru", ".google.ru",
".google.rw", ".google.rw",
".google.com.sa", ".google.com.sa",
".google.com.sb", ".google.com.sb",
".google.sc", ".google.sc",
".google.se", ".google.se",
".google.com.sg", ".google.com.sg",
".google.sh", ".google.sh",
".google.si", ".google.si",
".google.sk", ".google.sk",
".google.com.sl", ".google.com.sl",
".google.sn", ".google.sn",
".google.so", ".google.so",
".google.sm", ".google.sm",
".google.sr", ".google.sr",
".google.st", ".google.st",
".google.com.sv", ".google.com.sv",
".google.td", ".google.td",
".google.tg", ".google.tg",
".google.co.th", ".google.co.th",
".google.com.tj", ".google.com.tj",
".google.tk", ".google.tk",
".google.tl", ".google.tl",
".google.tm", ".google.tm",
".google.tn", ".google.tn",
".google.to", ".google.to",
".google.com.tr", ".google.com.tr",
".google.tt", ".google.tt",
".google.com.tw", ".google.com.tw",
".google.co.tz", ".google.co.tz",
".google.com.ua", ".google.com.ua",
".google.co.ug", ".google.co.ug",
".google.co.uk", ".google.co.uk",
".google.com.uy", ".google.com.uy",
".google.co.uz", ".google.co.uz",
".google.com.vc", ".google.com.vc",
".google.co.ve", ".google.co.ve",
".google.vg", ".google.vg",
".google.co.vi", ".google.co.vi",
".google.com.vn", ".google.com.vn",
".google.vu", ".google.vu",
".google.ws", ".google.ws",
".google.rs", ".google.rs",
".google.co.za", ".google.co.za",
".google.co.zm", ".google.co.zm",
".google.co.zw", ".google.co.zw",
".google.cat", ".google.cat",
"www.google.com", "www.google.com",
"www.google.ad", "www.google.ad",
"www.google.ae", "www.google.ae",
"www.google.com.af", "www.google.com.af",
"www.google.com.ag", "www.google.com.ag",
"www.google.com.ai", "www.google.com.ai",
"www.google.al", "www.google.al",
"www.google.am", "www.google.am",
"www.google.co.ao", "www.google.co.ao",
"www.google.com.ar", "www.google.com.ar",
"www.google.as", "www.google.as",
"www.google.at", "www.google.at",
"www.google.com.au", "www.google.com.au",
"www.google.az", "www.google.az",
"www.google.ba", "www.google.ba",
"www.google.com.bd", "www.google.com.bd",
"www.google.be", "www.google.be",
"www.google.bf", "www.google.bf",
"www.google.bg", "www.google.bg",
"www.google.com.bh", "www.google.com.bh",
"www.google.bi", "www.google.bi",
"www.google.bj", "www.google.bj",
"www.google.com.bn", "www.google.com.bn",
"www.google.com.bo", "www.google.com.bo",
"www.google.com.br", "www.google.com.br",
"www.google.bs", "www.google.bs",
"www.google.bt", "www.google.bt",
"www.google.co.bw", "www.google.co.bw",
"www.google.by", "www.google.by",
"www.google.com.bz", "www.google.com.bz",
"www.google.ca", "www.google.ca",
"www.google.cd", "www.google.cd",
"www.google.cf", "www.google.cf",
"www.google.cg", "www.google.cg",
"www.google.ch", "www.google.ch",
"www.google.ci", "www.google.ci",
"www.google.co.ck", "www.google.co.ck",
"www.google.cl", "www.google.cl",
"www.google.cm", "www.google.cm",
"www.google.cn", "www.google.cn",
"www.google.com.co", "www.google.com.co",
"www.google.co.cr", "www.google.co.cr",
"www.google.com.cu", "www.google.com.cu",
"www.google.cv", "www.google.cv",
"www.google.com.cy", "www.google.com.cy",
"www.google.cz", "www.google.cz",
"www.google.de", "www.google.de",
"www.google.dj", "www.google.dj",
"www.google.dk", "www.google.dk",
"www.google.dm", "www.google.dm",
"www.google.com.do", "www.google.com.do",
"www.google.dz", "www.google.dz",
"www.google.com.ec", "www.google.com.ec",
"www.google.ee", "www.google.ee",
"www.google.com.eg", "www.google.com.eg",
"www.google.es", "www.google.es",
"www.google.com.et", "www.google.com.et",
"www.google.fi", "www.google.fi",
"www.google.com.fj", "www.google.com.fj",
"www.google.fm", "www.google.fm",
"www.google.fr", "www.google.fr",
"www.google.ga", "www.google.ga",
"www.google.ge", "www.google.ge",
"www.google.gg", "www.google.gg",
"www.google.com.gh", "www.google.com.gh",
"www.google.com.gi", "www.google.com.gi",
"www.google.gl", "www.google.gl",
"www.google.gm", "www.google.gm",
"www.google.gp", "www.google.gp",
"www.google.gr", "www.google.gr",
"www.google.com.gt", "www.google.com.gt",
"www.google.gy", "www.google.gy",
"www.google.com.hk", "www.google.com.hk",
"www.google.hn", "www.google.hn",
"www.google.hr", "www.google.hr",
"www.google.ht", "www.google.ht",
"www.google.hu", "www.google.hu",
"www.google.co.id", "www.google.co.id",
"www.google.ie", "www.google.ie",
"www.google.co.il", "www.google.co.il",
"www.google.im", "www.google.im",
"www.google.co.in", "www.google.co.in",
"www.google.iq", "www.google.iq",
"www.google.is", "www.google.is",
"www.google.it", "www.google.it",
"www.google.je", "www.google.je",
"www.google.com.jm", "www.google.com.jm",
"www.google.jo", "www.google.jo",
"www.google.co.jp", "www.google.co.jp",
"www.google.co.ke", "www.google.co.ke",
"www.google.com.kh", "www.google.com.kh",
"www.google.ki", "www.google.ki",
"www.google.kg", "www.google.kg",
"www.google.co.kr", "www.google.co.kr",
"www.google.com.kw", "www.google.com.kw",
"www.google.kz", "www.google.kz",
"www.google.la", "www.google.la",
"www.google.com.lb", "www.google.com.lb",
"www.google.li", "www.google.li",
"www.google.lk", "www.google.lk",
"www.google.co.ls", "www.google.co.ls",
"www.google.lt", "www.google.lt",
"www.google.lu", "www.google.lu",
"www.google.lv", "www.google.lv",
"www.google.com.ly", "www.google.com.ly",
"www.google.co.ma", "www.google.co.ma",
"www.google.md", "www.google.md",
"www.google.me", "www.google.me",
"www.google.mg", "www.google.mg",
"www.google.mk", "www.google.mk",
"www.google.ml", "www.google.ml",
"www.google.com.mm", "www.google.com.mm",
"www.google.mn", "www.google.mn",
"www.google.ms", "www.google.ms",
"www.google.com.mt", "www.google.com.mt",
"www.google.mu", "www.google.mu",
"www.google.mv", "www.google.mv",
"www.google.mw", "www.google.mw",
"www.google.com.mx", "www.google.com.mx",
"www.google.com.my", "www.google.com.my",
"www.google.co.mz", "www.google.co.mz",
"www.google.com.na", "www.google.com.na",
"www.google.com.nf", "www.google.com.nf",
"www.google.com.ng", "www.google.com.ng",
"www.google.com.ni", "www.google.com.ni",
"www.google.ne", "www.google.ne",
"www.google.nl", "www.google.nl",
"www.google.no", "www.google.no",
"www.google.com.np", "www.google.com.np",
"www.google.nr", "www.google.nr",
"www.google.nu", "www.google.nu",
"www.google.co.nz", "www.google.co.nz",
"www.google.com.om", "www.google.com.om",
"www.google.com.pa", "www.google.com.pa",
"www.google.com.pe", "www.google.com.pe",
"www.google.com.pg", "www.google.com.pg",
"www.google.com.ph", "www.google.com.ph",
"www.google.com.pk", "www.google.com.pk",
"www.google.pl", "www.google.pl",
"www.google.pn", "www.google.pn",
"www.google.com.pr", "www.google.com.pr",
"www.google.ps", "www.google.ps",
"www.google.pt", "www.google.pt",
"www.google.com.py", "www.google.com.py",
"www.google.com.qa", "www.google.com.qa",
"www.google.ro", "www.google.ro",
"www.google.ru", "www.google.ru",
"www.google.rw", "www.google.rw",
"www.google.com.sa", "www.google.com.sa",
"www.google.com.sb", "www.google.com.sb",
"www.google.sc", "www.google.sc",
"www.google.se", "www.google.se",
"www.google.com.sg", "www.google.com.sg",
"www.google.sh", "www.google.sh",
"www.google.si", "www.google.si",
"www.google.sk", "www.google.sk",
"www.google.com.sl", "www.google.com.sl",
"www.google.sn", "www.google.sn",
"www.google.so", "www.google.so",
"www.google.sm", "www.google.sm",
"www.google.sr", "www.google.sr",
"www.google.st", "www.google.st",
"www.google.com.sv", "www.google.com.sv",
"www.google.td", "www.google.td",
"www.google.tg", "www.google.tg",
"www.google.co.th", "www.google.co.th",
"www.google.com.tj", "www.google.com.tj",
"www.google.tk", "www.google.tk",
"www.google.tl", "www.google.tl",
"www.google.tm", "www.google.tm",
"www.google.tn", "www.google.tn",
"www.google.to", "www.google.to",
"www.google.com.tr", "www.google.com.tr",
"www.google.tt", "www.google.tt",
"www.google.com.tw", "www.google.com.tw",
"www.google.co.tz", "www.google.co.tz",
"www.google.com.ua", "www.google.com.ua",
"www.google.co.ug", "www.google.co.ug",
"www.google.co.uk", "www.google.co.uk",
"www.google.com.uy", "www.google.com.uy",
"www.google.co.uz", "www.google.co.uz",
"www.google.com.vc", "www.google.com.vc",
"www.google.co.ve", "www.google.co.ve",
"www.google.vg", "www.google.vg",
"www.google.co.vi", "www.google.co.vi",
"www.google.com.vn", "www.google.com.vn",
"www.google.vu", "www.google.vu",
"www.google.ws", "www.google.ws",
"www.google.rs", "www.google.rs",
"www.google.co.za", "www.google.co.za",
"www.google.co.zm", "www.google.co.zm",
"www.google.co.zw", "www.google.co.zw",
"www.google.cat" "www.google.cat"
] ]
} }

2413
lists/microsoft-office365/list.json
View File

File diff suppressed because it is too large Load Diff

313
lists/microsoft/list.json
View File

@ -2,160 +2,163 @@
"name": "List of known microsoft domains", "name": "List of known microsoft domains",
"version": 1, "version": 1,
"description": "Event contains one or more entries of known microsoft domains", "description": "Event contains one or more entries of known microsoft domains",
"matching_attributes": [ "domain", "hostname", "domain|ip" ], "matching_attributes": [
"domain",
"hostname",
"domain|ip"
],
"list": [ "list": [
".files-df.1drv.com", ".files-df.1drv.com",
".files.1drv.com", ".files.1drv.com",
".aadrm.com", ".aadrm.com",
".afx.ms", ".afx.ms",
".akadns.net", ".akadns.net",
".aspnetcdn.com", ".aspnetcdn.com",
".azure-int.net", ".azure-int.net",
".azure-mobile.net", ".azure-mobile.net",
".azure.com", ".azure.com",
".cloudapp.azure.com", ".cloudapp.azure.com",
"azure.com", "azure.com",
".azure.net", ".azure.net",
".cloudapp.azure.net", ".cloudapp.azure.net",
".azureedge.net", ".azureedge.net",
".azurewebsites.net", ".azurewebsites.net",
".bing-exp.com", ".bing-exp.com",
".bing-int.com", ".bing-int.com",
".bing.com", ".bing.com",
"bing.com", "bing.com",
"download.cortana.cn.bing.com", "download.cortana.cn.bing.com",
".bing.net", ".bing.net",
".ceipmsn.com", ".ceipmsn.com",
".cloudapp.net", ".cloudapp.net",
".codeplex.com", ".codeplex.com",
".discoverbing.com", ".discoverbing.com",
".getmicrosoftkey.com", ".getmicrosoftkey.com",
".gfx-int.ms", ".gfx-int.ms",
"gfx-int.ms", "gfx-int.ms",
".gfx.ms", ".gfx.ms",
".healthvault-ppe.co.uk", ".healthvault-ppe.co.uk",
".healthvault-ppe.com", ".healthvault-ppe.com",
"healthvault-ppe.com", "healthvault-ppe.com",
".healthvault.co.uk", ".healthvault.co.uk",
".healthvault.com", ".healthvault.com",
".hotmail-int.com", ".hotmail-int.com",
"hotmail.co.uk", "hotmail.co.uk",
".hotmail.com", ".hotmail.com",
"hotmail.com", "hotmail.com",
"iespdytst", "iespdytst",
"ieta-wa-24", "ieta-wa-24",
".live-int.com", ".live-int.com",
".live-int.net", ".live-int.net",
".live-partner.com", ".live-partner.com",
".live-ppe.net", ".live-ppe.net",
".live.com", ".live.com",
".live.fi", ".live.fi",
"live.fi", "live.fi",
".live.net", ".live.net",
".livefilestore-int.com", ".livefilestore-int.com",
".livefilestore.com", ".livefilestore.com",
".livemeeting.com", ".livemeeting.com",
".lync.com", ".lync.com",
".mesh.com", ".mesh.com",
".mgmt.live", ".mgmt.live",
".microsoft-int.com", ".microsoft-int.com",
".microsoft.com", ".microsoft.com",
".redmond.corp.microsoft.com", ".redmond.corp.microsoft.com",
"download.microsoft.com", "download.microsoft.com",
"iespdytst.redmond.corp.microsoft.com", "iespdytst.redmond.corp.microsoft.com",
"microsoft.com", "microsoft.com",
"powerusers-staging.microsoft.com", "powerusers-staging.microsoft.com",
"powerusers.microsoft.com", "powerusers.microsoft.com",
"telecommand.telemetry.microsoft.com", "telecommand.telemetry.microsoft.com",
"vortex-sandbox.data.microsoft.com", "vortex-sandbox.data.microsoft.com",
"watson.telemetry.microsoft.com", "watson.telemetry.microsoft.com",
".microsoft.com.au", ".microsoft.com.au",
".microsoft.com.tr", ".microsoft.com.tr",
".microsoft.fr", ".microsoft.fr",
".microsoftonline-int.com", ".microsoftonline-int.com",
".microsoftonline-p-int.com", ".microsoftonline-p-int.com",
".microsoftonline-p.com", ".microsoftonline-p.com",
".microsoftonline-p.net", ".microsoftonline-p.net",
".microsoftonline.com", ".microsoftonline.com",
".microsoftonline.net", ".microsoftonline.net",
".microsoftprime.com", ".microsoftprime.com",
".microsoftstore.com", ".microsoftstore.com",
"za.microsoftstore.com", "za.microsoftstore.com",
".microsoftstore.com.br", ".microsoftstore.com.br",
".microsoftstore.com.cn", ".microsoftstore.com.cn",
".microsoftstore.com.hk", ".microsoftstore.com.hk",
".microsofttranslator.com", ".microsofttranslator.com",
".microsoftvirtualacademy.com", ".microsoftvirtualacademy.com",
".modern.ie", ".modern.ie",
"modern.ie", "modern.ie",
".msads.net", ".msads.net",
".vo.msecnd.net", ".vo.msecnd.net",
".msgamestudios.com", ".msgamestudios.com",
".msn-int.com", ".msn-int.com",
".msn.cn", ".msn.cn",
".msn.co.jp", ".msn.co.jp",
".msn.com", ".msn.com",
".msn.com.cn", ".msn.com.cn",
".msocdn.com", ".msocdn.com",
".firstpartyapps.oaspapps.com", ".firstpartyapps.oaspapps.com",
".office-int.com", ".office-int.com",
"office-int.com", "office-int.com",
".office-int.net", ".office-int.net",
".office.com", ".office.com",
"office.com", "office.com",
".office.net", ".office.net",
".office365.com", ".office365.com",
".officeppe.com", ".officeppe.com",
".officeppe.net", ".officeppe.net",
".onedrive.com", ".onedrive.com",
"onedrive.com", "onedrive.com",
".onenote.com", ".onenote.com",
"onenote.com", "onenote.com",
".onenote.net", ".onenote.net",
"outlook-int.com", "outlook-int.com",
".outlook.com", ".outlook.com",
"003-1-d.outlook.com", "003-1-d.outlook.com",
"003-1-d.prod.outlook.com", "003-1-d.prod.outlook.com",
"outlook.com", "outlook.com",
"pod71084-pri.outlook.com", "pod71084-pri.outlook.com",
"pod71084.outlook.com", "pod71084.outlook.com",
".pfx.ms", ".pfx.ms",
".s-microsoft.com", ".s-microsoft.com",
".s-msft.com", ".s-msft.com",
".s-msn.com", ".s-msn.com",
".sfx-df.ms", ".sfx-df.ms",
".sfx-int.ms", ".sfx-int.ms",
".sfx.ms", ".sfx.ms",
".sharepoint.com", ".sharepoint.com",
".sharepointonline.com", ".sharepointonline.com",
".skype.com", ".skype.com",
"community-stage.skype.com", "community-stage.skype.com",
".skype.net", ".skype.net",
".skypeassets.com", ".skypeassets.com",
".sqlazurelabs.com", ".sqlazurelabs.com",
".surface.com", ".surface.com",
".syncxp.net", ".syncxp.net",
".trouter.io", ".trouter.io",
".virtualearth.net", ".virtualearth.net",
".visualstudio.com", ".visualstudio.com",
"visualstudio.com", "visualstudio.com",
".windows-int.net", ".windows-int.net",
".windows.com", ".windows.com",
"insidersurveys.windows.com", "insidersurveys.windows.com",
"www.insidersurveys.windows.com", "www.insidersurveys.windows.com",
".windows.net", ".windows.net",
".windowsazure.com", ".windowsazure.com",
".windowsmedia.com", ".windowsmedia.com",
".windowsphone-int.com", ".windowsphone-int.com",
".windowsphone-int.net", ".windowsphone-int.net",
".windowsphone.com", ".windowsphone.com",
".windowsphone.net", ".windowsphone.net",
".windowssearch.com", ".windowssearch.com",
".windowsstore.com", ".windowsstore.com",
".wlxrs.com", ".wlxrs.com",
".xbox.com", ".xbox.com",
".xboxlive.com", ".xboxlive.com",
".zune.net" ".zune.net"
] ]
} }

162092
lists/public-dns-v4/list.json
View File

File diff suppressed because it is too large Load Diff

465
lists/public-dns-v6/list.json
View File

@ -1,184 +1,283 @@
{ {
"description": "Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set", "description": "Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set",
"list": [ "list": [
"2001:1488:800:400::130", "2001:1488:800:400::130",
"2001:1608:10:167:342::eb52", "2001:14b8:100:350::2",
"2001:1620:2777:1::10", "2001:14b8:100:8350::1",
"2001:1620:2777:1::11", "2001:14b8:100:8350::8",
"2001:1620:2777::2", "2001:1608:10:167:342::eb52",
"2001:1a68::d911:2244", "2001:1608:10:195:3:dead:beef:cafe",
"2001:1bc0::ffff:aaaa:2", "2001:1608:10:25::1c04:b12f",
"2001:1bc0::ffff:bbbb:2", "2001:1608:10:25::9249:d69b",
"2001:2040:39::5", "2001:1620:2777:1::10",
"2001:418:3ff::1:53", "2001:1620:2777:1::11",
"2001:418:3ff::53", "2001:1620:2777::2",
"2001:41d0:8:be92::1", "2001:19f0:5001:133:5400:ff:fe30:d565",
"2001:428:101:100:205:171:2:65", "2001:19f0:5801:11:5400:ff:fe2d:7724",
"2001:428:101:100:205:171:3:65", "2001:19f0:7001:929:5400:ff:fe30:50af",
"2001:428::1", "2001:19f0:8001:5e:5400:ff:fe35:c3ae",
"2001:450:2005:1::4", "2001:1a68::d911:2244",
"2001:450:2005:2::4", "2001:1bc0::ffff:aaaa:2",
"2001:450:2005:2::5", "2001:1bc0::ffff:bbbb:2",
"2001:450:2005:3::5", "2001:2040:39::5",
"2001:468:c80:2101:0:100:0:22", "2001:418:3ff::1:53",
"2001:468:c80:2101:0:100:0:22", "2001:418:3ff::53",
"2001:468:c80:4101:0:100:0:42", "2001:41d0:52:cff::1325",
"2001:468:c80:4101:0:100:0:42", "2001:41d0:52:f00::413",
"2001:470:0:45::2", "2001:41d0:8:be92::1",
"2001:470:0:69::2", "2001:41d0:a:1011::1",
"2001:470:0:78::2", "2001:41d0:a:28::1",
"2001:470:0:7d::2", "2001:428:101:100:205:171:2:65",
"2001:470:0:8c::2", "2001:428:101:100:205:171:3:65",
"2001:470:0:c0::2", "2001:428::1",
"2001:470:20::2", "2001:450:2005:1::4",
"2001:470:520a::1", "2001:450:2005:2::4",
"2001:470:6c:521::2", "2001:450:2005:2::5",
"2001:470:6d:521::1", "2001:450:2005:3::5",
"2001:470:f032:1::254", "2001:468:c80:2101:0:100:0:22",
"2001:4860:4860::8844", "2001:468:c80:4101:0:100:0:42",
"2001:4860:4860::8888", "2001:470:0:45::2",
"2001:4870:6082:3::100", "2001:470:0:69::2",
"2001:4870:6082:3::5", "2001:470:0:6e::2",
"2001:4870:8000:3::100", "2001:470:0:78::2",
"2001:4870:8000:3::5", "2001:470:0:7d::2",
"2001:4ce8::53", "2001:470:0:8c::2",
"2001:4dd0:fb32:3::d", "2001:470:0:90::2",
"2001:4dd0:fd5e::53", "2001:470:0:9d::2",
"2001:4f8:0:2::14", "2001:470:0:c0::2",
"2001:550:1:1::d", "2001:470:1f14:fd8::2",
"2001:5b8:1::5", "2001:470:20::2",
"2001:610:1108:5010::130", "2001:470:26:1c8::1",
"2001:638:902:1::10", "2001:470:6d:80:224:1dff:fe84:797",
"2001:648:2ffc:100::211", "2001:470:6d:80:a5f6:5a97:a53:71cb",
"2001:678:1::206", "2001:470:6d:80:c4f1:32a:4521:c34",
"2001:67c:15e8:d1::18", "2001:470:6d:f1e:1337:360:dead:beef",
"2001:67c:15e8:d1::19", "2001:470:8e08::",
"2001:67c:2b0::1", "2001:470:d:bb7::8888",
"2001:67c:2b0::2", "2001:470:f032:1::254",
"2001:67c:2b24:1000::10", "2001:4860:4860::8844",
"2001:67c:2b24:1000::11", "2001:4860:4860::8888",
"2001:6b0:3f::a", "2001:4870:6082:3::100",
"2001:750:2:3::51", "2001:4870:6082:3::5",
"2001:750:2:3::52", "2001:4870:8000:3::100",
"2001:7b8:1509::1", "2001:4870:8000:3::5",
"2001:840:0:200::1", "2001:4ce8::53",
"2001:840:200::", "2001:4dd0:fd5e::53",
"2001:840:2010:413::100", "2001:4f8:0:2::14",
"2001:910:800::12", "2001:550:1:1::d",
"2001:910:800::40", "2001:5b8:1::5",
"2001:913::8", "2001:610:1108:5010::130",
"2001:978:1:1::d", "2001:638:902:1::10",
"2001:978:1:2::d", "2001:648:2ffc:100::211",
"2001:b000:168::1", "2001:678:1::206",
"2001:b08:2:280::4:1", "2001:67c:15e8:d1::18",
"2001:bf0::2", "2001:67c:15e8:d1::19",
"2001:da8:202:10::37", "2001:67c:240c:214::4",
"2001:ec0:1::1", "2001:67c:240c:214::5",
"2001:ec0:3::3", "2001:67c:2b0::1",
"2400:8900::f03c:91ff:fe70:c452", "2001:67c:2b0::2",
"2407:9000:0:4::2", "2001:67c:2b24:1000::10",
"2600:3c00::20:b1ff", "2001:67c:2b24:1000::11",
"2600:3c02::f03c:91ff:fe84:cb54", "2001:6b0:3f::a",
"2600::1", "2001:7b8:1509::1",
"2600::2", "2001:840:0:200::1",
"2607:fa88:1::2", "2001:840:200::",
"2610:130:100:3::200", "2001:840:2010:413::100",
"2620:0:ccc::2", "2001:910:800::12",
"2620:0:ccd::2", "2001:910:800::40",
"2800:960:0:12:201:217:1:231", "2001:978:1:1::d",
"2a00-1508-0-4--9.puntcat.ip6.guifi.net.", "2001:978:1:2::d",
"2a00:1508:0:4::9", "2001:b000:168::1",
"2a00:5881:8100:1000::3", "2001:b08:2:280::4:1",
"2a00:dcc0:eda:88:245:71:858e:a15", "2001:bf0::2",
"2a01:4f8:161:4109::6", "2001:ec0:1::1",
"2a01:4f8:191:306c::2", "2001:ec0:3::3",
"2a02:180:1:1::517:1045", "2400:6180:0:d0::38:d001",
"2a02:2178:1:2::2", "2400:8900::f03c:91ff:fe70:c452",
"2a02:6b8::feed:ff", "2402:2f80:5::",
"2a02:940:0:4293::100", "2402:9e80:1::1:e554",
"2a03:4000:6:510b::1", "2403:5680::1:200f",
"2a03:b0c0:3:d0::7c:5001", "2407:9000:0:4::2",
"McRip-5-pt.tunnel.tserv26.ber1.ipv6.he.net.", "2600:3c00::20:b1ff",
"canopus.ne2000.nl.", "2600:3c02::f03c:91ff:fe84:cb54",
"copaco-public-resolver-ipv6-b.copaco.com.py.", "2600:3c02::f03c:91ff:fee0:5e5",
"cznic-public-dns-1.nic.cz.", "2600::1",
"dlfw-rdns-01.dlfw.twtelecom.net.", "2600::2",
"dns.cesidianroot.eu.", "2602:3f:e75c:1bff::1",
"dns.yandex.ru.", "2602:ffb6:2:0:f816:3eff:fe23:ae28",
"dns1.host.net.", "2602:ffc5:30::1:d69b",
"dns1.lon.gblx.net.", "2604:a880:1:20::c5b:1001",
"dns1.phx.gblx.net.", "2604:a880:400:d0::6d6:2001",
"dns1.totbb.net.", "2605:f700:c0:1::1089:53ef",
"dns2.phx.gblx.net.", "2607:fa88:1::2",
"dns2.roc.gblx.net.", "2610:130:100:3::200",
"dns2.totbb.net.", "2610:a1:1018::22",
"dnsres1.nic.cz.", "2610:a1:1018::23",
"dnvr-rdns-01.dnvr.twtelecom.net.", "2610:a1:1018::24",
"emma.robingroppe.de.", "2610:a1:1018::25",
"eu-res1.dns.cogentco.com.", "2610:a1:1018::26",
"eu-res2.dns.cogentco.com.", "2610:a1:1018::27",
"freya.stelas.de.", "2610:a1:1018::28",
"google-public-dns-a.google.com.", "2610:a1:1018::29",
"google-public-dns-b.google.com.", "2610:a1:1018::30",
"hntp1.hinet.net.", "2610:a1:1018::31",
"homens.b-hs.de.", "2610:a1:1018::32",
"jeru.cns.ipv6.vt.edu.", "2610:a1:1018::33",
"jeru.cns.ipv6.vt.edu.", "2610:a1:1018::34",
"leia.fdn.org.", "2610:a1:1018::35",
"lpc1.stu.neva.ru.", "2610:a1:1018::5",
"mnt1.eutelia.it.", "2610:a1:1019::22",
"mnt2.eutelia.it.", "2610:a1:1019::23",
"na-res1.dns.cogentco.com.", "2610:a1:1019::24",
"ns-3.iastate.edu.", "2610:a1:1019::25",
"ns.ipv6.uni-leipzig.de.", "2610:a1:1019::26",
"ns0.ldn-fai.net.", "2610:a1:1019::27",
"ns1.fdn.org.", "2610:a1:1019::28",
"ns1.init7.net.", "2610:a1:1019::29",
"ns1.probe-networks.de.", "2610:a1:1019::30",
"ns1.sprintlink.net.", "2610:a1:1019::31",
"ns1.twtelecom.net.", "2610:a1:1019::32",
"ns10.init7.net.", "2610:a1:1019::33",
"ns11.init7.net.", "2610:a1:1019::34",
"ns2.all.de.", "2610:a1:1019::35",
"ns2.itandtel.at.", "2610:a1:1019::5",
"ns2.powertech.no.", "2620:0:ccc::2",
"ns2.powertech.no.", "2620:0:ccd::2",
"ns2.probe-networks.de.", "2620:74:1b::1:1",
"ns2.sprintlink.net.", "2620:74:1c::2:2",
"ns2.twtelecom.net.", "2a00-1508-0-4--9.puntcat.ip6.guifi.net.",
"or.isc.org.", "2a00-1dc0-cafe--ad86-fa7e.static.host.",
"ordns.he.net.", "2a00-1dc0-cafe--c6af-c19d.static.host.",
"public-dns-a.primawebtools.de.", "2a00:12d8:7002::2",
"public-dns-c.ipv6.primawebtools.de.", "2a00:1508:0:4::9",
"recursif.arn-fai.net.", "2a00:1ca8:a7::1e9",
"resolver.qwest.net.", "2a00:1dc0:cafe::ad86:fa7e",
"resolver1.dns.trex.fi.", "2a00:1dc0:cafe::c6af:c19d",
"resolver1.ipv6-sandbox.opendns.com.", "2a00:5881:8100:1000::3",
"resolver2.dns.trex.fi.", "2a00:5884:8218::1",
"resolver2.ipv6-sandbox.opendns.com.", "2a00:dcc0:eda:88:245:71:858e:a15",
"rickhunter.ns.ielo.net.", "2a00:dcc0:eda:98:183:193:d85a:389b",
"rns1.grnet.gr.", "2a00:dcc7:2202:11::7b28",
"services.donotuse.de.", "2a00:dcc7:2202:14::2",
"tserv1.ams1.he.net.", "2a00:f48:100c:7b::2",
"tserv1.dal1.he.net.", "2a00:f48:100c:7e::2",
"tserv1.fmt2.he.net.", "2a01:4f8:131:1278::2",
"tserv1.fra1.he.net.", "2a01:4f8:141:4281::3000",
"tserv1.mia1.he.net.", "2a01:4f8:151:90e9::2",
"tserv1.tor1.he.net.", "2a01:4f8:151:90e9::b",
"tungsten.gparent.org.", "2a01:4f8:161:4109::6",
"voip.zee.li.", "2a01:4f8:191:306c::2",
"www.cesidianroot.eu.", "2a02:2178:1:2::2",
"x.ns.gin.ntt.net.", "2a02:2ca0:64:22::2",
"y.ns.gin.ntt.net.", "2a02:6b8::feed:ff",
"yardbird.cns.ipv6.vt.edu.", "2a02:7aa0:1201::f60e:2719",
"yardbird.cns.ipv6.vt.edu.", "2a02:7aa0:1619::4f50:a69",
"zen.stack.nl." "2a02:940:0:4293::100",
], "2a02:e00:fffd:139::9",
"matching_attribute": [ "2a03:b0c0:0:1010::62:f001",
"ip-src", "2a03:b0c0:3:d0::7c:5001",
"ip-dst", "2a04:92c7:7:7::14ae:460a",
"domain|ip" "2a04:9dc0:c1:7::cb9:f785",
], "2a05:b0c6:5e4::53",
"name": "List of known IPv6 public DNS resolvers", "2a05:dfc7:5::53",
"version": "20160803" "2a05:dfc7:5::5353",
} "2c0f:fda8:5::2ed1:d2ec",
"::ffff:9538:1aed",
"::ffff:9e45:abfe",
"ClemenTroniQ89-1-pt.tunnel.tserv11.ams1.ipv6.he.net.",
"anyone.dnsrec.meo.ws.",
"anytwo.dnsrec.meo.ws.",
"b-root.cesidian.info.",
"canopus.ne2000.nl.",
"cl-849.hel-01.fi.sixxs.net.",
"crt-public-dns-a.cesidianroot.eu.",
"cznic-public-dns-1.nic.cz.",
"dlfw-rdns-01.dlfw.twtelecom.net.",
"dns.yandex.ru.",
"dns01.jordbruksverket.se.",
"dns02.jordbruksverket.se.",
"dns1.host.net.",
"dns1.lon.gblx.net.",
"dns1.phx.gblx.net.",
"dns1.totbb.net.",
"dns2.phx.gblx.net.",
"dns2.roc.gblx.net.",
"dns2.totbb.net.",
"dnsdist.mysrvr.net.",
"dnsres1.nic.cz.",
"eu-res1.dns.cogentco.com.",
"eu-res2.dns.cogentco.com.",
"freya.stelas.de.",
"google-public-dns-b.google.com.",
"hntp1.hinet.net.",
"homens.b-hs.de.",
"host19-65-static.59-88-b.business.telecomitalia.it.",
"jeru.cns.ipv6.vt.edu.",
"log.bzh.",
"lpc1.stu.neva.ru.",
"lucy.s.imvry.pw.",
"mail2.cesidianroot.eu.",
"na-res1.dns.cogentco.com.",
"ns-3.iastate.edu.",
"ns.ipv6.uni-leipzig.de.",
"ns0.fdn.org.",
"ns1.ams.dns.lchi.mp.",
"ns1.ata.dns.lchi.mp.",
"ns1.fdn.fr.",
"ns1.hnd.dns.lchi.mp.",
"ns1.init7.net.",
"ns1.nl.dns.d0wn.biz.",
"ns1.probe-networks.de.",
"ns1.sea.dns.lchi.mp.",
"ns1.sg.dns.d0wn.biz.",
"ns1.shodan.io.",
"ns1.syd.dns.lchi.mp.",
"ns1.twtelecom.net.",
"ns10.init7.net.",
"ns11.init7.net.",
"ns2.all.de.",
"ns2.itandtel.at.",
"ns2.powertech.no.",
"ns2.probe-networks.de.",
"ns2.shodan.io.",
"ns2.sprintlink.net.",
"ns2.twtelecom.net.",
"ns532549.ip-149-56-26.net.",
"open-root.cesidian.info.",
"or.isc.org.",
"ordns.he.net.",
"plfgr.eu.org.",
"primary.server.edv-froehlich.de.",
"proxyvm.stejau.de.",
"public-dns-a.primawebtools.de.",
"recursif.arn-fai.net.",
"resolver.qwest.net.",
"resolver1.dns.trex.fi.",
"resolver1.ipv6-sandbox.opendns.com.",
"resolver2.dns.trex.fi.",
"resolver2.ipv6-sandbox.opendns.com.",
"rickhunter.ns.ielo.net.",
"rns1.grnet.gr.",
"secondary.server.edv-froehlich.de.",
"services.donotuse.de.",
"spcr-2.machadosbsmarketing.com.br.",
"test.cesidian.info.",
"tserv1.ams1.he.net.",
"tserv1.dal1.he.net.",
"tserv1.fmt2.he.net.",
"tserv1.fra1.he.net.",
"tserv1.mia1.he.net.",
"tserv1.tor1.he.net.",
"x.ns.gin.ntt.net.",
"y.ns.gin.ntt.net.",
"yardbird.cns.ipv6.vt.edu.",
"zen.stack.nl."
],
"matching_attributes": [
"ip-src",
"ip-dst",
"domain|ip"
],
"name": "List of known IPv6 public DNS resolvers",
"version": 20170212
}

16
lists/rfc6598/list.json Normal file
View File

@ -0,0 +1,16 @@
{
"list": [
"100.64.0.0/10"
],
"type": [
"cidr"
],
"matching_attributes": [
"ip-src",
"ip-dst",
"domain|ip"
],
"description": "Event contains one or more entries part of the RFC 6598 CIDR blocks - Special Use IPv4 Addresses",
"version": 2,
"name": "List of RFC 6598 CIDR blocks"
}

12944
lists/second-level-tlds/list.json
View File

File diff suppressed because it is too large Load Diff

78
lists/url-shortener/list.json Normal file
View File

@ -0,0 +1,78 @@
{
"name": "List of known URL Shorteners domains",
"version": 2,
"description": "Event contains one or more entries of known Shorteners domains",
"matching_attributes": [
"domain",
"hostname",
"domain|ip",
"url",
"uri"
],
"list": [
"1url.com",
"adcraft.co",
"adcrun.ch",
"adflav.com",
"adf.ly",
"aka.gr",
"bc.vc",
"bee4.biz",
"bit.do",
"bit.ly",
"bitly.com",
"buff.ly",
"buzurl.com",
"cektkp.com",
"cur.lv",
"cutt.us",
"db.tt",
"dft.ba",
"filoops.info",
"fun.ly",
"fzy.co",
"gog.li",
"golinks.co",
"goo.gl",
"hit.my",
"id.tl",
"is.gd",
"ity.im",
"j.mp",
"linkto.im",
"link.zip.net",
"lnk.co",
"lnkd.in",
"mcaf.ee",
"nov.io",
"ow.ly",
"p6l.org",
"picz.us",
"po.st",
"prettylinkpro.com",
"q.gs",
"qr.ae",
"qr.net",
"scrnch.me",
"shortquik.com",
"sk.gy",
"su.pr",
"t.co",
"tinyarrows.com",
"tinyurl.com",
"tota2.com",
"tr.im",
"tweez.me",
"twitthis.com",
"u.bb",
"u.to",
"v.gd",
"vzturl.com",
"x.co",
"xlinkz.info",
"xtu.me",
"yourls.org",
"yu2.it",
"zpag.es"
]
}

45
lists/whats-my-ip/list.json Normal file
View File

@ -0,0 +1,45 @@
{
"name": "List of known domains to know external IP",
"version": 2,
"description": "Event contains one or more entries of known 'what's is my ip' domains",
"matching_attributes": [
"domain",
"hostname",
"domain|ip",
"uri",
"url"
],
"list": [
"api.ipify.org",
"checkip.dyndns.com",
"icanhazip.com",
"ifcfg.me",
"ifconfig.co",
"ip4.me",
"ip-adress.eu",
"ip.anysrc.net",
"ipchicken.com",
"ipecho.net",
"ipinfo.info",
"ip-secrets.com",
"myexternalip.com",
"myipaddress.com",
"my-ip-address.net",
"myipnumber.com",
"vermiip.es",
"whatismybrowser.com",
"whatismyipaddress.com",
"whatismyip.com",
"whatismyip.com.br",
"whatismyip.li",
"whatismyip.net",
"whatismyip.org",
"whatismypublicip.com",
"whatsmyip.ie",
"whatsmyip.net",
"whatsmyip.org",
"wtfismyip.com",
"ip-score.com",
"xmyip.com"
]
}

46
schema.json Normal file
View File

@ -0,0 +1,46 @@
{
"$schema": "http://json-schema.org/schema#",
"title": "Validator for misp-warninglists",
"id": "https://www.github.com/MISP/misp-warninglists/schema.json",
"type": "object",
"additionalProperties": false,
"properties": {
"description": {
"type": "string"
},
"name": {
"type": "string"
},
"version": {
"type": "integer"
},
"list": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "string"
}
},
"type": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "string"
}
},
"matching_attributes": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "string"
}
}
},
"required": [
"list",
"matching_attributes",
"description",
"version",
"name"
]
}

10
tools/generate-alexa.py Normal file → Executable file
View File

@ -8,7 +8,7 @@ import json
alexa_url = "http://s3.amazonaws.com/alexa-static/top-1m.csv.zip" alexa_url = "http://s3.amazonaws.com/alexa-static/top-1m.csv.zip"
alexa_file = "top-1m.csv.zip" alexa_file = "top-1m.csv.zip"
user_agent = {"User-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0"} user_agent = {"User-agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0"}
r = requests.get(alexa_url, headers=user_agent) r = requests.get(alexa_url, headers=user_agent)
with open(alexa_file, 'wb') as fd: with open(alexa_file, 'wb') as fd:
for chunk in r.iter_content(4096): for chunk in r.iter_content(4096):
@ -22,15 +22,17 @@ with zipfile.ZipFile(alexa_file, 'r') as alexa_lists:
continue continue
alexa_warninglist = {} alexa_warninglist = {}
version = int(datetime.date.today().strftime('%Y%m%d'))
alexa_warninglist['description'] = "Event contains one or more entries from the top 1000 of the most used website (Alexa)." alexa_warninglist['description'] = "Event contains one or more entries from the top 1000 of the most used website (Alexa)."
d = datetime.datetime.now() d = datetime.datetime.now()
alexa_warninglist['version'] = "{0}{1:02d}{2:02d}".format(d.year,d.month,d.day) alexa_warninglist['version'] = version
alexa_warninglist['name'] = "Top 1000 website from Alexa" alexa_warninglist['name'] = "Top 1000 website from Alexa"
alexa_warninglist['list'] = [] alexa_warninglist['list'] = []
alexa_warninglist['matching_attributes'] = ['hostname','domain'] alexa_warninglist['matching_attributes'] = ['hostname', 'domain']
for site in top1000: for site in top1000:
v = str(site).split(',')[1] v = str(site).split(',')[1]
alexa_warninglist['list'].append(v[:-3]) alexa_warninglist['list'].append(v[:-3])
print (json.dumps(alexa_warninglist)) alexa_warninglist['list'] = sorted(set(alexa_warninglist['list']))
print(json.dumps(alexa_warninglist))

8
tools/generate-office365.py Normal file → Executable file
View File

@ -15,10 +15,10 @@ for address in office365.iter('address'):
warninglist = {} warninglist = {}
warninglist['name'] = 'List of known Office 365 URLs and IP address ranges' warninglist['name'] = 'List of known Office 365 URLs and IP address ranges'
d = datetime.datetime.now() warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['version'] = "{0}{1:02d}{2:02d}".format(d.year, d.month, d.day)
warninglist['description'] = 'Office 365 URLs and IP address ranges' warninglist['description'] = 'Office 365 URLs and IP address ranges'
warninglist['list'] = l warninglist['list'] = sorted(set(l))
warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip", "hostname"]
print (json.dumps(warninglist)) print(json.dumps(warninglist))

14
tools/generate-publicdns.py
View File

@ -28,7 +28,7 @@ with open(csv_path) as csv_file:
for row in servers_list: for row in servers_list:
if row[5] == '': if row[5] == '':
try: try:
ip = ipaddress.ip_address(row[0]) ip = ipaddress.ip_address(row[0])
if ip.version == 4: if ip.version == 4:
@ -43,25 +43,25 @@ with open(csv_path) as csv_file:
except ValueError as exc: except ValueError as exc:
logging.warning(str(exc)) logging.warning(str(exc))
version = datetime.datetime.now().strftime('%Y%m%d') version = int(datetime.date.today().strftime('%Y%m%d'))
out4_list = {} out4_list = {}
out4_list['name'] = 'List of known IPv4 public DNS resolvers' out4_list['name'] = 'List of known IPv4 public DNS resolvers'
out4_list['version'] = version out4_list['version'] = version
out4_list['description'] = 'Event contains one or more public IPv4 DNS resolvers as attribute with an IDS flag set' out4_list['description'] = 'Event contains one or more public IPv4 DNS resolvers as attribute with an IDS flag set'
out4_list['matching_attribute'] = [ 'ip-src', 'ip-dst', 'domain|ip' ] out4_list['matching_attributes'] = ['ip-src', 'ip-dst', 'domain|ip']
out4_list['list'] = sorted(ip4_list) out4_list['list'] = sorted(set(ip4_list))
out6_list = {} out6_list = {}
out6_list['name'] = 'List of known IPv6 public DNS resolvers' out6_list['name'] = 'List of known IPv6 public DNS resolvers'
out6_list['version'] = version out6_list['version'] = version
out6_list['description'] = 'Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set' out6_list['description'] = 'Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set'
out6_list['matching_attribute'] = [ 'ip-src', 'ip-dst', 'domain|ip' ] out6_list['matching_attributes'] = ['ip-src', 'ip-dst', 'domain|ip']
out6_list['list'] = sorted(ip6_list) out6_list['list'] = sorted(set(ip6_list))
#print(json.dumps(out4_list, indent=True)) # print(json.dumps(out4_list, indent=True))
with open(dns4_path, 'w') as dns4_file: with open(dns4_path, 'w') as dns4_file:
dns4_file.write(json.dumps(out4_list, indent=4, sort_keys=True)) dns4_file.write(json.dumps(out4_list, indent=4, sort_keys=True))

21
validate_all.sh Executable file
View File

@ -0,0 +1,21 @@
#!/bin/bash
set -e
set -x
./jq_all_the_things.sh
diffs=`git status --porcelain | wc -l`
if ! [ $diffs -eq 0 ]; then
echo "Please make sure you run ./jq_all_the_things.sh before commiting."
exit 1
fi
for dir in lists/*/list.json
do
echo -n "${dir}: "
jsonschema -i ${dir} schema.json
echo ''
done