Merge pull request #15 from devnull-/whats-my-ip

Warning list "What's my IP" domains

README.md

@@ -23,6 +23,7 @@ are available in one of the list. The list can be globally enabled or disabled i
 - [lists/rfc5735](lists/rfc5735) - RFC 5735 CIDR blocks - Special Use IPv4 Addresses
 - [lists/second-level-tlds](lists/second-level-tlds) - Mozilla list of second level top-level domains
 - [lists/tlds](lists/tlds) - top-level domains
+- [lists/whats-my-ip](lists/whats-my-ip) - "What's my IP" service
 
 # Format of a warning list
 

lists/whats-my-ip/list.json

@@ -0,0 +1,40 @@
+{
+  "name": "List of known domains to know external IP",
+  "version": 2,
+  "description": "Event contains one or more entries of known 'what's is my ip' domains",
+  "matching_attributes": [ "domain", "hostname", "domain|ip", "uri", "url" ],
+  "list": [
+        "api.ipify.org",
+        "checkip.dyndns.com",
+        "icanhazip.com",
+        "ifcfg.me",
+        "ifconfig.co",
+        "ip4.me",
+        "ip-adress.eu",
+        "ip.anysrc.net",
+        "ipchicken.com",
+        "ipecho.net",
+        "ipinfo.info",
+        "ip-secrets.com",
+        "myexternalip.com",
+        "myipaddress.com",
+        "my-ip-address.net",
+        "myipnumber.com",
+        "vermiip.es",
+        "whatismybrowser.com",
+        "whatismyipaddress.com",
+        "whatismyip.com",
+        "whatismyip.com.br",
+        "whatismyip.li",
+        "whatismyip.net",
+        "whatismyip.org",
+        "whatismypublicip.com",
+        "whatsmyip.ie",
+        "whatsmyip.net",
+        "whatsmyip.org",
+        "wtfismyip.com",
+        "ip-score.com",
+        "xmyip.com"
+  ]
+}
+