From: Adolf Belka <adolf.belka@ipfire.org>
Date: Wed, 12 Mar 2025 11:03:22 +0000 (+0100)
Subject: sources: Update ipblocklist with Threatview.io IP list
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d028a679ab0a9a7fd29e2cf31a2fd3761f261fe1;p=people%2Fmfischer%2Fipfire-2.x.git

sources: Update ipblocklist with Threatview.io IP list

- Blocklist addition was discussed and agreed at IPFire dev conf call in March 2025.
- Tested on vm system.
- Adjusted the entry alignment for the three 3coresec entries as they had used tabs and
   all the rest used spaces for alignment. Now all entries are lined up the same.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources
index a25353528..0e26792d6 100644
--- a/config/ipblocklist/sources
+++ b/config/ipblocklist/sources
@@ -112,21 +112,27 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats Blocklis
                                     'rate'     => '30m',
                                     'category' => 'attacker' },
              '3CORESEC_SSH'    => { 'name'     => '3CORESec SSH Activity Blocklist',
-					 'url'      => 'https://blacklist.3coresec.net/lists/ssh.txt',
-					 'info'     => 'https://blacklist.3coresec.net',
-					 'parser'   => 'ip-or-net-list',
-					 'rate'     => '1d',
-					 'category' => 'attacker' },
+                                    'url'      => 'https://blacklist.3coresec.net/lists/ssh.txt',
+                                    'info'     => 'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'attacker' },
              '3CORESEC_SCAN'   => { 'name'     => '3CORESec Scan and IDS Blocklist',
-					 'url'      => 'https://blacklist.3coresec.net/lists/misc.txt',
-					 'info'     => 'https://blacklist.3coresec.net',
-					 'parser'   => 'ip-or-net-list',
-					 'rate'     => '1d',
-					 'category' => 'reputation' },
+                                    'url'      => 'https://blacklist.3coresec.net/lists/misc.txt',
+                                    'info'     => 'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'reputation' },
 	      '3CORESEC_WEB'    => { 'name'     => '3CORESec Web Server Activity Blocklist',
-					 'url'      => 'https://blacklist.3coresec.net/lists/http.txt',
-					 'info'     => 'https://blacklist.3coresec.net',
-					 'parser'   => 'ip-or-net-list',
-					 'rate'     => '1d',
-					 'category' => 'attacker' }
+                                    'url'      => 'https://blacklist.3coresec.net/lists/http.txt',
+                                    'info'     => 'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'attacker' },
+	      'THREATVIEW_IO_IP'    => { 'name'     => 'Threatview.io Malicious IP Blocklist for known Bad IP addresses',
+                                    'url'      => 'https://threatview.io/Downloads/IP-High-Confidence-Feed.txt',
+                                    'info'     => 'https://threatview.io/#services',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'reputation' }
            );