From: Adolf Belka <adolf.belka@ipfire.org>
Date: Mon, 24 Jun 2024 15:10:39 +0000 (+0200)
Subject: ipblocklist-sources: Update to include the Abuse.ch Botnet C2 ip blocklist
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e9e78d2aff0a90d4551e20c7d7d5e01aa8d6ef1a;p=people%2Fmfischer%2Fipfire-2.x.git

ipblocklist-sources: Update to include the Abuse.ch Botnet C2 ip blocklist

- Blocklist addition was discussed and agreed at IPFire dev conf call in June 2024.
- Tested on vm system.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources
index 69f964dd9..1cef06dd1 100644
--- a/config/ipblocklist/sources
+++ b/config/ipblocklist/sources
@@ -142,5 +142,11 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats Blocklis
 					 'info'     => 'https://blacklist.3coresec.net',
 					 'parser'   => 'ip-or-net-list',
 					 'rate'     => '1d',
-					 'category' => 'attacker' }
+					 'category' => 'attacker' },
+	      'ABUSECH_BOTNETC2'  => { 'name'	=> 'ABUSE.ch Botnet C2 IP Blocklist',
+					   'url'	=> 'https://sslbl.abuse.ch/blacklist/sslipblacklist.txt',
+					   'info'	=> 'https://sslbl.abuse.ch/blacklist#botnet-c2-ips-csv',
+					   'parser'	=> 'ip-or-net-list',
+					   'rate'	=> '5m',
+					   'category'	=> 'reputation' }
            );