From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4ZjynG3VQ9z336H for ; Thu, 24 Apr 2025 14:20:50 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4ZjynB6LmYz2xc2 for ; Thu, 24 Apr 2025 14:20:46 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4ZjynB1fjRzlQ; Thu, 24 Apr 2025 14:20:46 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1745504446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=ltqz0T59+FKneU6/9kurUhUSytxS/qGPJHlOdeBia7Y=; b=jP6cuk8ab+XEnAkKHg8Z9SWglg1yqFwhM4imVrBmlVhe/07kCQ+LLoer0ludzDebHf0zxW 8lPe7qSga4vrZuDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1745504446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=ltqz0T59+FKneU6/9kurUhUSytxS/qGPJHlOdeBia7Y=; b=uQAvVAMgGkeiGC4Xo9dCOK8qbGKf6Wtt5u/svg/6Mo3ZiFRzvDefWkTSZLzkZ6o5ghZTJm lfkIdttBr+KgpzOnnlX+bjTXHYhvc50Kd0f9jTc5kQHMz3CzOajqJ2k7crlJvC4C1h7TLL mGakdy/znRzMsMRjSSiZVyDj+btOL1efVZZo9H/4q1n7W+6Nb0udGUuqgKmN3iO92alXOP 7jKH5nQWJwWXpamrKZw/5BZYG+gZrmwZ/i4bdjNern/o5OGHChZyUCBTMutEXNrh+Fyoty TVI1D6tjSioHCFXY8MHsq5cziYZJSMJUv0GSYmkiJ9hyyTs0FDJDXXaYX7NfyA== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 1/4] sources: remove the 3CORESEC ipblocklist entries from the sources file Date: Thu, 24 Apr 2025 16:20:38 +0200 Message-ID: <20250424142041.3443255-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit - The three 3CORESEC ipblocklists were removed and the web server urls completely removed on 3 Feb 2025. There was no explanation or announcement. - There was some suggestion from their twitter account that they might be ressurrected which is why the removal was delayed. However there has been no further notification or indication of any change. - From their website they focus on a turnkey platform provision and the provision of actionable threat information being provided on a subscription basis. So I believe they have decided to stop the free IPBlocklist provision but were not willing to make a clear announcement on that fact. - This patch removes the three lists from the sources file. Signed-off-by: Adolf Belka --- config/ipblocklist/sources | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources index 0e26792d6..b0b405357 100644 --- a/config/ipblocklist/sources +++ b/config/ipblocklist/sources @@ -111,24 +111,6 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name' => 'Emerging Threats Blocklis 'parser' => 'ip-or-net-list', 'rate' => '30m', 'category' => 'attacker' }, - '3CORESEC_SSH' => { 'name' => '3CORESec SSH Activity Blocklist', - 'url' => 'https://blacklist.3coresec.net/lists/ssh.txt', - 'info' => 'https://blacklist.3coresec.net', - 'parser' => 'ip-or-net-list', - 'rate' => '1d', - 'category' => 'attacker' }, - '3CORESEC_SCAN' => { 'name' => '3CORESec Scan and IDS Blocklist', - 'url' => 'https://blacklist.3coresec.net/lists/misc.txt', - 'info' => 'https://blacklist.3coresec.net', - 'parser' => 'ip-or-net-list', - 'rate' => '1d', - 'category' => 'reputation' }, - '3CORESEC_WEB' => { 'name' => '3CORESec Web Server Activity Blocklist', - 'url' => 'https://blacklist.3coresec.net/lists/http.txt', - 'info' => 'https://blacklist.3coresec.net', - 'parser' => 'ip-or-net-list', - 'rate' => '1d', - 'category' => 'attacker' }, 'THREATVIEW_IO_IP' => { 'name' => 'Threatview.io Malicious IP Blocklist for known Bad IP addresses', 'url' => 'https://threatview.io/Downloads/IP-High-Confidence-Feed.txt', 'info' => 'https://threatview.io/#services', -- 2.49.0