IPFire Devs - The IP Blocklist feature has been absolutely great. Has been any consideration given to adding something like the abuseipdb.com blocklist? The list does require an API key and will return a different amount of IPs depending on your subscription level/account config, but bad actors are picked up quickly.
Thanks! Chris
Hello Chris,
On 11 Oct 2022, at 14:35, Chris Multari cmultari@gmail.com wrote:
IPFire Devs - The IP Blocklist feature has been absolutely great.
Thanks for the feedback!
Has been any consideration given to adding something like the abuseipdb.com blocklist? The list does require an API key and will return a different amount of IPs depending on your subscription level/account config, but bad actors are picked up quickly.
Currently, we only process offline blocklists, since it isn’t feasible to send any API requests out. A busy firewall might get many thousands of packets in a second that need checking (and that includes any potential caching of responses).
As far as I can see, there is no way to download the entire list in text format.
-Michael
Thanks! Chris
Thanks for the reply Michael. You can download the entire list in text format in a single API call, it just requires your API key. There is a free level of service from them that will provide a basic list of 10000 high confidence offenders.
https://docs.abuseipdb.com/#plaintext-blacklist
curl -G https://api.abuseipdb.com/api/v2/blacklist \ -d confidenceMinimum=85 \ -d limit=500000 \ -H "Key: $YOUR_API_KEY" \ -H "Accept: text/plain"
We've just noticed that the majority of malicious web requests comes in from an IP with a confidence score of 85% or above from this list.
Thanks again!
Chris
On Wed, Oct 12, 2022 at 5:35 AM Michael Tremer michael.tremer@ipfire.org wrote:
Hello Chris,
On 11 Oct 2022, at 14:35, Chris Multari cmultari@gmail.com wrote:
IPFire Devs - The IP Blocklist feature has been absolutely great.
Thanks for the feedback!
Has been any consideration given to adding something like the
abuseipdb.com blocklist? The list does require an API key and will return a different amount of IPs depending on your subscription level/account config, but bad actors are picked up quickly.
Currently, we only process offline blocklists, since it isn’t feasible to send any API requests out. A busy firewall might get many thousands of packets in a second that need checking (and that includes any potential caching of responses).
As far as I can see, there is no way to download the entire list in text format.
-Michael
Thanks! Chris
-
Chris Multari -
Michael Tremer