- The three 3CORESEC ipblocklists were removed and the web server urls completely removed on 3 Feb 2025. There was no explanation or announcement. - There was some suggestion from their twitter account that they might be ressurrected which is why the removal was delayed. However there has been no further notification or indication of any change. - From their website they focus on a turnkey platform provision and the provision of actionable threat information being provided on a subscription basis. So I believe they have decided to stop the free IPBlocklist provision but were not willing to make a clear announcement on that fact. - This patch removes the three lists from the sources file.
Signed-off-by: Adolf Belka <[email protected]> --- config/ipblocklist/sources | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources index 0e26792d6..b0b405357 100644 --- a/config/ipblocklist/sources +++ b/config/ipblocklist/sources @@ -111,24 +111,6 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name' => 'Emerging Threats Blocklis 'parser' => 'ip-or-net-list', 'rate' => '30m', 'category' => 'attacker' }, - '3CORESEC_SSH' => { 'name' => '3CORESec SSH Activity Blocklist', - 'url' => 'https://blacklist.3coresec.net/lists/ssh.txt', - 'info' => 'https://blacklist.3coresec.net', - 'parser' => 'ip-or-net-list', - 'rate' => '1d', - 'category' => 'attacker' }, - '3CORESEC_SCAN' => { 'name' => '3CORESec Scan and IDS Blocklist', - 'url' => 'https://blacklist.3coresec.net/lists/misc.txt', - 'info' => 'https://blacklist.3coresec.net', - 'parser' => 'ip-or-net-list', - 'rate' => '1d', - 'category' => 'reputation' }, - '3CORESEC_WEB' => { 'name' => '3CORESec Web Server Activity Blocklist', - 'url' => 'https://blacklist.3coresec.net/lists/http.txt', - 'info' => 'https://blacklist.3coresec.net', - 'parser' => 'ip-or-net-list', - 'rate' => '1d', - 'category' => 'attacker' }, 'THREATVIEW_IO_IP' => { 'name' => 'Threatview.io Malicious IP Blocklist for known Bad IP addresses', 'url' => 'https://threatview.io/Downloads/IP-High-Confidence-Feed.txt', 'info' => 'https://threatview.io/#services', -- 2.49.0
