Skip to content

Commit 7caca94

Browse files
colorbookcolorbook
committed
Sample output of intelmq fix
1 parent a89a116 commit 7caca94

File tree

8 files changed

+206
-0
lines changed

8 files changed

+206
-0
lines changed

‎SecurityResearch/Ponmocup_Botnet.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,28 @@ web-servers.
2424
* Comments
2525
- Website not found.
2626

27+
##### Sample Output of IntelMQ
28+
29+
```javascript
30+
{
31+
"time":{
32+
"observation":"2016-07-07T12:48:53+00:00"
33+
},
34+
"source":{
35+
"fqdn":"-sso.anbtr.com"
36+
},
37+
"raw":"MTI3LjAuMC4xCS1zc28uYW5idHIuY29t",
38+
"classification":{
39+
"type":"blacklist"
40+
},
41+
"feed":{
42+
"accuracy":100.0,
43+
"url":"http://hosts-file.net/download/hosts.txt",
44+
"name":"HpHosts"
45+
}
46+
}
47+
```
48+
2749
There's only Url information in in http://security-research.dyndns.org/pub/malware-feeds/ponmocup-infected-domains-CIF-latest.txt. It looks like:
2850

2951
#

‎Spamhaus/Dont_Route_Or_Peer_Lists.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,36 @@ AFRINIC, APNIC, LACNIC or KRNIC or direct RIR allocations.
2828
* Comments
2929
- No comment
3030

31+
##### Sample Output of IntelMQ
32+
33+
```javascript
34+
{
35+
"event_description":{
36+
"text":"has malicious code redirecting to malicious host"
37+
},
38+
"time":{
39+
"observation":"2016-07-07T12:18:38+00:00",
40+
"source":"2016-07-07T07:44:04+00:00"
41+
},
42+
"raw":"LyAyODU2MC5wb2xpdGNhbG5ld3MuY29tIGh0dHA6Ly8yODU2MC5wb2xpdGNhbG5ld3MuY29tL3VybCBtLmtmYy5mcg==",
43+
"feed":{
44+
"url":"http://security-research.dyndns.org/pub/malware-feeds/ponmocup-infected-domains-CIF-latest.txt",
45+
"accuracy":100.0,
46+
"name":"DynDNS ponmocup Domains"
47+
},
48+
"source":{
49+
"url":"http://28560.politcalnews.com/url",
50+
"fqdn":"28560.politcalnews.com"
51+
},
52+
"destination":{
53+
"fqdn":"m.kfc.fr"
54+
},
55+
"classification":{
56+
"type":"malware"
57+
}
58+
}
59+
```
60+
3161
There's only IP information in https://www.spamhaus.org/drop/drop.txt
3262
It looks like:
3363

‎SpamhausCERTInsightPortal/Botnet.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,11 @@ the specific country or region that the CERT or CSIRT is responsible for.
2727
- Error
2828
* Comments
2929
- No API Key
30+
31+
##### Sample Output of IntelMQ
32+
33+
```javascript
34+
{
35+
null
36+
}
37+
```

‎TaichungBlocklist/Malicious_Activities.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,32 @@ A public blocklist of IP addresses suspected in malicious activities on-line.
2323
* Comments
2424
- No comment
2525

26+
##### Sample Output of IntelMQ
27+
28+
```javascript
29+
{
30+
"time":{
31+
"source":"2016-05-18T01:33:43+00:00",
32+
"observation":"2016-07-07T14:46:02+00:00"
33+
},
34+
"raw":"PHRkPjE8L3RkPjx0ZD48aW1nIHNyYz0iL2ltYWdlcy9mbGFncy9qcC5naWYiIGFsdD0iIj48c3BhbiBzdHlsZT0iY29sb3I6IGJsYWNrOyI+MTA2LjE4NC4yLjI5PC9zcGFuPjwvdGQ+PHRkPlNTSCBBdHRhY2s8L3RkPgogICAgICAgIDx0ZD7miYvli5XoqK3lrpo8L3RkPjx0ZD4yMDE2LTA1LTE4IDA5OjMzOjQzPC90ZD48dGQ+NTAuNTc8L3RkPgogICAgICAgIDx0ZCBzdHlsZT0iY29sb3I6cmVkOyI+5bCB6Y6WPC90ZD48L3RyPiAgICAgICAg",
35+
"event_description":{
36+
"text":"SSH Attack"
37+
},
38+
"classification":{
39+
"type":"unknown"
40+
},
41+
"source":{
42+
"ip":"106.184.2.29"
43+
},
44+
"feed":{
45+
"accuracy":100.0,
46+
"name":"Taichung",
47+
"url":"https://www.tc.edu.tw/net/netflow/lkout/recent/30"
48+
}
49+
}
50+
```
51+
2652
There's only IP information in https://www.openbl.org/lists/date_all.txt
2753
It looks like:
2854

‎TeamCymru/Bogons.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,29 @@ commonly found as the source addresses of DDoS attacks.
2727
* Comments
2828
- No comment
2929

30+
##### Sample Output of IntelMQ
31+
32+
```javascript
33+
{
34+
"feed":{
35+
"accuracy":100.0,
36+
"url":"https://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt",
37+
"name":"Cymru"
38+
},
39+
"classification":{
40+
"type":"blacklist"
41+
},
42+
"source":{
43+
"network":"0.0.0.0/8"
44+
},
45+
"time":{
46+
"observation":"2016-07-07T11:40:52+00:00",
47+
"source":"2016-07-07T08:50:01+00:00"
48+
},
49+
"raw":"MC4wLjAuMC84"
50+
}
51+
```
52+
3053
There's only IP information in https://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt
3154
It looks like:
3255

‎TurrisGreylist/Scanning_Attack.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,31 @@ help of a special router.
2525
* Comments
2626
- No comment
2727

28+
##### Sample Output of IntelMQ
29+
30+
```javascript
31+
{
32+
"classification":{
33+
"type":"scanner"
34+
},
35+
"time":{
36+
"observation":"2016-07-07T14:53:37+00:00"
37+
},
38+
"raw":"MS4xMS40NS41LEtSLG5ldGlzLDE4MzEz",
39+
"feed":{
40+
"url":"https://www.turris.cz/greylist-data/greylist-latest.csv",
41+
"name":"Turris Greylist",
42+
"accuracy":100.0
43+
},
44+
"event_description":{
45+
"text":"netis"
46+
},
47+
"source":{
48+
"ip":"1.11.45.5"
49+
}
50+
}
51+
```
52+
2853
There's not only IP information in https://www.turris.cz/greylist-data/greylist-latest.csv, but also more information like:
2954

3055
* Country

‎URLVir/Malware.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,28 @@ Monitor Malicious Executable URLs
2424
* Comments
2525
- No comment
2626

27+
##### Sample Output of IntelMQ
28+
29+
```javascript
30+
{
31+
"feed":{
32+
"url":"http://www.urlvir.com/export-ip-addresses/",
33+
"name":"URLVir",
34+
"accuracy":100.0
35+
},
36+
"raw":"MTAzLjI2Ljk5LjE0Nw==",
37+
"source":{
38+
"ip":"103.26.99.147"
39+
},
40+
"time":{
41+
"observation":"2016-07-07T14:57:12+00:00"
42+
},
43+
"classification":{
44+
"type":"malware"
45+
}
46+
}
47+
```
48+
2749
#### IP Address
2850
>
2951
* Website
@@ -41,6 +63,28 @@ Monitor Malicious Executable URLs
4163
* Comments
4264
- No comment
4365

66+
##### Sample Output of IntelMQ
67+
68+
```javascript
69+
{
70+
"time":{
71+
"observation":"2016-07-07T14:55:14+00:00"
72+
},
73+
"raw":"aW5kaXJsaXZleHN0b3JlLmNvbQ==",
74+
"classification":{
75+
"type":"malware"
76+
},
77+
"source":{
78+
"fqdn":"indirlivexstore.com"
79+
},
80+
"feed":{
81+
"accuracy":100.0,
82+
"name":"URLVir",
83+
"url":"http://www.urlvir.com/export-hosts/"
84+
}
85+
}
86+
```
87+
4488
There's only Domain information in in http://www.urlvir.com/export-hosts/. It looks like:
4589

4690
################################################################## #URLVir Active Malicious Hosts #Updated on August 29, 2016, 4:40 am #Free for noncommercial use only, contact us for more information ################################################################## indirlivexstore.com smoon.co.kr 217.199.161.78 mytnoc.com w3.gazi.edu.tr expoperfumes.com.mx strangeduckfilms.com relimar.com setar.info testtralala.xorg.pl cs8.my harshwhispers.com stdtelecom.com.br iffschool.in pegdev.be motosrc.com arizontennisdomes.com appimmobilier.com

‎hpHosts/Malicious_Activities.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,34 @@ website.
4848
* Comments
4949
- No comment
5050

51+
##### Sample Output of IntelMQ
52+
53+
```javascript
54+
{
55+
"source":{
56+
"ip":"1.34.139.38"
57+
},
58+
"time":{
59+
"observation":"2016-07-07T08:46:43+00:00"
60+
},
61+
"event_description":{
62+
"text":"IP reported as having run attacks on the service Apache, Apache-DDoS, RFI-Attacks"
63+
},
64+
"classification":{
65+
"type":"ids alert"
66+
},
67+
"raw":"MS4zNC4xMzkuMzg=",
68+
"feed":{
69+
"name":"BlockList.de",
70+
"accuracy":100.0,
71+
"url":"https://lists.blocklist.de/lists/apache.txt"
72+
},
73+
"protocol":{
74+
"application":"http"
75+
}
76+
}
77+
```
78+
5179
There's only Domain information in in http://hosts-file.net/download/hosts.txt. It looks like:
5280

5381
# hpHosts last updated on: 06/08/2016

0 commit comments

Comments
 (0)