net/banip/files/banip.feeds

   1 {
   2         "adaway": {
   3                 "url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/adaway-ipv4.txt",
   4                 "url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/adaway-ipv6.txt",
   5                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
   6                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
   7                 "focus": "adaway IPs",
   8                 "descurl": "https://github.com/dibdot/banIP-IP-blocklists"
   9         },
  10         "adguard": {
  11                 "url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/adguard-ipv4.txt",
  12                 "url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/adguard-ipv6.txt",
  13                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  14                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  15                 "focus": "adguard IPs",
  16                 "descurl": "https://github.com/dibdot/banIP-IP-blocklists"
  17         },
  18         "adguardtrackers": {
  19                 "url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/adguardtrackers-ipv4.txt",
  20                 "url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/adguardtrackers-ipv6.txt",
  21                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  22                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  23                 "focus": "adguardtracker IPs",
  24                 "descurl": "https://github.com/dibdot/banIP-IP-blocklists"
  25         },
  26         "antipopads": {
  27                 "url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/antipopads-ipv4.txt",
  28                 "url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/antipopads-ipv6.txt",
  29                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  30                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  31                 "focus": "antipopads IPs",
  32                 "descurl": "https://github.com/dibdot/banIP-IP-blocklists"
  33         },
  34         "asn": {
  35                 "url_4": "https://asn.ipinfo.app/api/text/list/",
  36                 "url_6": "https://asn.ipinfo.app/api/text/list/",
  37                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
  38                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
  39                 "focus": "ASN IPs",
  40                 "descurl": "https://asn.ipinfo.app"
  41         },
  42         "backscatterer": {
  43                 "url_4": "http://wget-mirrors.uceprotect.net/rbldnsd-all/ips.backscatterer.org.gz",
  44                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
  45                 "focus": "backscatterer IPs",
  46                 "descurl": "https://www.uceprotect.net/en/index.php",
  47                 "flag": "gz"
  48         },
  49         "bogon": {
  50                 "url_4": "https://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt",
  51                 "url_6": "https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt",
  52                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
  53                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
  54                 "focus": "bogon prefixes",
  55                 "descurl": "https://team-cymru.com"
  56         },
  57         "cinsscore": {
  58                 "url_4": "https://cinsscore.com/list/ci-badguys.txt",
  59                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
  60                 "focus": "suspicious attacker IPs",
  61                 "descurl": "https://cinsscore.com/#list"
  62         },
  63         "country": {
  64                 "url_4": "https://www.ipdeny.com/ipblocks/data/aggregated/",
  65                 "url_6": "https://www.ipdeny.com/ipv6/ipaddresses/aggregated/",
  66                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
  67                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
  68                 "focus": "country blocks",
  69                 "descurl": "http://www.ipdeny.com/ipblocks"
  70         },
  71         "darklist": {
  72                 "url_4": "https://darklist.de/raw.php",
  73                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
  74                 "focus": "suspicious attacker IPs",
  75                 "descurl": "https://darklist.de"
  76         },
  77         "debl": {
  78                 "url_4": "https://www.blocklist.de/downloads/export-ips_all.txt",
  79                 "url_6": "https://www.blocklist.de/downloads/export-ips_all.txt",
  80                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
  81                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
  82                 "focus": "fail2ban IP blacklist",
  83                 "descurl": "https://www.blocklist.de"
  84         },
  85         "doh": {
  86                 "url_4": "https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/master/doh-ipv4.txt",
  87                 "url_6": "https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/master/doh-ipv6.txt",
  88                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  89                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  90                 "focus": "public DoH-Provider",
  91                 "descurl": "https://github.com/dibdot/DoH-IP-blocklists"
  92         },
  93         "drop": {
  94                 "url_4": "https://www.spamhaus.org/drop/drop.txt",
  95                 "url_6": "https://www.spamhaus.org/drop/dropv6.txt",
  96                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  97                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
  98                 "focus": "spamhaus drop compilation",
  99                 "descurl": "https://www.spamhaus.org"
 100         },
 101         "dshield": {
 102                 "url_4": "https://feeds.dshield.org/block.txt",
 103                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s/%s,\\n\",$1,$3}",
 104                 "focus": "dshield IP blocklist",
 105                 "descurl": "https://www.dshield.org"
 106         },
 107         "edrop": {
 108                 "url_4": "https://www.spamhaus.org/drop/edrop.txt",
 109                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 110                 "focus": "spamhaus edrop compilation",
 111                 "descurl": "https://www.spamhaus.org"
 112         },
 113         "feodo": {
 114                 "url_4": "https://feodotracker.abuse.ch/downloads/ipblocklist.txt",
 115                 "rule_4": "BEGIN{RS=\"\\r\\n\"}/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 116                 "focus": "feodo tracker",
 117                 "descurl": "https://feodotracker.abuse.ch"
 118         },
 119         "firehol1": {
 120                 "url_4": "https://iplists.firehol.org/files/firehol_level1.netset",
 121                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 122                 "focus": "firehol level 1 compilation",
 123                 "descurl": "https://iplists.firehol.org/?ipset=firehol_level1"
 124         },
 125         "firehol2": {
 126                 "url_4": "https://iplists.firehol.org/files/firehol_level2.netset",
 127                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 128                 "focus": "firehol level 2 compilation",
 129                 "descurl": "https://iplists.firehol.org/?ipset=firehol_level2"
 130         },
 131         "firehol3": {
 132                 "url_4": "https://iplists.firehol.org/files/firehol_level3.netset",
 133                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 134                 "focus": "firehol level 3 compilation",
 135                 "descurl": "https://iplists.firehol.org/?ipset=firehol_level3"
 136         },
 137         "firehol4": {
 138                 "url_4": "https://iplists.firehol.org/files/firehol_level4.netset",
 139                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{if(!seen[$1]++)printf \"%s,\\n\",$1}",
 140                 "focus": "firehol level 4 compilation",
 141                 "descurl": "https://iplists.firehol.org/?ipset=firehol_level4"
 142         },
 143         "greensnow": {
 144                 "url_4": "https://blocklist.greensnow.co/greensnow.txt",
 145                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 146                 "focus": "suspicious server IPs",
 147                 "descurl": "https://greensnow.co"
 148         },
 149         "iblockads": {
 150                 "url_4": "https://list.iblocklist.com/?list=dgxtneitpuvgqqcpfulq&fileformat=cidr&archiveformat=gz",
 151                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 152                 "focus": "advertising IPs",
 153                 "descurl": "https://www.iblocklist.com",
 154                 "flag": "gz",
 155                 "login": true
 156         },
 157         "iblockspy": {
 158                 "url_4": "https://list.iblocklist.com/?list=llvtlsjyoyiczbkjsxpf&fileformat=cidr&archiveformat=gz",
 159                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 160                 "focus": "malicious spyware IPs",
 161                 "descurl": "https://www.iblocklist.com",
 162                 "flag": "gz",
 163                 "login": true
 164         },
 165         "myip": {
 166                 "url_4": "https://myip.ms/files/blacklist/general/latest_blacklist.txt",
 167                 "url_6": "https://myip.ms/files/blacklist/general/latest_blacklist.txt",
 168                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 169                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 170                 "focus": "real-time IP blocklist",
 171                 "descurl": "https://myip.ms"
 172         },
 173         "nixspam": {
 174                 "url_4": "https://www.nixspam.net/download/nixspam-ip.dump.gz",
 175                 "rule_4": "/(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$2}",
 176                 "focus": "iX spam protection",
 177                 "descurl": "https://www.nixspam.net",
 178                 "flag": "gz"
 179         },
 180         "oisdbig": {
 181                 "url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdbig-ipv4.txt",
 182                 "url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdbig-ipv6.txt",
 183                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 184                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 185                 "focus": "OISD-big IPs",
 186                 "descurl": "https://github.com/dibdot/banIP-IP-blocklists"
 187         },
 188         "oisdnsfw": {
 189                 "url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdnsfw-ipv4.txt",
 190                 "url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdnsfw-ipv6.txt",
 191                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 192                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 193                 "focus": "OISD-nsfw IPs",
 194                 "descurl": "https://github.com/dibdot/banIP-IP-blocklists"
 195         },
 196         "oisdsmall": {
 197                 "url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdsmall-ipv4.txt",
 198                 "url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/oisdsmall-ipv6.txt",
 199                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 200                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 201                 "focus": "OISD-small IPs",
 202                 "descurl": "https://github.com/dibdot/banIP-IP-blocklists"
 203         },
 204         "proxy": {
 205                 "url_4": "https://iplists.firehol.org/files/proxylists.ipset",
 206                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 207                 "focus": "open proxies",
 208                 "descurl": "https://iplists.firehol.org/?ipset=proxylists"
 209         },
 210         "sslbl": {
 211                 "url_4": "https://sslbl.abuse.ch/blacklist/sslipblacklist.csv",
 212                 "rule_4": "BEGIN{FS=\",\"}/(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)/{printf \"%s,\\n\",$2}",
 213                 "focus": "SSL botnet IPs",
 214                 "descurl": "https://sslbl.abuse.ch"
 215         },
 216         "stevenblack": {
 217                 "url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/stevenblack-ipv4.txt",
 218                 "url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/stevenblack-ipv6.txt",
 219                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 220                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 221                 "focus": "stevenblack IPs",
 222                 "descurl": "https://github.com/dibdot/banIP-IP-blocklists"
 223         },
 224         "talos": {
 225                 "url_4": "https://www.talosintelligence.com/documents/ip-blacklist",
 226                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 227                 "focus": "talos IPs",
 228                 "descurl": "https://talosintelligence.com/reputation_center"
 229         },
 230         "threat": {
 231                 "url_4": "https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt",
 232                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 233                 "focus": "emerging threats",
 234                 "descurl": "https://rules.emergingthreats.net"
 235         },
 236         "threatview": {
 237                 "url_4": "https://threatview.io/Downloads/IP-High-Confidence-Feed.txt",
 238                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 239                 "focus": "malicious IPs",
 240                 "descurl": "https://threatview.io"
 241         },
 242         "tor": {
 243                 "url_4": "https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst",
 244                 "url_6": "https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst",
 245                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 246                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
 247                 "focus": "tor exit nodes",
 248                 "descurl": "https://github.com/SecOps-Institute/Tor-IP-Addresses"
 249         },
 250         "uceprotect1": {
 251                 "url_4": "http://wget-mirrors.uceprotect.net/rbldnsd-all/dnsbl-1.uceprotect.net.gz",
 252                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 253                 "focus": "spam protection level 1",
 254                 "descurl": "http://www.uceprotect.net/en/index.php",
 255                 "flag": "gz"
 256         },
 257         "uceprotect2": {
 258                 "url_4": "http://wget-mirrors.uceprotect.net/rbldnsd-all/dnsbl-2.uceprotect.net.gz",
 259                 "rule_4": "BEGIN{IGNORECASE=1}/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]]NET)/{printf \"%s,\\n\",$1}",
 260                 "focus": "spam protection level 2",
 261                 "descurl": "http://www.uceprotect.net/en/index.php",
 262                 "flag": "gz"
 263         },
 264         "uceprotect3": {
 265                 "url_4": "http://wget-mirrors.uceprotect.net/rbldnsd-all/dnsbl-3.uceprotect.net.gz",
 266                 "rule_4": "BEGIN{IGNORECASE=1}/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]]YOUR)/{printf \"%s,\\n\",$1}",
 267                 "focus": "spam protection level 3",
 268                 "descurl": "http://www.uceprotect.net/en/index.php",
 269                 "flag": "gz"
 270         },
 271         "urlhaus": {
 272                 "url_4": "https://urlhaus.abuse.ch/downloads/ids/",
 273                 "rule_4": "match($0,/(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5]))/){printf \"%s,\\n\",substr($0,RSTART,RLENGTH)}",
 274                 "focus": "urlhaus IDS IPs",
 275                 "descurl": "https://urlhaus.abuse.ch"
 276         },
 277         "urlvir": {
 278                 "url_4": "https://iplists.firehol.org/files/urlvir.ipset",
 279                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 280                 "focus": "malware related IPs",
 281                 "descurl": "https://iplists.firehol.org/?ipset=urlvir"
 282         },
 283         "voip": {
 284                 "url_4": "https://voipbl.org/update/",
 285                 "rule_4": "BEGIN{RS=\"(([0-9]{1,3}\\\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)\"}{if(RT)printf \"%s,\\n\",RT}",
 286                 "focus": "VoIP fraud blocklist",
 287                 "descurl": "https://voipbl.org"
 288         },
 289         "webclient": {
 290                 "url_4": "https://iplists.firehol.org/files/firehol_webclient.netset",
 291                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
 292                 "focus": "malware related IPs",
 293                 "descurl": "https://iplists.firehol.org/?ipset=firehol_webclient"
 294         },
 295         "yoyo": {
 296                 "url_4": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/yoyo-ipv4.txt",
 297                 "url_6": "https://raw.githubusercontent.com/dibdot/banIP-IP-blocklists/main/yoyo-ipv6.txt",
 298                 "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 299                 "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)[[:space:]]/{printf \"%s,\\n\",$1}",
 300                 "focus": "yoyo IPs",
 301                 "descurl": "https://github.com/dibdot/banIP-IP-blocklists"
 302         }
 303 }