<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I’m running ioc2rpz community web-site (<a href="https://ioc2rpz.net" class="">https://ioc2rpz.net</a>). It is powered by my open source project ioc2rpz - a DNS server which pulls TI and generate/maintain RPZ feeds.<br class=""><div><br class=""></div><div>As for now the following RPZ feeds are available on the community portal:</div><div><br class=""></div><div><b class="">- bogons-ipv4.ioc2rpz</b></div><div>Bogon IPv4 prefixes by Team Cymru (<a href="https://www.team-cymru.com/bogon-reference.html" class="">https://www.team-cymru.com/bogon-reference.html</a>). A bogon prefix is a route that should never appear in the Internet routing table. The RPZ feed includes IP space that has been allocated to an RIR, but not assigned by that RIR to an actual ISP or other end-user.</div><div><br class=""></div><div><b class="">- dga-360.ioc2rpz</b></div><div>DGA feed powered by Netlab 360 (<a href="http://data.netlab.360.com/dga/" class="">http://data.netlab.360.com/dga/</a>). It contains domains generated by malware: bamital, banjori, blackhole, ccleaner, chinad, conficker, cryptolocker, dircrypt, dyre, emotet, enviserv, feodo, fobber gameover, gspy, locky, madmax, matsnu, mirai, murofet, mydoom, necurs, nymaim, omexo, padcrypt, proslikefan, pykspa, qadars, ramnit, ranbyus, rovnix, shifu, shiotob, simda, suppobox, symmi, tempedreve, tinba, tinynuke, tofsee, vawtrak, vidro, virut, xshellghost.</div><div><br class=""></div><div>- <b class="">dns-bh.ioc2rpz</b></div><div>DNS-BH – Malware Domain Blocklist by RiskAnalytics (<a href="http://www.malwaredomains.com" class="">http://www.malwaredomains.com</a>).</div><div><br class=""></div><div>- <b class="">doh.ioc2rpz</b></div><div>The feed contains publicly available DNS over HTTPs (DoH) servers and canary domains (<a href="https://raw.githubusercontent.com/DNScrypt/dnscrypt-resolvers/master/v2/public-resolvers.md" class="">https://raw.githubusercontent.com/DNScrypt/dnscrypt-resolvers/master/v2/public-resolvers.md</a>). It is very important when you protect your network on DNS to block communications to any 3rd party DNS server your applications or devices may use.</div><div><br class=""></div><div>- <b class="">local.ioc2rpz</b></div><div>Block local, non Internet routable networks and domains (e.g. RFE-1918) to protect against DNS rebinding attack.</div><div><br class=""></div><div>- <b class="">notracking.ioc2rpz</b></div><div>No more ads, tracking and other virtual garbage (<a href="https://github.com/notracking/hosts-blocklists" class="">https://github.com/notracking/hosts-blocklists</a>).</div><div><br class=""></div><div>BR,</div><div>Vadim<br class=""><blockquote type="cite" class=""><div class="">On Jun 3, 2020, at 05:07, Swapneel Patnekar <<a href="mailto:swapneel@brainattic.in" class="">swapneel@brainattic.in</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_default" style=""><font face="georgia, serif" class="">Hello!</font></div><div class="gmail_default" style=""><font face="georgia, serif" class=""><br class=""></font></div><div class="gmail_default" style=""><font face="georgia, serif" class="">I was looking at compiling a list of public/community RPZ feeds. Here are the ones that I am currently using,</font></div><div class="gmail_default" style=""><font face="georgia, serif" class=""><br class=""></font></div><div class="gmail_default" style=""><font face="georgia, serif" class="">1. <a href="https://www.spamhaustech.com/free-trial/sign-up-for-free-dns-firewall-threat-feeds/" class="">https://www.spamhaustech.com/free-trial/sign-up-for-free-dns-firewall-threat-feeds/</a></font></div><div class="gmail_default" style=""><font face="georgia, serif" class="">2. <span style="background-color:transparent;color:inherit;font-size:inherit" class=""><a href="https://urlhaus.abuse.ch/downloads/rpz/" class="">https://urlhaus.abuse.ch/downloads/rpz/</a></span></font></div><div class="gmail_default" style=""><font face="georgia, serif" class=""><span style="background-color:transparent;color:inherit;font-size:inherit" class="">3. </span><a href="https://scripttiger.github.io/alts/rpz/blacklist.txt" class="">https://scripttiger.github.io/alts/rpz/blacklist.txt</a></font></div><div class="gmail_default" style=""><font face="georgia, serif" class=""><br class=""></font></div><div class="gmail_default" style=""><font face="georgia, serif" class="">Any others that you would recommend? Thank you. </font></div><div class=""><font face="georgia, serif" class=""><br class=""></font></div><font face="georgia, serif" class="">-- <br class=""></font><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><font face="georgia, serif" class=""><span style="font-size:small" class="">Best, </span><br class=""></font></div><div style="font-size:small" class=""><font face="georgia, serif" class="">Swapneel</font></div><a href="https://brainattic.in/blog" target="_blank" class=""><font face="georgia, serif" class="">https://brainattic.in/blog</font></a></div></div></div></div></div></div></div>
_______________________________________________<br class="">DNSfirewalls mailing list<br class=""><a href="mailto:DNSfirewalls@lists.redbarn.org" class="">DNSfirewalls@lists.redbarn.org</a><br class="">http://lists.redbarn.org/mailman/listinfo/dnsfirewalls<br class=""></div></blockquote></div><br class=""></body></html>