Where to get list of malicious hosts (sim to spamhaus dshield cymru torlist) and what can replace malwaredomainlist.com?

Hi, I’m looking for maintained malicious hosts/addresses lists and respective fetch/update scripts that will allow me as a home user to harden my security configuration using my mikrotik router.

So far I came by to:

I was planning to add www.malwaredomainlist.com, but from 1st glance it looks like it’s kinda outdated (last host added has Dec 2017 in UTC columnt).
malc0de also seems has retired.

Thus, can you please recommend if there is any other major source of info I’ve missed (that are applicable to home user and frequently updated), and is there any replacement for www.malwaredomainlist.com?

Thanks!

I offer a 10 free trial of my blacklist service … check my sig for links

Thanks for the offer, but so far I’m looking for “free” solutions - as home user without mission critical apps/services in my home network (that is somehow “covered” by my ISP), I think it may be enough to run “community”-level services.

If anything changes, I will be glad to run proposed trial, thank you.

Good luck with that…
The service offered is very cheap for the incredible value. ( A couple of cups of coffee per month !!! )
Compared to what I pay here…
https://axiomcyber.com/shield/
If it wasn’t possible to write it off as business expense I would be using Mozerds advice.
Went the same route as you when I first got my router and quite simply the time spent continually playing with it, after setting it up, and as sites come up and go down…
I do see value in learning more about the routers capabilities but thats about it.

Yep, I’ve checked your price previously and as I already know axiom’s price - those are indeed hard to compare by magnitude, so nothing to argue about if to judge by $:)
Thanks for advise, who knows, maybe I’ll indeed switch to paid one later on (as I do for many products that have “free” alternative).

But as of now I will still try to find relevant services and ask community for advice. At least all those spamhaus/dshield are still alive.

I am using the following. malc0de has not been updated since 16/12/19, but I am still including its content.
I am using PowerShell on a Windows server to grab the lists and host on a local web server, such that I can block any outbound traffic from the router, other than NATed traffic passing through and known IPSec destinations.

I’m having an issue with dshield not downloading through my script, so I am periodically updating that list manually.

http://www.spamhaus.org/drop/drop.txt
http://www.spamhaus.org/drop/edrop.txt
http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist-high.txt
http://malc0de.com/bl/IP_Blacklist.txt
https://sslbl.abuse.ch/blacklist/sslipblacklist.txt
https://dshield.org/block.txt
https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master/firehol_level2.netset

This results in just short of 6,000 address list entries.

Thank you! I will check it out.

One question about “6,000 address list entries” - are you combining them somehow? Source data http://iplists.firehol.org/?ipset=firehol_level2 claims there should be 23K+ ipset entries.

Hmm, compared to the other service with over 600million entries why quibble over a few thousand???

I would doubt that the hex Routerboard can handle that many dynamic address list entries…

Good point. Let me check out what’s going on in my environment with that one and report back.

Concur, but doesnt need to!
“How does MOAB store 615+ million IP addresses you wonder? MOAB consists of ipset that store a large number of IP(v4) addresses – For well provisioned MikroTik Router models MOAB normally contains between 35K and 50K ipset entries and in that mix reside 2,400+ CIDR notations - so you may wonder what do those CIDR notations represent? CIDR notation is a compact representation of an IP address and its associated routing prefix. A CIDR notation entry represents a large collection of IP addresses.”

Exactly…so the point around 600million entries is slightly misleading as plenty of the other lists referenced in the thread are also using subnets in CIDR notation rather than tranches of individual hosts. I have no doubt that MOAB and its various data sources is likely a more extensive list than some of the others mentioned. That doesn’t necessarily negate the value of the others.

Particularly in light of the fact that despite there appearing to be an issue with my script resulting in an incomplete import (without throwing an error), between that configuration, a ‘manual’ blacklist and a block on detected port scanners, I have seen around 80-90% of the malicious traffic that was previously observed and rejected at an application level has disappeared.

I still would like it when the DNS based address list feature would:

  • support more addresses in a single DNS name. limited by memory usage on the router (and thus much higher on CCR etc).
  • support “subnet” results as well as single addresses (e.g. via TXT records containing 1.2.3.0/24 notation)

This would make blocklisting via DNS possible, and as a DNS based entry is only a single configuration item resulting in a number of dynamic address list entries, it is also much more friendly on the flash memory wear and memory usage.

Unfortunately as it is now, a single DNS entry in an address list can only expand to about 500 addresses. There is some hardcoded limit that I would like to set higher.
A workaround is to have several DNS names under the same address list name, together they can hold more entries.
However, there is an issue with updating, as the different entries will not be refreshed at exactly the same time (their timers will wander apart) so when you have a single big address list and you split it in 10 parts and load them via 10 different DNS names, at some point the list will be missing entries temporarily when the big list is updated and changed in DNS.

MOAB for the hEX and the HAP AC2 currently has 7692 ipset entries … the performance hit on the hEX is close to 13% while the HAP AC2 the performance hit is 8%.

For Your Information MOAB for the hEX and the HAP AC2 consists of the following 3 lists that are combined and any duplicates removed.

firehol_level1.netset’ 620,083,167 unique IPs [changes take place every minute]
firehol_webclient.netset 3,777 unique IPs
firehol_webserver.netset 34,672,171 unique IPs

You can go to http://iplists.firehol.org/ and check for yourself how many ip addresses are contained therein … nothing misleading whatsoever.

Currently the size of the MOAB RSC file for the hEX and the HAP AC2 is 329,503 bytes. MOAB changes 3 times each day 8 hours apart depending on adds/deletions that take place dynamically – so whatever changes takes place are caught at each 8 hour interval by my monitoring system

No hEX or HAP AC2 MOAB user has complained of ANY performance issue using MOAB over the past 18 months.
No MikroTik Router MOAB users have complained of ANY performance issue using MOAB over the past 18 months …

For MikroTik Routers like the RB3011, RB4011, RB1100, and all CCR models MOAB RSC file size is currently 2,029,080 bytes that includes the following lists scrubbed to remove duplicate entries:

firehol_level1.netset
firehol_level2.netset
firehol_level3.netset
firehol_webclient.netset
firehol_webserver.netset’

Key POINT to understand about an ipset: ipset is an extension to iptables that allows you to create firewall rules that match entire “sets” of addresses at once. Unlike normal iptables chains, which are stored and traversed linearly, IP sets are stored in indexed data structures, making lookups very efficient, even when dealing with large sets … works remarkable well under RouterOS starting with the hEX, HAP AC2 and all the Router models mentioned above..

http://forum.mikrotik.com/t/blacklist-import-file-size/139344/1

Something new has arrived: 1.1.1.2 and backup 1.0.0.2 malicious DNS filtering servers. Check it out. 1.1.1.3 and 1.0.0.3 are also porn aware for kids protection.

Been using OpenDNS here for years. I have a /29 subnet routed to each of my WAN links, so I srcnat the various LAN subnets to different public IPs, which each have different categories blocked at OpenDNS.

That won’t help you for inbound traffic.

What is your opinion of quad9 9.9.9.9 ??