{"id":25532440,"url":"https://github.com/curbengh/botnet-filter","last_synced_at":"2025-04-11T11:35:45.677Z","repository":{"id":98810845,"uuid":"581977937","full_name":"curbengh/botnet-filter","owner":"curbengh","description":"Mirror of https://gitlab.com/malware-filter/botnet-filter","archived":false,"fork":false,"pushed_at":"2025-04-10T00:22:10.000Z","size":46,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-10T01:26:46.411Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/curbengh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-12-25T06:10:42.000Z","updated_at":"2025-02-16T01:32:07.000Z","dependencies_parsed_at":"2023-12-19T03:26:12.671Z","dependency_job_id":"95ee8265-c8f8-4a35-944b-3cf6c39e54a0","html_url":"https://github.com/curbengh/botnet-filter","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/curbengh%2Fbotnet-filter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/curbengh%2Fbotnet-filter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/curbengh%2Fbotnet-filter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/curbengh%2Fbotnet-filter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/curbengh","download_url":"https://codeload.github.com/curbengh/botnet-filter/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248384622,"owners_count":21094747,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-02-20T01:49:17.959Z","updated_at":"2025-04-11T11:35:45.650Z","avatar_url":"https://github.com/curbengh.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Botnet IP Blocklist\n\n- Formats\n  - [IP-based](#ip-based)\n  - [Domain-based (AdGuard Home)](#domain-based-adguard-home)\n  - [IP-based (AdGuard)](#ip-based-adguard)\n  - [IP-based (Vivaldi)](#ip-based-vivaldi)\n  - [dnscrypt-proxy](#dnscrypt-proxy)\n  - [Snort2](#snort2)\n  - [Snort3](#snort3)\n  - [Suricata](#suricata)\n  - [Splunk](#splunk)\n  - [htaccess](#htaccess)\n- [Compressed version](#compressed-version)\n- [Reporting issues](#issues)\n- [FAQ and Guides](#faq-and-guides)\n- [CI Variables](#ci-variables)\n- [License](#license)\n\nA blocklist of botnet IPs, based on the **Botnet C2 IOCs** of Abuse.ch [Feodo Tracker](https://feodotracker.abuse.ch/blocklist/#iocs), including online and offline entries. Blocklist is updated twice a day.\n\nThis blocklist is only useful as a last line of defence _after_ being infected. To avoid infection in the first place, consider using [urlhaus-filter](https://gitlab.com/malware-filter/urlhaus-filter).\n\n| Client | mirror 1 | mirror 2 | mirror 3 | mirror 4 | mirror 5 | mirror 6 |\n| --- | --- | --- | --- | --- | --- | --- |\n| uBlock Origin, [IP-based](#ip-based) | [link](https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt) | [link](https://curbengh.github.io/malware-filter/botnet-filter.txt) | [link](https://curbengh.github.io/botnet-filter/botnet-filter.txt) | [link](https://malware-filter.gitlab.io/botnet-filter/botnet-filter.txt) | [link](https://malware-filter.pages.dev/botnet-filter.txt) | [link](https://botnet-filter.pages.dev/botnet-filter.txt) |\n| [AdGuard Home](#domain-based-adguard-home) | [link](https://malware-filter.gitlab.io/malware-filter/botnet-filter-agh.txt) | [link](https://curbengh.github.io/malware-filter/botnet-filter-agh.txt) | [link](https://curbengh.github.io/botnet-filter/botnet-filter-agh.txt) | [link](https://malware-filter.gitlab.io/botnet-filter/botnet-filter-agh.txt) | [link](https://malware-filter.pages.dev/botnet-filter-agh.txt) | [link](https://botnet-filter.pages.dev/botnet-filter-agh.txt) |\n| [AdGuard (browser extension)](#ip-based-adguard) | [link](https://malware-filter.gitlab.io/malware-filter/botnet-filter-ag.txt) | [link](https://curbengh.github.io/malware-filter/botnet-filter-ag.txt) | [link](https://curbengh.github.io/botnet-filter/botnet-filter-ag.txt) | [link](https://malware-filter.gitlab.io/botnet-filter/botnet-filter-ag.txt) | [link](https://malware-filter.pages.dev/botnet-filter-ag.txt) | [link](https://botnet-filter.pages.dev/botnet-filter-ag.txt) |\n| [Vivaldi](#ip-based-vivaldi) | [link](https://malware-filter.gitlab.io/malware-filter/botnet-filter-vivaldi.txt) | [link](https://curbengh.github.io/malware-filter/botnet-filter-vivaldi.txt) | [link](https://curbengh.github.io/botnet-filter/botnet-filter-vivaldi.txt) | [link](https://malware-filter.gitlab.io/botnet-filter/botnet-filter-vivaldi.txt) | [link](https://malware-filter.pages.dev/botnet-filter-vivaldi.txt) | [link](https://botnet-filter.pages.dev/botnet-filter-vivaldi.txt) |\n| [dnscrypt-proxy](#dnscrypt-proxy) | [link](https://malware-filter.gitlab.io/malware-filter/botnet-filter-dnscrypt-blocked-ips.txt) | [link](https://curbengh.github.io/malware-filter/botnet-filter-dnscrypt-blocked-ips.txt) | [link](https://curbengh.github.io/botnet-filter/botnet-filter-dnscrypt-blocked-ips.txt) | [link](https://malware-filter.gitlab.io/botnet-filter/botnet-filter-dnscrypt-blocked-ips.txt) | [link](https://malware-filter.pages.dev/botnet-filter-dnscrypt-blocked-ips.txt) | [link](https://botnet-filter.pages.dev/botnet-filter-dnscrypt-blocked-ips.txt) |\n| [Snort2](#snort2), [Snort3](#snort3), [Suricata](#suricata) | [link](https://malware-filter.gitlab.io/malware-filter/botnet-filter-suricata.rules) | [link](https://curbengh.github.io/malware-filter/botnet-filter-suricata.rules) | [link](https://curbengh.github.io/botnet-filter/botnet-filter-suricata.rules) | [link](https://malware-filter.gitlab.io/botnet-filter/botnet-filter-suricata.rules) | [link](https://malware-filter.pages.dev/botnet-filter-suricata.rules) | [link](https://botnet-filter.pages.dev/botnet-filter-suricata.rules) |\n| [Splunk](#splunk) | [link](https://malware-filter.gitlab.io/malware-filter/botnet-filter-splunk.csv) | [link](https://curbengh.github.io/malware-filter/botnet-filter-splunk.csv) | [link](https://curbengh.github.io/botnet-filter/botnet-filter-splunk.csv) | [link](https://malware-filter.gitlab.io/botnet-filter/botnet-filter-splunk.csv) | [link](https://malware-filter.pages.dev/botnet-filter-splunk.csv) | [link](https://botnet-filter.pages.dev/botnet-filter-splunk.csv) |\n| [Apache](#htaccess) | [link](https://malware-filter.gitlab.io/malware-filter/botnet-filter-htaccess.txt) | [link](https://curbengh.github.io/malware-filter/botnet-filter-htaccess.txt) | [link](https://curbengh.github.io/botnet-filter/botnet-filter-htaccess.txt) | [link](https://malware-filter.gitlab.io/botnet-filter/botnet-filter-htaccess.txt) | [link](https://malware-filter.pages.dev/botnet-filter-htaccess.txt) | [link](https://botnet-filter.pages.dev/botnet-filter-htaccess.txt) |\n\nFor other programs, see [Compatibility](https://gitlab.com/malware-filter/malware-filter/wikis/compatibility) page in the wiki.\n\nCheck out my other filters:\n\n- [urlhaus-filter](https://gitlab.com/malware-filter/urlhaus-filter)\n- [phishing-filter](https://gitlab.com/malware-filter/phishing-filter)\n- [tracking-filter](https://gitlab.com/malware-filter/tracking-filter)\n- [vn-badsite-filter](https://gitlab.com/malware-filter/vn-badsite-filter)\n\n## IP-based\n\nI highly recommend to use the upstream version (update every 5 minutes): [online+offline](https://feodotracker.abuse.ch/downloads/ipblocklist.txt) or [online only](https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt).\n\nImport the link into uBO's filter list to subscribe.\n\n\u003c/details\u003e\n\n## IP-based (AdGuard)\n\nImport the link into AdGuard browser extension to subscribe.\n\n## IP-based (Vivaldi)\n\n_Requires Vivaldi Desktop/Android 3.3+, blocking level must be at least \"Block Trackers\"_\n\nImport the link into Vivaldi's **Tracker Blocking Sources** to subscribe.\n\n## Domain-based (AdGuard Home)\n\n## dnscrypt-proxy\n\nSave the rulesets to \"/etc/dnscrypt-proxy/\". Refer to this [guide](https://gitlab.com/malware-filter/malware-filter/wikis/update-filter) for auto-update.\n\nConfigure dnscrypt-proxy to use the blocklist:\n\n```diff\n[blocked_ips]\n+  blocked_ips_file = '/etc/dnscrypt-proxy/botnet-filter-dnscrypt-blocked-ips.txt'\n```\n\n## Snort2\n\nI highly recommend to use the [upstream version](https://feodotracker.abuse.ch/blocklist/#ip-ids) which is updated every 5 minutes.\n\nSave the ruleset to \"/etc/snort/rules/botnet-filter-suricata.rules\". Refer to this [guide](https://gitlab.com/malware-filter/malware-filter/wikis/update-filter) for auto-update. Snort 2, 3 and Suricata use the same ruleset for this blocklist.\n\nConfigure Snort to use the ruleset:\n\n`printf \"\\ninclude \\$RULE_PATH/botnet-filter-suricata.rules\\n\" \u003e\u003e /etc/snort/snort.conf`\n\n## Snort3\n\nI highly recommend to use the [upstream version](https://feodotracker.abuse.ch/blocklist/#ip-ids) which is updated every 5 minutes.\n\nSave the ruleset to \"/etc/snort/rules/botnet-filter-suricata.rules\". Refer to this [guide](https://gitlab.com/malware-filter/malware-filter/wikis/update-filter) for auto-update. Snort 2, 3 and Suricata use the same ruleset for this blocklist.\n\nConfigure Snort to use the ruleset:\n\n```diff\n# /etc/snort/snort.lua\nips =\n{\n  variables = default_variables,\n+  include = 'rules/botnet-filter-suricata.rules'\n}\n```\n\n## Suricata\n\nI highly recommend to use the [upstream version](https://feodotracker.abuse.ch/blocklist/#ip-ids) which is updated every 5 minutes.\n\nSave the ruleset to \"/etc/suricata/rules/botnet-filter-suricata.rules\". Refer to this [guide](https://gitlab.com/malware-filter/malware-filter/wikis/update-filter) for auto-update. Snort 2, 3 and Suricata use the same ruleset for this blocklist.\n\nConfigure Suricata to use the ruleset:\n\n```diff\n# /etc/suricata/suricata.yaml\nrule-files:\n  - local.rules\n+  - botnet-filter-suricata.rules\n```\n\n## Splunk\n\nA CSV file for Splunk [lookup](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutlookupsandfieldactions).\n\nEither upload the file via GUI or save the file in `$SPLUNK_HOME/Splunk/etc/system/lookups` or app-specific `$SPLUNK_HOME/etc/YourApp/apps/search/lookups`.\n\nOr use [malware-filter add-on](https://splunkbase.splunk.com/app/6970) to install this lookup and optionally auto-update it.\n\nColumns:\n\n| ip | message | updated |\n| --- | --- | --- |\n| 1.2.3.4 | botnet-filter botnet IP detected | 2022-12-21T12:34:56Z |\n\n## htaccess\n\nIn Apache configuration, add `AllowOverride All` to each `\u003cDirectory\u003e`, then add .htaccess to each site directory.\n\n## Compressed version\n\nAll filters are also available as gzip- and brotli-compressed.\n\n- Gzip: https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt.gz\n- Brotli: https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt.br\n- Zstd: https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt.zst\n\n## Issues\n\nThis blocklist **only** accepts new malicious IPs from [Feodo Tracker](https://feodotracker.abuse.ch/).\n\n## FAQ and Guides\n\nSee [wiki](https://gitlab.com/malware-filter/malware-filter/-/wikis/home)\n\n## CI Variables\n\nOptional variables:\n\n- `CLOUDFLARE_BUILD_HOOK`: Deploy to Cloudflare Pages.\n- `NETLIFY_SITE_ID`: Deploy to Netlify.\n\n## Repository Mirrors\n\nhttps://gitlab.com/curben/blog#repository-mirrors\n\n## License\n\n[Creative Commons Zero v1.0 Universal](LICENSE-CC0.md) and [MIT License](LICENSE)\n\n[Feodo Tracker](https://feodotracker.abuse.ch/): [CC0](https://creativecommons.org/publicdomain/zero/1.0/)\n\nThis repository is not endorsed by Abuse.ch.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcurbengh%2Fbotnet-filter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcurbengh%2Fbotnet-filter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcurbengh%2Fbotnet-filter/lists"}