Initial commit: intrusion detection system for copyparty and NPM proxy logs with MikroTik blocklist export

2026-08-03 16:34:45 +02:00
commit 15019de3d8
@@ -0,0 +1,10 @@
+# Data directory for allucanget-ids
+
+This directory contains data files used by the `allucanget-ids` Intrusion Detection System application, including whitelists, blocklists, and other configuration files. The data files are organized into subdirectories for easier management and maintenance.
+
+## Data files
+
+- [Openfactory Geofeed](./openfactory/geofeed.csv): Contains Openfactory IP addresses and associated geolocation data from `https://openfactory.net/geofeed.csv`. Used for identifying and whitelisting traffic from known Openfactory sources.
+- [Cloudflare IPv4 list](./cloudflare/ips-v4.txt): Contains a list of Cloudflare IPv4 addresses from `https://www.cloudflare.com/ips-v4`, used for whitelisting traffic from Cloudflare services.
+- [Cloudflare IPv6 list](./cloudflare/ips-v6.txt): Contains a list of Cloudflare IPv6 addresses from `https://www.cloudflare.com/ips-v6`, used for whitelisting traffic from Cloudflare services.
+- [PaloAlto Scanner IP list](./paloalto/scanner-ips.txt): List of known PaloAlto scanner IP addresses from `https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity`, used for whitelisting traffic from PaloAlto scanners.
@@ -0,0 +1 @@
+$ = cloudflare
@@ -0,0 +1,15 @@
+173.245.48.0/20
+103.21.244.0/22
+103.22.200.0/22
+103.31.4.0/22
+141.101.64.0/18
+108.162.192.0/18
+190.93.240.0/20
+188.114.96.0/20
+197.234.240.0/22
+198.41.128.0/17
+162.158.0.0/15
+104.16.0.0/13
+104.24.0.0/14
+172.64.0.0/13
+131.0.72.0/22
@@ -0,0 +1,7 @@
+2400:cb00::/32
+2606:4700::/32
+2803:f800::/32
+2405:b500::/32
+2405:8100::/32
+2a06:98c0::/29
+2c0f:f248::/32
@@ -0,0 +1 @@
+$ = openfactory
@@ -0,0 +1,46 @@
+45.11.248.0/23,DE,DE-HE,Frankfurt Am Main,
+45.11.250.0/24,NL,NL-NH,Amsterdam,
+45.11.251.0/24,AT,AT-9,Vienna,
+2a0e:8f04::/32,DE,DE-HE,Frankfurt Am Main,
+2a0e:8f05::/32,GB,GB-LND,London,
+2a0e:8f06::/32,NL,NL-NH,Amsterdam,
+2a0e:8f07::/32,AT,AT-9,Vienna,
+5.226.144.0/21,CH,CH-TG,Frauenfeld,
+5.226.144.192/26,CH,CH-ZH,Winterthur,
+5.226.145.0/26,CH,CH-ZH,Wangen-Bruettisellen,
+5.226.145.64/26,LI,LI-07,Schaan,
+5.226.145.128/25,CH,CH-ZH,Kloten,
+5.226.148.0/29,CH,CH-ZH,Zurich,
+5.226.148.8/29,CH,CH-ZH,Kloten,
+5.226.148.16/28,CH,CH-ZH,Zurich,
+5.226.148.32/27,CH,CH-ZH,Kloten,
+5.226.148.64/26,CH,CH-ZH,Zurich,
+5.226.148.96/27,CH,CH-ZH,Zurich,
+5.226.148.128/25,CH,CH-ZH,Zurich,
+5.226.149.0/26,CH,CH-ZH,Zurich,
+5.226.149.64/28,CH,CH-LU,Lutzern,
+5.226.149.128/26,CH,CH-ZH,Glattfelden,
+5.226.149.240/30,CH,CH-SZ,Wollerau,
+5.226.150.0/27,CH,CH-ZH,Glattfelden,
+5.226.150.32/27,CH,CH-BE,Biel,
+5.226.150.152/29,LI,LI-07,Schaan,
+5.226.150.160/28,CH,CH-ZH,Winterthur,
+5.226.150.224/27,CH,CH-BE,Bern,
+5.226.151.0/26,NL,NL-NH,Amsterdam,
+5.226.151.64/27,CH,CH-ZH,Ruemlang,
+185.86.228.0/23,CH,CH-ZH,Zurich,
+195.138.203.0/24,CH,CH-ZH,Zurich,
+2a00:6340::/32,CH,CH-TG,Frauenfeld,
+2a00:6340:2080::/48,NL,NL-NH,Amsterdam,
+2001:67c:2648::/48,CH,CH-ZH,Winterthur,
+
+# Customer geofeed details on request
+# Having issues with your geolocation? send us a ticket!
+
+45.11.248.94/32,DE,DE-NW,Dortmund,
+2a00:6340:2044:200::/56,DE,DE-NW,Dortmund,
+2a00:6340:2044:600::/56,DE,DE-BW,Stuttgart,
+45.11.248.96/32,DE,DE-BW,Stuttgart,
+45.11.248.37/32,DE,DE-BE,Berlin,
+2a00:6340:2044:800::/56,DE,DE-BE,Berlin,
+5.226.146.49/32,CH,CH-ZH,Winterthur,8405,47.472502,8.779930
@@ -0,0 +1 @@
+$ = paloalto
@@ -0,0 +1,12 @@
+35.203.210.0/23
+144.86.173.0/24
+147.185.132.0/23
+162.216.149.0/24
+162.216.150.0/24
+172.105.147.0/24
+198.235.24.0/24
+205.210.31.0/24
+216.25.88.0/21
+2604:a940:300:5b6:0:0:0:0/64 
+2604:a940:301:225:0:0:0:0/64 
+2604:a940:302:118:0:0:0:0/64