0 Fork 0

Files

T

zwitschi 40212d84f7 Refactor copyparty and npm analyzers to use updated imports and remove utils module

Update whois cache with additional IP ranges

2026-08-04 21:56:55 +02:00

cloudflare

Initial commit: intrusion detection system for copyparty and NPM proxy logs with MikroTik blocklist export

2026-08-03 16:34:45 +02:00

openfactory

Initial commit: intrusion detection system for copyparty and NPM proxy logs with MikroTik blocklist export

2026-08-03 16:34:45 +02:00

paloalto

Initial commit: intrusion detection system for copyparty and NPM proxy logs with MikroTik blocklist export

2026-08-03 16:34:45 +02:00

README.md

Move WHOIS cache to data directory and update .gitignore to ignore report directories

2026-08-03 16:39:11 +02:00

whois_cache.json

Refactor copyparty and npm analyzers to use updated imports and remove utils module

2026-08-04 21:56:55 +02:00

README.md

Data directory for allucanget-ids

This directory contains data files used by the allucanget-ids Intrusion Detection System application, including whitelists, blocklists, and other configuration files. The data files are organized into subdirectories for easier management and maintenance.

Data files

whois cache: Local cache of WHOIS queries to reduce network requests and improve performance. The cache is automatically updated when new IP addresses are queried.
Openfactory Geofeed: Contains Openfactory IP addresses and associated geolocation data from https://openfactory.net/geofeed.csv. Used for identifying and whitelisting traffic from known Openfactory sources.
Cloudflare IPv4 list: Contains a list of Cloudflare IPv4 addresses from https://www.cloudflare.com/ips-v4, used for whitelisting traffic from Cloudflare services.
Cloudflare IPv6 list: Contains a list of Cloudflare IPv6 addresses from https://www.cloudflare.com/ips-v6, used for whitelisting traffic from Cloudflare services.
PaloAlto Scanner IP list: List of known PaloAlto scanner IP addresses from https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity, used for whitelisting traffic from PaloAlto scanners.