ThreatConnect feeds with Minemeld prototypes

David_Avila — Sat, 04 Apr 2020 18:16:28 GMT

Hi, there.. I just set up a ThreatConnect miners using prototype Minemeld premises that query a URL in Threat Connect ... the content of that IPv4 list contains two point IP addresses: 171.100.142.238 and 172.82.152.136. For some strange reason Minemeld summed them up well however added other IP addresses like range: 171.100.142.239-172.82.152.135. This range is neither listed nor those IP addresses. What could have happened?

The miner:

The aggregator type used is: stdlib.aggregatorIPv4Generic

The output type used is: stdlib.feedHCGreen

Anyone knows about this behavior? Thanks!

Re: ThreatConnect feeds with Minemeld prototypes

David_Avila — Sat, 04 Apr 2020 19:57:38 GMT

We saw that in the source list (Threat Connect) were some subnets with netmask / 1 and / 2, and these networks was the problem with the large IP range mentioned in the post above (171.100.142.239-172.82.152.135) and these networks have nothing to do with this range:

45.128.134.20/2
45.88.110.171/2
45.88.110.171/1

Anyone knows?

topic Re: ThreatConnect feeds with Minemeld prototypes in General Topics

ThreatConnect feeds with Minemeld prototypes

Re: ThreatConnect feeds with Minemeld prototypes