topic Re: Decent IPv6 miner in General Topics

Decent IPv6 miner

Brian_Marshall — Sun, 05 Nov 2017 02:34:42 GMT

Hello all, We use MineMeld with our PA firewalls at work, so I thought I'd try it at home as well, and it was easy to integrate with my OpenBSD PF firewall. Lots of high-quality IPv4 address and subnets to block! However, I also run IPv6 at home and would like to import a decent feed. I already use unbound to blackhole everything in the SomeoneWhoCares list (ads and tracking), which also works for IPv6, but I'd like to use a v6 list for malware, c&c, botnets, known bruteforce nets, etc. I've been looking, but come up empty handed. TAXII has the ipv6 tag, but doesn't appear to actually have any content in v6. Does anyone here know of a decent source I can bring into minemeld? Thanks! -Brian Marshall

Re: Decent IPv6 miner

lmori — Tue, 14 Nov 2017 05:22:11 GMT

Hi @Brian_Marshall,

I haven't found a OSINT feeds providing IPv6 addresses, only commercial feeds. Did you find one ?

Thanks,

luigi

Re: Decent IPv6 miner

Brian_Marshall — Mon, 04 Dec 2017 22:35:30 GMT

Hello Luigi, No unfortunately I never did find any feeds. One line of reasoning I came upon was that the size of the IPV6 address space made it hard to do any kind of filtering, as bad actors would simply hop around too much, or you'd be blocking netblocks that are too big.

Re: Decent IPv6 miner

lmori — Tue, 26 Dec 2017 07:47:43 GMT

Hi @Brian_Marshall,

I think that's true for IPv4 feeds as well, that's why frequency of updates and a proper expiration policy are so important to an effective Threat Intelligence enforcement strategy.

I will check around and let you know if I can find a good IPv6 feed.