topic Re: Missing IP's in Minemeld feed in General Topics

Missing IP's in Minemeld feed

raji_toor — Tue, 11 Sep 2018 20:33:32 GMT

We pull Zeus IP's using minemeld. Statics page shows the current number of IP' 109, which is the same as hosted on this URL.

https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist

Every few months i got notified to comunication with one of theses IP's and when i check the zeustracker.abuse.ch shows the IP in the list but the output is missing that IP. If I create a new miner i can see that IP again. I don't know why it gets removed. below are the attributes of the prototype.

Re: Missing IP's in Minemeld feed

xhoms — Wed, 12 Sep 2018 11:09:06 GMT

Hi @raji_toor,

the Zeus prototypes in the standard library do no specify any aging timeout policy. That means that nodes cloning such a protorype will use the "default" ageout policy which hapens to expire indicators 30 days after first seen in the feed.

If you need to keep the indicators for a longer period then you must create a new prototype with your specific age out policy.

Re: Missing IP's in Minemeld feed

raji_toor — Wed, 12 Sep 2018 15:43:08 GMT

@xhoms So does changing it to below, fix the age_out