Decent IPv6 miner

[Brian_Marshall]

Hello all, We use MineMeld with our PA firewalls at work, so I thought I'd try it at home as well, and it was easy to integrate with my OpenBSD PF firewall. Lots of high-quality IPv4 address and subnets to block! However, I also run IPv6 at home and would like to import a decent feed. I already use unbound to blackhole everything in the SomeoneWhoCares list (ads and tracking), which also works for IPv6, but I'd like to use a v6 list for malware, c&c, botnets, known bruteforce nets, etc. I've been looking, but come up empty handed. TAXII has the ipv6 tag, but doesn't appear to actually have any content in v6. Does anyone here know of a decent source I can bring into minemeld? Thanks! -Brian Marshall

[lmori]

Hi @Brian_Marshall,

I haven't found a OSINT feeds providing IPv6 addresses, only commercial feeds. Did you find one ?

Thanks,

luigi

[Brian_Marshall]

Hello Luigi, No unfortunately I never did find any feeds. One line of reasoning I came upon was that the size of the IPV6 address space made it hard to do any kind of filtering, as bad actors would simply hop around too much, or you'd be blocking netblocks that are too big.

[lmori]

Hi @Brian_Marshall,

I think that's true for IPv4 feeds as well, that's why frequency of updates and a proper expiration policy are so important to an effective Threat Intelligence enforcement strategy.

I will check around and let you know if I can find a good IPv6 feed.