Merge branch 'main' into warninglists/rewrite-google-generator

Author: adulau

README.md

@@ -19,6 +19,8 @@ There is also a standalone software project called [misp-feedback](https://githu
 - [alphastrike-research-nt-scanning/list.json](./lists/alphastrike-research-nt-scanning/list.json) - **Alphastrike research IP Ranges Used for Scanning** - _List containing IP's associated with the Alphastrike research scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/08/10_
 - [alphastrike-scanning/list.json](./lists/alphastrike-scanning/list.json) - **Alpha Strike Labs IP Ranges Used for Scanning** - _List containing IP ranges associated with Alpha Strike Labs scanning infrastructure. Alpha Strike Labs GmbH (AS208843) operates legitimate security research and internet-wide scanning services [https://ipinfo.io/AS208843]_
 - [amazon-aws/list.json](./lists/amazon-aws/list.json) - **List of known Amazon AWS IP address ranges** - _Amazon AWS IP address ranges (https://ip-ranges.amazonaws.com/ip-ranges.json)_
+- [apple-ipv4/list.json](./lists/apple-ipv4/list.json) - **List of known Apple IPv4 ranges** - _Apple IPv4 ranges announced by AS714 and AS6185_
+- [apple-ipv6/list.json](./lists/apple-ipv6/list.json) - **List of known Apple IPv6 ranges** - _Apple IPv6 ranges announced by AS714 and AS6185_
 - [apple/list.json](./lists/apple/list.json) - **List of known Apple IP ranges** - _IP ranges assigned to Apple_
 - [automated-malware-analysis/list.json](./lists/automated-malware-analysis/list.json) - **List of known domains used by automated malware analysis services & security vendors** - _Domains used by automated malware analysis services & security vendors_
 - [bank-website/list.json](./lists/bank-website/list.json) - **List of known bank domains** - _Event contains one or more entries of known banking website_
@@ -31,6 +33,7 @@ There is also a standalone software project called [misp-feedback](https://githu
 - [circl-ssh-scanning/list.json](./lists/circl-ssh-scanning/list.json) - **CIRCL IP address used for SSH scanning** - _CIRCL IP address to conducting non-intrusive SSH scans_
 - [cisco_top1000/list.json](./lists/cisco_top1000/list.json) - **Top 1000 websites from Cisco Umbrella** - _Event contains one or more entries from the top 1000 of the most used websites (Cisco Umbrella)._
 - [cisco_top10k/list.json](./lists/cisco_top10k/list.json) - **Top 10 000 websites from Cisco Umbrella** - _Event contains one or more entries from the top 10 000 of the most used websites (Cisco Umbrella)._
+- [cisco_top1m/list.json](./lists/cisco_top1m/list.json) - **Top 1 000 000 websites from Cisco Umbrella** - _Event contains one or more entries from the top 1 000 000 of the most used websites (Cisco Umbrella)._
 - [cisco_top20k/list.json](./lists/cisco_top20k/list.json) - **Top 20 000 websites from Cisco Umbrella** - _Event contains one or more entries from the top 20 000 of the most used websites (Cisco Umbrella)._
 - [cisco_top5k/list.json](./lists/cisco_top5k/list.json) - **Top 5000 websites from Cisco Umbrella** - _Event contains one or more entries from the top 5000 of the most used websites (Cisco Umbrella)._
 - [cloudflare-top100k/list.json](./lists/cloudflare-top100k/list.json) - **Top 100,000 domains from Cloudflare Radar** - _List of top 100,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)_
@@ -59,6 +62,7 @@ There is also a standalone software project called [misp-feedback](https://githu
 - [dax30/list.json](./lists/dax30/list.json) - **List of known dax30 webpages** - _Event contains one or more entries of known dax30 webpages_
 - [digitalside/list.json](./lists/digitalside/list.json) - **OSINT.DigitalSide.IT Warning List** - _OSINT DigitalSide Threat-Intel Repository - MISP Warninglist - List of domains should be marked as false positive in the related MISP event with IDS attribute not flagged_
 - [disposable-email/list.json](./lists/disposable-email/list.json) - **List of disposable email domains** - _List of disposable email domains_
+- [driftnet/list.json](./lists/driftnet/list.json) - **List of known Driftnet / Internet-Measurement IP ranges (https://internet-measurement.com/)** - _Driftnet / Internet-Measurement IP address ranges (https://internet-measurement.com/)_
 - [dynamic-dns/list.json](./lists/dynamic-dns/list.json) - **List of known dynamic DNS domains** - _Event contains one or more entries of known dynamic DNS domains._
 - [eicar.com/list.json](./lists/eicar.com/list.json) - **List of hashes for EICAR test virus** - _Event contains one or more entries based on hashes for EICAR test virus_
 - [empty-hashes/list.json](./lists/empty-hashes/list.json) - **List of known hashes for empty files** - _Event contains one or more entries of empty files based on known hashed_
@@ -92,6 +96,7 @@ There is also a standalone software project called [misp-feedback](https://githu
 - [microsoft-office365-ip/list.json](./lists/microsoft-office365-ip/list.json) - **List of known Office 365 IP address ranges** - _Office 365 IP address ranges_
 - [microsoft-office365/list.json](./lists/microsoft-office365/list.json) - **List of known Office 365 URLs** - _Office 365 URLs and IP address ranges_
 - [microsoft-win10-connection-endpoints/list.json](./lists/microsoft-win10-connection-endpoints/list.json) - **List of known Windows 10 connection endpoints** - _Event contains one or more entries of known Windows 10 connection endpoints (https://docs.microsoft.com/en-us/windows/privacy/manage-windows-endpoints)_
+- [microsoft-win11-connection-endpoints/list.json](./lists/microsoft-win11-connection-endpoints/list.json) - **List of known Windows 11 connection endpoints** - _Event contains one or more entries of known Windows 11 connection endpoints (https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints)_
 - [microsoft/list.json](./lists/microsoft/list.json) - **List of known microsoft domains** - _Event contains one or more entries of known microsoft domains_
 - [modat-nt-scanning/list.json](./lists/modat-nt-scanning/list.json) - **Modat IP Ranges Used for Scanning** - _List containing IP's associated with the Modat scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/08/10_
 - [modat-scanner/list.json](./lists/modat-scanner/list.json) - **List of published IP address ranges for Modat Scanner** - _Modat Scanner (https://www.modat.io/)_

generate_all.sh

@@ -6,26 +6,31 @@ set -x
 pushd tools
 # python3 generate_alexa.py  # not updated since February 1, 2023 and offline after July 31, 2023
 python3 generate-amazon-aws.py
+python3 generate-oracle-oci.py
+python3 generate-apple-ip-ranges.py
 python3 generate-cisco.py
 python3 generate-cloudflare.py
+python3 generate-fastly.py
+#python3 generate-cloudflare-top-domains.py  # requires a CLOUDFLARE_API_TOKEN env var (Cloudflare Radar API); raises KeyError: 'CLOUDFLARE_API_TOKEN' when unset
 python3 generate-covid.py
 python3 generate-crl-ip-domains.py
 python3 generate-disposal.py
 python3 generate-google.py
-#python3 generate_majestic-million.py -n 10000
-#python3 generate-microsoft-azure.py
+python3 generate_majestic-million.py -n 10000
+python3 generate-microsoft-azure.py
 # See https://github.com/MISP/misp-warninglists/issues/319
 python3 generate_mozilla_certificates.py
 python3 generate_moz-top500.py
 python3 generate-office365.py
 python3 generate_phone_numbers.py
-#python3 generate-publicdns.py
-#python3 generate-stackpath.py
+#python3 generate-stackpath.py  # source https://k3t9x2h3.map2.ssl.hwcdn.net/ipblocks.txt is dead (NXDOMAIN); StackPath wound down its CDN and hwcdn.net is now a parked domain-for-sale page
 python3 generate-tlds.py
 python3 generate-github.py
-#python3 generate_tranco.py
+python3 generate-public-ipfs-gateways.py
+python3 generate_tranco.py
 python3 generate-university-domain-list.py
 # python3 generate-windows-binary-hashes.py  # ON HOLD DUE TO https://github.com/m417z/winbindex/commit/24dd6995fd1c8eacbf59b5ce658d34ccf00bae00
+python3 generate-microsoft-win11-endpoints.py
 python3 generate-vpn.py
 python3 generate-wikimedia.py
 python3 generate-second-level-tlds.py
@@ -37,18 +42,20 @@ python3 generate-tenable.py
 python3 generate-microsoft-azure-appid.py
 python3 generate-chrome-crux-1m.py
 python3 generate-digitalside.py
-#python3 generate-gptbot.py
+python3 generate-gptbot.py
 python3 generate-cisco-umbrella-blockpage.py
 python3 generate-zscaler.py
 python3 generate-onyphe-scanner.py
 python3 generate-modat-scanner.py
 python3 generate-internetcleanup-scanner.py
-#python3 generate-umich-cse-connection-attempts.py # ON HOLD DUE TO 403 (due to User-Agent)
-python3 generate-icloud-private-relay.py
+python3 generate-driftnet.py
+#python3 generate-umich-cse-connection-attempts.py # ON HOLD: source protected by Cloudflare managed JS challenge (HTTP 403, Cf-Mitigated: challenge header) as of 2026-08-29; not a User-Agent issue, requests-based fetch cannot pass itpython3 generate-icloud-private-relay.py
 python3 generate-bunny-net.py
 python3 generate-ovh.py
 python3 generate-microsoft-mdca.py
 python3 generate-palo-alto-networks-cortex-cloud.py
+python3 generate-lots-project.py
+python3 generate-check-host-net.py
 popd
 
 ./jq_all_the_things.sh

lists/apple-ipv4/list.json

@@ -0,0 +1,20 @@
+{
+  "description": "Apple IPv4 ranges announced by AS714 and AS6185",
+  "list": [
+    "139.178.128.0/18",
+    "144.178.0.0/18",
+    "17.0.0.0/8",
+    "57.102.0.0/15",
+    "65.199.22.0/23"
+  ],
+  "matching_attributes": [
+    "ip-src",
+    "ip-dst",
+    "domain|ip",
+    "ip-src|port",
+    "ip-dst|port"
+  ],
+  "name": "List of known Apple IPv4 ranges",
+  "type": "cidr",
+  "version": 20260829
+}

lists/apple-ipv6/list.json

@@ -0,0 +1,20 @@
+{
+  "description": "Apple IPv6 ranges announced by AS714 and AS6185",
+  "list": [
+    "2403:300::/32",
+    "2620:0:1b00::/48",
+    "2620:149::/32",
+    "2a01:b740::/32",
+    "2a01:b747::/32"
+  ],
+  "matching_attributes": [
+    "ip-src",
+    "ip-dst",
+    "domain|ip",
+    "ip-src|port",
+    "ip-dst|port"
+  ],
+  "name": "List of known Apple IPv6 ranges",
+  "type": "cidr",
+  "version": 20260829
+}

lists/automated-malware-analysis/list.json

@@ -36,5 +36,5 @@
   ],
   "name": "List of known domains used by automated malware analysis services & security vendors",
   "type": "substring",
-  "version": 5
+  "version": 20200403
 }

lists/bank-website/list.json

@@ -2236,5 +2236,5 @@
   ],
   "name": "List of known bank domains",
   "type": "hostname",
-  "version": 9
+  "version": 20260414
 }

lists/check-host-net/list.json

@@ -2,54 +2,72 @@
   "description": "check-host IP addresses (https://check-host.net/nodes/ips)",
   "list": [
     "103.214.169.52/32",
+    "103.42.116.205/32",
+    "104.28.192.94/32",
+    "107.149.201.15/32",
+    "107.181.134.162/32",
+    "141.255.165.104/32",
     "141.98.234.68/32",
-    "167.235.135.184/32",
-    "170.205.54.119/32",
+    "142.132.174.167/32",
+    "143.246.193.61/32",
+    "147.45.60.14/32",
+    "151.243.12.65/32",
+    "157.254.174.204/32",
+    "162.217.248.181/32",
     "178.17.171.235/32",
-    "178.216.200.169/32",
-    "179.43.148.195/32",
+    "178.239.146.199/32",
+    "178.83.180.17/32",
+    "181.214.10.239/32",
     "185.105.238.209/32",
     "185.120.77.165/32",
     "185.130.104.238/32",
-    "185.138.164.21/32",
-    "185.143.223.66/32",
-    "185.185.132.232/32",
-    "185.209.161.169/32",
-    "185.230.55.13/32",
-    "185.24.253.139/32",
+    "185.209.161.145/32",
+    "185.221.199.82/32",
+    "185.224.3.111/32",
+    "185.23.17.21/32",
+    "185.244.28.180/32",
     "185.25.204.60/32",
     "185.37.147.117/32",
-    "185.39.205.237/32",
     "185.83.213.25/32",
     "185.86.77.126/32",
-    "193.8.95.39/32",
     "194.146.57.64/32",
+    "194.26.100.165/32",
     "194.26.229.20/32",
+    "195.137.244.1/32",
+    "195.137.245.1/32",
     "195.154.114.92/32",
+    "195.182.38.164/32",
+    "195.211.24.52/32",
     "195.211.27.85/32",
-    "209.14.69.16/32",
+    "195.234.80.20/32",
+    "198.135.169.20/32",
+    "217.15.166.168/32",
     "38.145.202.12/32",
-    "45.12.81.15/32",
-    "45.141.149.25/32",
-    "45.146.7.45/32",
-    "45.95.168.235/32",
-    "5.159.54.120/32",
-    "5.44.42.40/32",
+    "45.135.242.142/32",
+    "45.162.230.209/32",
+    "45.252.248.142/32",
+    "45.9.168.235/32",
+    "64.72.205.76/32",
     "65.109.182.130/32",
-    "77.75.230.51/32",
+    "77.104.108.3/32",
     "77.92.151.181/32",
-    "88.119.179.10/32",
-    "91.102.183.15/32",
+    "78.40.111.151/32",
+    "83.143.119.103/32",
+    "88.135.75.5/32",
+    "91.102.127.2/32",
+    "91.199.41.138/32",
     "91.231.182.39/32",
-    "92.223.65.81/32",
-    "93.123.16.89/32"
+    "93.123.16.89/32",
+    "94.154.123.196/32"
   ],
   "matching_attributes": [
     "ip-src",
     "ip-dst",
-    "domain|ip"
+    "domain|ip",
+    "ip-src|port",
+    "ip-dst|port"
   ],
   "name": "List of known check-host.net IP address ranges",
   "type": "cidr",
-  "version": 20240402
+  "version": 20260829
 }