curi0usJack/.htaccess

Maybe add the following also..

    # Slack Bot
    RewriteCond                             %{HTTP_USER_AGENT}                      ^Slackbot-LinkExpanding.*$
    RewriteRule                             ^.*$                                    https://www.slack.com [L,R=302]

@jllang320 - thanks!

Is there an error on line 957 with the " [OR] " at the end of that line?

@jllang320 - yep. fixed! btw - do you have any idea how weird it is to talk to the only other jlang in infosec?

Yes, I suppose you do. :-)

I'd make sure the list updates as the list of exit nodes may update - for instance I was doing that for a while and am no longer.

@curiousjack - Yea it is kind of weird and cool at the sametime.

Awesome, work! Here's a few more for your list:

195.189.155.0/24 # BitDefender
91.199.104.0/24 # BitDefender
91.212.136.0/24 # IKARUS Security Software
208.90.236.0/22 # Trustwave Holdings, Inc.
204.13.200.0/22 # Trustwave Holdings, Inc.
207.102.138.0/24, FORTINET TECHNOLOGIES (CANADA) INC
208.87.232.0/21 # SurfControl, Inc.
103.245.47.20 # McAfee Software (India) Private Limited
182.75.165.176/30 # NETSKOPE

Thanks @ztgrace! Added.

Added fine grained Azure & AWS ranges. Still had to make some assumptions with /16s but way better than before.

Updated to include lists from Matt Kelly: https://twitter.com/breakersall/status/1105967605230256128

Heres a few more from that same thread https://twitter.com/fuzzzynoise/status/1105959396851486720

Palo Alto - 70.42.131.0/24
Palo Alto - 70.42.131.0/24
Palo Alto - 64.74.215.0/24
Palo Alto - 65.154.226.0/24
Forcepoint - 85.115.60.0/24
Forcepoint - 208.87.232.0/21

Zscaler - 104.129.204.0/24

@jakxx - updated.. thanks!

If you use a Define variable it would be much easier to maintain for some slightly more opsec style redirects rather than just trolling with apple.com etc :) https://gist.github.com/Meatballs1/fe50ad25ef6e0225f8b1f7f84aa37d83

You may not want to include %{REQUEST_URI} however.

@Meatballs1 - killer change. Included it & updated the gist. Thanks!

VirusTotal Cloud URL scanning indicators

Note the virustotal string and bing referrer header

"Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) AppEngine-Google; (+http://code.google.com/appengine; appid: s~virustotalcloud)"
"Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET CLR 1.0.3705; .NET CLR 1.1.4322)"
"Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) AppEngine-Google; (+http://code.google.com/appengine; appid: s~virustotalcloud)"```

Mimecast related IPs below. Only saw their URL preview/analysis from the addresses starting with 204, 205, and 207 but included all the other Mimecast related IP ranges I could find.

RewriteCond expr "-R '103.13.69.0/24'" [OR]
RewriteCond expr "-R '103.96.20.0/22'" [OR]
RewriteCond expr "-R '124.47.150.0/24'" [OR]
RewriteCond expr "-R '124.47.189.0/24'" [OR]
RewriteCond expr "-R '180.189.28.0/24'" [OR]
RewriteCond expr "-R '63.128.21.0/24'" [OR]
RewriteCond expr "-R '193.7.207.0/24'" [OR]
RewriteCond expr "-R '194.104.111.0/24'" [OR]
RewriteCond expr "-R '204.141.92.0/24'" [OR]
RewriteCond expr "-R '205.139.110.0/23'" [OR]
RewriteCond expr "-R '207.211.30.0/24'" [OR]
RewriteCond expr "-R '207.211.31.0/24'" [OR]
RewriteCond expr "-R '216.145.219.0/24'" [OR]
RewriteCond expr "-R '216.145.221.0/24'" [OR]
RewriteCond expr "-R '216.205.24.0/24'" [OR]
RewriteCond expr "-R '41.74.203.0/24'" [OR]
RewriteCond expr "-R '51.163.158.0/23'" [OR]
RewriteCond expr "-R '62.140.7.0/24'" [OR]
RewriteCond expr "-R '62.140.10.0/24'" [OR]
RewriteCond expr "-R '91.220.42.0/24'" [OR]
RewriteCond expr "-R '146.101.76.0/23'" [OR]
RewriteCond expr "-R '146.101.78.0/24'" [OR]
RewriteCond expr "-R '185.58.84.0/22'" [OR]
RewriteCond expr "-R '193.7.204.0/24'" [OR]
RewriteCond expr "-R '194.104.108.0/24'" [OR]
RewriteCond expr "-R '195.130.217.0/24'" [OR]
RewriteCond expr "-R '207.82.80.0/24'" [OR]
RewriteCond expr "-R '216.35.243.0/24'" [OR]
RewriteCond expr "-R '216.35.244.0/24'" [OR]
RewriteCond expr "-R '41.74.192.0/21'" [OR]
RewriteCond expr "-R '41.74.200.0/23'" [OR]
RewriteCond expr "-R '41.74.202.0/24'" [OR]
RewriteCond expr "-R '41.74.204.0/22'" [OR]

add another range for AWS fine grained
RewriteCond expr "-R '3.80.0.0/12'" [OR]

another AWS range too ;)

3.0.0.0/9

Curious to understand the benefit of redirecting to another website versus just blocking the IP via .htaccess or iptables.

Awesome! Much appreciated! Just to contribute some, I needed a way to parse out just the CIDRs to add them to iptables rules. I came up with this command:

ipRegex="((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/[0-9]?[0-9])"

curl -s 'https://gist.githubusercontent.com/curi0usJack/971385e8334e189d93a6cb4671238b10/raw'| awk '/BURN AV BURN/ {seen = 1} seen {print}' | grep -oP "(^\s$)|(#.*)|${ipRegex}"

For anyone still using these rules, note that the "Virus Total Other Hosts" IP blocks are very broad and cover IP space for various networks that are definitely not VT related. You may unintentionally block "benign" traffic with these.

Starting with Line 138

I made some scripts to update some of the file dynamically, you can check it out here https://github.com/molangning/fire-av

Cool, mind you might want to make sure you get the latest list of tor exit nodes. I no longer own 79.78.147.142 but that hasn't been one since before 2018.

I use the tor bulk exit list so ur good