search

TheHive-Project / Cortex-Analyzers

Cortex Analyzers Repository
https://TheHive-Project.github.io/Cortex-Analyzers/
GNU Affero General Public License v3.0
423 stars 371 forks source link

Abuse.ch SSL Blacklist Analyzer #176

Open 3c7 opened 6 years ago

3c7 commented 6 years ago

URL: https://sslbl.abuse.ch/

SSL Blacklist (SSLBL) is a project maintained by abuse.ch. The goal is to provide a list of "bad" SSL certificates identified by abuse.ch to be associated with malware or botnet activities. SSLBL relies on SHA1 fingerprints of malicious SSL certificates and offers various blacklists that can found in the SSL Blacklist section.

Will provide an analyzer for that, but low prio atm.

srilumpa commented 6 years ago

Would it be possible to design the analyzer to plug in it other services provided by abuse.ch? I was thinking of adding RansomwareTracker (https://ransomwaretracker.abuse.ch/) and FeodoTracker (https://feodotracker.abuse.ch/)

3c7 commented 6 years ago

Hmmm. Need to think about it whether it's better to split them into multiple analyzer or to keep one. As these are open trackers, they don't need credentials, so from that side it would be possible (would'nt like to mix different credentials in one analyzer config).

omibao commented 3 years ago

SSLBL seems no longer works?