Feature Request: A separate repository for blocklist and best practices

[getkub]

First of all, Lulu is a great product and thanks for all your hard work.

I'm finding it struggling to find a baseline list of "blocklist" and rules (ips, ports, destinations etc). Would be great if you can start a new repository to incorporate all default rules/blocklists eg includes

• the known list of unsafe IP's in Lulu's required format
• the known list of analytics and tracking rules (eg google analytics, apple hash for programs etc)

This will tremendously help new users and not making many mistakes

[m0rg5]

This is what I was searching for too.

Perhaps in FAQ &/or Wiki just link to/recommend others?

[shawnyeager]

I would gladly pay/donate/subscribe to this.

https://ceadd.ca/blockyouxlist.txt was last updated in August of 2020.

[m0rg5]

I just asked GPT4-turbo (to April 2023) - "recommend a baseline list, repository or similar of "blocklist" and rules (ips, ports, destinations etc) of known list of unsafe IP’s, ideally with known list of analytics and tracking rules (eg google analytics, apple hash for programs etc)"

---

Maintaining a blocklist for cybersecurity purposes involves keeping an updated list of IP addresses, domains, and other indicators of compromise (IoCs) that are known to be associated with malicious activities. Similarly, for privacy concerns, you might want to block tracking services and analytics providers. Here are some resources that can help you build or access such lists:

FireHOL IP Lists: This is a collection of IP lists that are aggregated from various sources and updated regularly. They include lists for known attackers, malware, scanners, and more.

Website: http://iplists.firehol.org/

Spamhaus: Known for their spam-blocking lists, Spamhaus also provides several datasets that can be used to block IPs associated with malicious activity.

Website: https://www.spamhaus.org/

Emerging Threats: The Open Source community at Emerging Threats offers a set of rules for IDS (Intrusion Detection Systems) like Snort or Suricata which includes various types of malicious activity.

Website: https://rules.emergingthreats.net/

Pi-hole Blocklists: Originally designed for the Pi-hole ad-blocking software, these lists can also be used in other contexts to block ads and trackers.

GitHub Repository: https://github.com/pi-hole/pi-hole/wiki/Customising-Sources-for-Ad-Lists

Disconnect.me: They provide simple lists to block trackers which can be integrated into browsers or network devices.

GitHub Repository: https://github.com/disconnectme/disconnect-tracking-protection

EasyList & EasyPrivacy: These are popular filter lists used by adblockers that also serve to block many analytics and tracking services.

Website: https://easylist.to/

NoTrack Blocklists: NoTrack is another project that provides blocklists aimed at blocking trackers and telemetry data sent to companies like Google and Microsoft.

GitHub Repository: https://github.com/quidsup/notrack-blocklists

The Blocklist Project: A collection of various community-maintained blocklists categorized by the type of content they filter out (ads, scams, abuse, etc.).

Website: https://blocklistproject.github.io/Lists/

IPdeny Country Block Lists: If you're looking to restrict access based on geographic locations, IPdeny offers aggregated zone files by country.

Website: http://www.ipdeny.com/ipblocks/

Abuse.ch: This platform hosts several threat intelligence feeds focusing on malware command & control servers (C&C), botnets, and more.

Website: https://abuse.ch/

AlienVault Open Threat Exchange (OTX): AlienVault OTX provides access to a global community-driven platform where participants share IoCs like malicious IPs or domains.

Website: https://otx.alienvault.com/

Cisco Talos Intelligence: Talos offers an extensive list of threats based on their own research which can be useful for blocking purposes.

Website: http:///talosintelligence.com/