feodo

package

v1.0.0 Latest Latest Go to latest Published: Jun 28, 2026 License: MIT Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/eilandert/mailstrix

Links

Open Source Insights

Documentation ¶

Overview ¶

Package feodo adds an abuse.ch Feodo Tracker IP-blocklist check to yarad. Feodo Tracker tracks botnet C&C servers (Emotet, TrickBot, AgentTesla, …); the blocklist is a CSV of known-malicious IP:port pairs.

Design mirrors internal/urlhaus (same fetch/refresh/cache pattern) but with one simplification: Feodo is a public feed (no Auth-Key required) and stores only IP addresses. A URL whose host is a raw IP listed in the blocklist is a strong signal — botnet C&C payloads often hardcode IP:port rather than a domain to avoid DNS-based blocking.

The feed URL (https://feodotracker.abuse.ch/downloads/ipblocklist.csv) is public. A key is not required; New accepts an empty key and still starts the refresher. Callers that supply a non-empty abuse.ch key get it attached as an Auth-Key header for potential future access controls on the feed.

Index ¶

type Checker
- func New(enabled bool, key string, refresh time.Duration, cacheDir string, ...) *Checker
type Hit
- func (h Hit) Rule() string
type Metrics

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Checker ¶

type Checker struct {
	// contains filtered or unexported fields
}

Checker holds the cached blocklist and serves lookups.

func New ¶

func New(enabled bool, key string, refresh time.Duration, cacheDir string, logf func(string, ...any)) *Checker

New builds a Checker and starts its background refresher. The feed is public; key may be empty. enabled must be true to start (allows callers to gate on a config flag without the nil-check pattern used for key-gated feeds).

func (*Checker) Check ¶

func (c *Checker) Check(data []byte, maxURLs int) []Hit

Check extracts URLs from data (and a defanged copy) via urlcand.Extract, and reports any whose host is a raw IP address in the Feodo blocklist. maxURLs bounds work. Delegates to CheckCandidates.

func (*Checker) CheckCandidates ¶

func (c *Checker) CheckCandidates(cands []urlcand.Candidate, maxURLs int) []Hit

CheckCandidates reports Feodo hits for pre-extracted URL candidates. cands is produced by urlcand.Extract; maxURLs caps how many are processed.

func (*Checker) Close ¶

func (c *Checker) Close()

Close stops the background refresher. Safe on nil and multiple calls.

func (*Checker) Metrics ¶

func (c *Checker) Metrics() Metrics

Metrics returns a snapshot for /metrics.

type Hit ¶

type Hit struct {
	URL   string // the matched (normalized) URL containing the blocked IP
	IP    string // the blocked IP (no port)
	Deobf bool   // found only after defanging
}

Hit is one URL in a scanned buffer whose host IP matched the Feodo blocklist.

func (Hit) Rule ¶

func (h Hit) Rule() string

Rule returns the synthetic rule name for this hit.

type Metrics ¶

type Metrics struct {
	Enabled         bool
	FeedIPs         int64
	LastRefreshUnix int64
	RefreshFailures uint64
	Lookups         uint64
	Hits            uint64
}

Metrics is a snapshot for /metrics.

Source Files ¶

View all Source files

feodo.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL