CyberMind-FR
41fb86ce47
Whitelist trusted crawlers to prevent false positive SSRF alerts: - Facebook/Meta: 69.171.x, 173.252.x, 31.13.x, 157.240.x, etc. - Ahrefs SEO: 54.39.210.x, 167.114.139.x, 54.36.x Changed from ip/cidr format to expression format for CrowdSec compatibility on OpenWrt. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
36 lines
1.3 KiB
YAML
36 lines
1.3 KiB
YAML
# CrowdSec whitelist for SecuBox trusted networks
|
|
# Prevents banning of internal/trusted IPs and known crawlers
|
|
|
|
name: secubox/whitelists
|
|
description: "SecuBox whitelist for trusted IPs and services"
|
|
whitelist:
|
|
reason: "Trusted services and networks"
|
|
expression:
|
|
# Local networks (RFC1918)
|
|
- evt.Meta.source_ip startsWith "192.168."
|
|
- evt.Meta.source_ip startsWith "10."
|
|
- evt.Meta.source_ip startsWith "172.16."
|
|
- evt.Meta.source_ip startsWith "172.17."
|
|
- evt.Meta.source_ip startsWith "172.18."
|
|
- evt.Meta.source_ip startsWith "127."
|
|
|
|
# Facebook/Meta infrastructure
|
|
- evt.Meta.source_ip startsWith "69.171."
|
|
- evt.Meta.source_ip startsWith "173.252."
|
|
- evt.Meta.source_ip startsWith "31.13."
|
|
- evt.Meta.source_ip startsWith "157.240."
|
|
- evt.Meta.source_ip startsWith "179.60."
|
|
- evt.Meta.source_ip startsWith "185.60."
|
|
- evt.Meta.source_ip startsWith "204.15.20."
|
|
|
|
# Ahrefs SEO crawler
|
|
- evt.Meta.source_ip startsWith "54.39.210."
|
|
- evt.Meta.source_ip startsWith "167.114.139."
|
|
- evt.Meta.source_ip startsWith "54.36."
|
|
- evt.Meta.source_ip startsWith "195.154."
|
|
|
|
# Local IPv6
|
|
- evt.Meta.source_ip startsWith "fe80:"
|
|
- evt.Meta.source_ip startsWith "::1"
|
|
- evt.Meta.source_ip startsWith "2a01:e0a:dec:c4e0"
|