Bug 14664

Summary:	Threatfox IPS list now needs API/Subscription code.
Product:	IPFire	Reporter:	Adam Gibbons <ag>
Component:	---	Assignee:	Assigned to nobody - feel free to grab it and work on it <nobody>
Status:	CLOSED FIXED	QA Contact:
Severity:	- Unknown -
Priority:	- Unknown -
Version:	2
Hardware:	unspecified
OS:	Unspecified

Description Adam Gibbons 2026-10-26 10:47:21 UTC

As of 21/10/2026 Abuse.ch needs a API key to download their lists.

News link:
https://www.linkedin.com/posts/abuse-ch_authenticate-steadyplatform-steadysignal-activity-7518660733203832832-ohAX

This includes ThreatFox which will not receive updates unless v2 of their URL is used. Feodo Tracker seems to not need this. But as of right now the Feodo Tracker only contains 5 entries anyway.

Comment 1 Michael Tremer 2026-10-29 22:46:32 UTC

The ThreatFox ruleset source requires the Auth-Key now (commit ed825bc835, "ruleset-sources: Require an Auth-Key for ThreatFox downloads"), and it is not offered without it. Closing this as fixed.