ransomwaretracker.abuse.ch discontinued

[rkmbaxed]

ransomwaretracker.abuse.ch discontinued

[waab76]

Had a look at the the API for urlhaus.abuse.ch and it seems like it might support something roughly like the ransomware URL data adapter, but I'm not sure there's a solution for the Domain and IP ransomware adapters. Discussing with the team about the best path forward for this issue.

[ortizleo]

+1
Please!

[H2Cyber]

Does this mean that the Abuse.ch Ransomware tracker lookups in Graylog are no longer useful ?

[rkmbaxed]

When they did not changed anything in the meantime, that it is not useful since Dec 8th, 2019

[H2Cyber]

I have removed the abuse.ch plugin, rules, pipeline, and events/alerts from my setup, to save the wasted processing power and storage space.

The rest of the GL userbase should probably be prompted to do so (be it via the notification system or in a future update).

Also the blog entry on the GL website on the abuse.ch setup should probably get updated.

Finally I think it would be better to treat the URLhaus integration separately as it has a different use case.