Add files via upload

Author: ipanalytics

README.md

@@ -161,7 +161,7 @@ The default configuration includes:
 - Team Cymru: IPv4 and IPv6 full bogon prefixes.
 - abuse.ch Feodo Tracker: active botnet C2 IPs.
 - SANS ISC DShield, GreenSnow, and IPsum for community risk signals.
-- Binary Defense Banlist, ThreatFox IOC IPs, USOM malicious IPs, Inversion Cloud IPs, Inversion DNSBL IPv4, Ukrainian EMA fraud IPs, ACMA blocked gambling IPs, and Global Anti Scam IPs.
+- Binary Defense Banlist, ThreatFox IOC IPs, USOM malicious IPs, Inversion Cloud IPs, Inversion DNSBL IPv4, Ukrainian EMA fraud IPs, ACMA blocked gambling IPs, Global Anti Scam IPs, AlienVault reputation, Dataplane attack feeds, and ZiyadNZ hourly aggregate IPs.
 
 Commercial feeds and API-key feeds are intentionally not bundled. Add them as private entries in `configs/feeds.yaml` when your license allows local redistribution or internal use.
 
@@ -215,7 +215,10 @@ Classification labels describe source category without forcing everything into `
   "phishing_or_scam",
   "financial_fraud",
   "policy_illegal_gambling",
-  "scam_or_fraud"
+  "scam_or_fraud",
+  "alienvault_otx_reputation",
+  "network_scan_or_abuse",
+  "aggregate_threat_intel_hourly"
 ]
 ```
 

configs/feeds.yaml

@@ -228,3 +228,40 @@ feeds:
     classification: [phishing_or_scam, scam_or_fraud]
     urls:
       - https://raw.githubusercontent.com/elliotwutingfeng/GlobalAntiScamOrg-blocklist/main/global-anti-scam-org-scam-ips.txt
+
+  - kind: textlist
+    name: alienvault_reputation_generic
+    display_name: AlienVault Reputation Generic
+    trust: community
+    threat: [community_high_risk, multi_sensor_high_risk]
+    classification: [alienvault_otx_reputation]
+    urls:
+      - https://reputation.alienvault.com/reputation.generic
+
+  - kind: textlist
+    name: dataplane_attack_feeds
+    display_name: Dataplane Attack Feeds
+    trust: community
+    threat: [recent_attack_any]
+    classification: [network_scan_or_abuse]
+    urls:
+      - https://dataplane.org/dnsrd.txt
+      - https://dataplane.org/dnsrdany.txt
+      - https://dataplane.org/dnsversion.txt
+      - https://dataplane.org/sipinvitation.txt
+      - https://dataplane.org/sipquery.txt
+      - https://dataplane.org/sipregistration.txt
+      - https://dataplane.org/smtpdata.txt
+      - https://dataplane.org/smtpgreet.txt
+      - https://dataplane.org/sshclient.txt
+      - https://dataplane.org/sshpwauth.txt
+      - https://dataplane.org/vncrfb.txt
+
+  - kind: textlist
+    name: ziyadnz_threat_intel_hourly_ipv4
+    display_name: ZiyadNZ Threat Intel Hourly IPv4
+    trust: aggregator
+    threat: [community_high_risk, multi_sensor_high_risk]
+    classification: [aggregate_threat_intel_hourly]
+    urls:
+      - https://raw.githubusercontent.com/ziyadnz/threat-intel-ip-feeds/main/output/hourlyIPv4.txt

docs/source-audit.md

@@ -11,6 +11,9 @@ This file records upstream handling for active Blackroute feeds that were review
 | `ukrainian_ema_blocklist_ips` | `https://www.ema.com.ua/wp-json/api/blacklist-query?count=1000000` | Public JSON endpoint, no key in scraper. | Daily mirror cadence. | Direct upstream. |
 | `acma_blocked_gambling_ips` | `https://backend.acma.gov.au/gmbl/api/Domain` | Public JSON endpoint, no key in scraper. | Daily mirror cadence. | Direct upstream. |
 | `global_anti_scam_ips` | `https://raw.githubusercontent.com/elliotwutingfeng/GlobalAntiScamOrg-blocklist/main/global-anti-scam-org-scam-ips.txt` | Original Wix API requires a live browser session token. No static public IP feed was found. | Daily mirror cadence. | Mirror retained. |
+| `alienvault_reputation_generic` | `https://reputation.alienvault.com/reputation.generic` | Public reputation feed used directly by Maltrail. | Monitor by HTTP freshness. | Direct upstream. |
+| `dataplane_attack_feeds` | `https://dataplane.org/*.txt` category feeds | Public pipe-delimited attack feeds used directly by Maltrail. | Monitor by HTTP freshness. | Direct upstream. |
+| `ziyadnz_threat_intel_hourly_ipv4` | `https://raw.githubusercontent.com/ziyadnz/threat-intel-ip-feeds/main/output/hourlyIPv4.txt` | Hourly aggregate IP output. Includes API-key-backed upstreams such as AbuseIPDB and OTX, so Blackroute treats it as an aggregate signal. | Hourly project cadence. | Aggregate retained. |
 
 ## Operational Notes
 

internal/source/textlist/textlist.go

@@ -153,7 +153,7 @@ func extractIPTokens(line string) []string {
 	// This tokenizer covers plain text, CSV, JSON-ish arrays, and netset files
 	// without assigning meaning to unrelated fields on the same line.
 	fields := strings.FieldsFunc(line, func(r rune) bool {
-		return r == ',' || r == ';' || r == ':' || r == '\t' || r == ' ' || r == '[' || r == ']' || r == '{' || r == '}' || r == '"' || r == '\''
+		return r == ',' || r == ';' || r == ':' || r == '|' || r == '\t' || r == ' ' || r == '[' || r == ']' || r == '{' || r == '}' || r == '"' || r == '\''
 	})
 	out := make([]string, 0, len(fields))
 	for _, f := range fields {