[Oisf-users] URL reputation?

[Victor Julien]

On 01/30/2013 04:25 PM, Matt wrote:
> Has anyone discussed URL reputation as a feature?  URL reputation is a
> common offering for threat intelligence providers.  For instance, Phish
> Tank publishes an open source feed here:
> http://www.phishtank.com/developer_info.php.  I can pull that list and
> turn it into 11k rules, but that doesn't seem optimal.  For larger
> feeds, it isn't possible at all.  E.g. Symantec's Deep Sight feed has
> over 150k URLs on it this morning.  I tried turning that into a rule
> set, but the box ran out of memory trying to load it.

We've been talking about it, just like other forms of reputation like
dns. I suggest opening a feature ticket...

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------