Noticed a change in the Talos / Snort blocklist from the website. Reason I looked further is I can't get the list to update on the Sophos v21 feeds and this would make sense. Also noting that it no longer works on a pfsense instance I have.
"Thursday, September 26, 2024
Changes to the Snort Sample IP Block List
Effective today, we have made some changes to the Snort Sample IP Block List available on Snort.org
The Snort Sample IP Blocklist has been a steady component of our open-source Snort community since its launch. It was originally provided so the community could test the functionality of their Snort installation, and it was never intended to be users’ sole source of IP blocking.
Traditionally, this is list of suggested IPs to block based on other open-source IP block lists. But over the past several years, we have seen an increasing number of users relying on the Snort Sample IP Blocklist as their primary source of IP Blocking, which may lead to a false sense of protection from threats.
To ensure the intention and legal usage of this blocklist is clear to all our users, we will be enabling a “click-to-accept” terms and conditions box for users to access the Snort Sample IP Blocklist hosted on Snort.org. This change will outline the legal terms and conditions for use of the blocklist, which clearly documents the intended use of the data.
We will continuously update the Snort Sample IP Blocklist on Snort.org regularly and provide it free to all users to ensure that Snort is functioning as intended.
Thanks,
The Snort Team"