#
# ransomware_rw
#
# ipv4 hash:ip ipset
#
# [Abuse.ch Ransomware Tracker] 
# (https://ransomwaretracker.abuse.ch) Ransomware Tracker 
# tracks and monitors the status of domain names, IP 
# addresses and URLs that are associated with Ransomware, 
# such as Botnet C&C servers, distribution sites and payment 
# sites. By using data provided by Ransomware Tracker, 
# hosting- and internet service provider (ISPs), as well as 
# national CERTs/CSIRTs, law enforcement agencies (LEA) and 
# security researchers can receive an overview on 
# infrastructure used by Ransomware and whether these are 
# actively being used by miscreants to commit fraud. This 
# list includes TC_PS_IPBL, LY_C2_IPBL, TL_C2_IPBL, 
# TL_PS_IPBL and it is the recommended blocklist. It might 
# not catch everything, but the false positive rate should be 
# low. However, false positives are possible, especially with 
# regards to RW_IPBL. IP addresses associated with Ransomware 
# Payment Sites (*_PS_IPBL) or Locky botnet C&Cs (LY_C2_IPBL) 
# stay listed on RW_IPBL for a time of 30 days after the last 
# appearance. This means that an IP address stays listed on 
# RW_IPBL even after the threat has been eliminated (e.g. the 
# VPS / server has been suspended by the hosting provider) 
# for another 30 days.
#
# Maintainer      : Abuse.ch
# Maintainer URL  : https://ransomwaretracker.abuse.ch
# List source URL : https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
# Source File Date: Sun Dec  8 11:16:07 UTC 2019
#
# Category        : malware
# Version         : 1555
#
# This File Date  : Sun Dec  8 11:16:07 UTC 2019
# Update Frequency: 5 mins 
# Aggregation     : none
# Entries         : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
#  http://iplists.firehol.org/?ipset=ransomware_rw
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#