feat(security): add darklist.de source and raise the blocklist cap to 1M

.env.example

@@ -135,7 +135,7 @@ CROWDSEC_LAPI_API_KEY=
 # Expiration for each blocklist decision (re-synced keeps them fresh).
 #CROWDSEC_BLOCKLIST_DURATION=24h
 # Combined cap per sync (safety valve against excessive decisions).
-#CROWDSEC_BLOCKLIST_MAX_DECISIONS=250000
+#CROWDSEC_BLOCKLIST_MAX_DECISIONS=1000000
 # Comma-separated IPs/CIDRs that a sync must always skip (allowlist).
 #CROWDSEC_BLOCKLIST_ALLOW=1.2.3.4,10.0.0.0/8
 

README.md

@@ -848,8 +848,8 @@ bash cms security blocklists
 
 Defaults: Spamhaus DROP/EDROP, DShield, CINS, Greensnow, StopForumSpam,
 Binary Defense, blocklist.de, Emerging Threats, BruteForceBlocker, abuse.ch
-Feodo/SSLBL, Botvrij, IPsum, Firehol ipsets and Tor exit nodes
+Feodo/SSLBL, Darklist, Botvrij, IPsum, Firehol ipsets and Tor exit nodes
-(25 sources). URLhaus was removed because its `text_online` feed lists URLs,
+(26 sources). URLhaus was removed because its `text_online` feed lists URLs,
 not IPs; a malformed token in it could otherwise expand into a bogus
 huge CIDR. The validator only accepts whole-line bare IPs or proper CIDRs,
 enforces sane prefix bounds and drops reserved/private/loopback space, so a

scripts/blocklists-sync.sh

@@ -27,6 +27,8 @@ DEFAULT_SOURCES=(
   "https://feodotracker.abuse.ch/downloads/ipblocklist.txt"
   "https://sslbl.abuse.ch/blacklist/sslipblacklist.txt"
   "https://www.botvrij.eu/data/ioclist.ip-dst.raw"
+  # Live SSH/spam attackers (last 48h), bare IPs only
+  "https://www.darklist.de/raw.php"
   # Aggregated threat intel
   "https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt"
   "https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txt"