Hi,
Back from holidays I noticed that it looks like the following Shadowserver feeds have disappeared:
population_bgp - https://www.shadowserver.org/what-we-do/network-reporting/accessible-bgp-ser... population_ntrip - https://www.shadowserver.org/what-we-do/network-reporting/accessible-ntrip-r... scan_imap_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-imap-re... scan_pop3_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-re...
There are no foolproof exact matches when looking for replacements but these appears to come close:
scan_bgp,scan6_bgp - https://www.shadowserver.org/what-we-do/network-reporting/open-bgp-service-r... ??? - https://www.shadowserver.org/what-we-do/network-reporting/info-accessible-nt... NB: this link is broken! scan_imap,scan6_imap - https://www.shadowserver.org/what-we-do/network-reporting/accessible-imap-re... scan_pop3,scan6_pop3 - https://www.shadowserver.org/what-we-do/network-reporting/accessible-pop3-re...
Could someone with the proper rights please update report.json, intelmq.json and types.md under
https://github.com/The-Shadowserver-Foundation/report_schema/
to fix the mismatch? And if I'm mistaken, please let me know why.
Br and thank you, Mika
The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacyhttps://csc.fi/en/privacy
T?m?n s?hk?postin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkil?n tai yhteis?n k?ytt??n, jolle ne on osoitettu. Jos et ole viestiss? tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta v?litt?m?sti viestin l?hett?j?lle. Tietoja henkil?tietojen ja yhteystietojen k?sittelyst? l?yd?t CSC:n verkkosivuilta: Tietosuojahttps://csc.fi/tietosuoja
Hello,
They are still there: https://github.com/The-Shadowserver-Foundation/report_schema/blob/main/intel...
population_bgp starts on line 7248
population_ntrip starts on line 7778
scan_imap_vulnerable starts on line 21671
scan_pop3_vulnerable starts on line 26502
We will get the ntrip link restored soon.
Regards,
Jason
On 9/1/26 7:02 AM, Mika Silander via IntelMQ-dev wrote:
Hi,
Back from holidays I noticed that it looks like the following Shadowserver feeds have disappeared:
population_bgp - https://www.shadowserver.org/what-we-do/network-reporting/accessible-bgp-ser... population_ntrip - https://www.shadowserver.org/what-we-do/network-reporting/accessible-ntrip-r... scan_imap_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-imap-re... scan_pop3_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-re...
There are no foolproof exact matches when looking for replacements but these appears to come close:
scan_bgp,scan6_bgp - https://www.shadowserver.org/what-we-do/network-reporting/open-bgp-service-r... ??? - https://www.shadowserver.org/what-we-do/network-reporting/info-accessible-nt... NB: this link is broken! scan_imap,scan6_imap - https://www.shadowserver.org/what-we-do/network-reporting/accessible-imap-re... scan_pop3,scan6_pop3 - https://www.shadowserver.org/what-we-do/network-reporting/accessible-pop3-re...
Could someone with the proper rights please update report.json, intelmq.json and types.md under
https://github.com/The-Shadowserver-Foundation/report_schema/
to fix the mismatch? And if I'm mistaken, please let me know why.
Br and thank you, Mika
/The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacy https://csc.fi/en/privacy
Tämän sähköpostin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkilön tai yhteisön käyttöön, jolle ne on osoitettu. Jos et ole viestissä tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta välittömästi viestin lähettäjälle. Tietoja henkilötietojen ja yhteystietojen käsittelystä löydät CSC:n verkkosivuilta: Tietosuoja https://csc.fi/tietosuoja /
IntelMQ-dev mailing list --intelmq-dev@lists.cert.at To unsubscribe send an email tointelmq-dev-leave@lists.cert.at
Hi Jason,
Yes, I can see they are still in the The Shadowserver Foundation git repo, but I was more puzzled by the fact that they do not seem to show up on the official Shadowserver pages anymore, or at least, not in the exact same form as before.
Br, Mika ________________________________ From: elsif via IntelMQ-dev intelmq-dev@lists.cert.at Sent: Tuesday, 1 September 2026 23.51 To: intelmq-dev@lists.cert.at intelmq-dev@lists.cert.at Subject: [IntelMQ-dev] Re: report.json, intelmq.json and types.md out of sync with Shadowserver feed offering?
Hello,
They are still there: https://github.com/The-Shadowserver-Foundation/report_schema/blob/main/intel...
population_bgp starts on line 7248
population_ntrip starts on line 7778
scan_imap_vulnerable starts on line 21671
scan_pop3_vulnerable starts on line 26502
We will get the ntrip link restored soon.
Regards,
Jason
On 9/1/26 7:02 AM, Mika Silander via IntelMQ-dev wrote: Hi,
Back from holidays I noticed that it looks like the following Shadowserver feeds have disappeared:
population_bgp - https://www.shadowserver.org/what-we-do/network-reporting/accessible-bgp-ser... population_ntrip - https://www.shadowserver.org/what-we-do/network-reporting/accessible-ntrip-r... scan_imap_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-imap-re... scan_pop3_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-re...
There are no foolproof exact matches when looking for replacements but these appears to come close:
scan_bgp,scan6_bgp - https://www.shadowserver.org/what-we-do/network-reporting/open-bgp-service-r... ??? - https://www.shadowserver.org/what-we-do/network-reporting/info-accessible-nt... NB: this link is broken! scan_imap,scan6_imap - https://www.shadowserver.org/what-we-do/network-reporting/accessible-imap-re... scan_pop3,scan6_pop3 - https://www.shadowserver.org/what-we-do/network-reporting/accessible-pop3-re...
Could someone with the proper rights please update report.json, intelmq.json and types.md under
https://github.com/The-Shadowserver-Foundation/report_schema/
to fix the mismatch? And if I'm mistaken, please let me know why.
Br and thank you, Mika
The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacyhttps://csc.fi/en/privacy
Tämän sähköpostin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkilön tai yhteisön käyttöön, jolle ne on osoitettu. Jos et ole viestissä tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta välittömästi viestin lähettäjälle. Tietoja henkilötietojen ja yhteystietojen käsittelystä löydät CSC:n verkkosivuilta: Tietosuojahttps://csc.fi/tietosuoja
_______________________________________________ IntelMQ-dev mailing list -- intelmq-dev@lists.cert.atmailto:intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.atmailto:intelmq-dev-leave@lists.cert.at
The website hosting provider appears to be experiencing a WordPress issue at this time. The documented URLs are correct and should be restored soon.
On 9/1/26 11:20 PM, Mika Silander via IntelMQ-dev wrote:
Hi Jason,
Yes, I can see they are still in the The Shadowserver Foundation git repo, but I was more puzzled by the fact that they do not seem to show up on the official Shadowserver pages anymore, or at least, not in the exact same form as before.
Br, Mika
*From:* elsif via IntelMQ-dev intelmq-dev@lists.cert.at *Sent:* Tuesday, 1 September 2026 23.51 *To:* intelmq-dev@lists.cert.at intelmq-dev@lists.cert.at *Subject:* [IntelMQ-dev] Re: report.json, intelmq.json and types.md out of sync with Shadowserver feed offering?
Hello,
They are still there: https://github.com/The-Shadowserver-Foundation/report_schema/blob/main/intel... https://github.com/The-Shadowserver-Foundation/report_schema/blob/main/intelmq.json
population_bgp starts on line 7248
population_ntrip starts on line 7778
scan_imap_vulnerable starts on line 21671
scan_pop3_vulnerable starts on line 26502
We will get the ntrip link restored soon.
Regards,
Jason
On 9/1/26 7:02 AM, Mika Silander via IntelMQ-dev wrote:
Hi,
Back from holidays I noticed that it looks like the following Shadowserver feeds have disappeared:
population_bgp - https://www.shadowserver.org/what-we-do/network-reporting/accessible-bgp-ser... https://www.shadowserver.org/what-we-do/network-reporting/accessible-bgp-service-report/ population_ntrip - https://www.shadowserver.org/what-we-do/network-reporting/accessible-ntrip-r... https://www.shadowserver.org/what-we-do/network-reporting/accessible-ntrip-report scan_imap_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-imap-re... https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-imap-report/ scan_pop3_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-re... https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-report/
There are no foolproof exact matches when looking for replacements but these appears to come close:
scan_bgp,scan6_bgp - https://www.shadowserver.org/what-we-do/network-reporting/open-bgp-service-r... https://www.shadowserver.org/what-we-do/network-reporting/open-bgp-service-report/ ??? - https://www.shadowserver.org/what-we-do/network-reporting/info-accessible-nt... https://www.shadowserver.org/what-we-do/network-reporting/info-accessible-ntrip-report NB: this link is broken! scan_imap,scan6_imap - https://www.shadowserver.org/what-we-do/network-reporting/accessible-imap-re... https://www.shadowserver.org/what-we-do/network-reporting/accessible-imap-report/ scan_pop3,scan6_pop3 - https://www.shadowserver.org/what-we-do/network-reporting/accessible-pop3-re... https://www.shadowserver.org/what-we-do/network-reporting/accessible-pop3-report/
Could someone with the proper rights please update report.json, intelmq.json and types.md under
https://github.com/The-Shadowserver-Foundation/report_schema/ https://github.com/The-Shadowserver-Foundation/report_schema/
to fix the mismatch? And if I'm mistaken, please let me know why.
Br and thank you, Mika
/The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacy https://csc.fi/en/privacy
Tämän sähköpostin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkilön tai yhteisön käyttöön, jolle ne on osoitettu. Jos et ole viestissä tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta välittömästi viestin lähettäjälle. Tietoja henkilötietojen ja yhteystietojen käsittelystä löydät CSC:n verkkosivuilta: Tietosuoja https://csc.fi/tietosuoja /
IntelMQ-dev mailing list --intelmq-dev@lists.cert.at mailto:intelmq-dev@lists.cert.at To unsubscribe send an email tointelmq-dev-leave@lists.cert.at mailto:intelmq-dev-leave@lists.cert.at
IntelMQ-dev mailing list --intelmq-dev@lists.cert.at To unsubscribe send an email tointelmq-dev-leave@lists.cert.at
Thanks for keeping us informed.
Br, Mika ________________________________ From: elsif via IntelMQ-dev intelmq-dev@lists.cert.at Sent: Wednesday, 2 September 2026 17.27 To: intelmq-dev@lists.cert.at intelmq-dev@lists.cert.at Subject: [IntelMQ-dev] Re: report.json, intelmq.json and types.md out of sync with Shadowserver feed offering?
The website hosting provider appears to be experiencing a WordPress issue at this time. The documented URLs are correct and should be restored soon.
On 9/1/26 11:20 PM, Mika Silander via IntelMQ-dev wrote: Hi Jason,
Yes, I can see they are still in the The Shadowserver Foundation git repo, but I was more puzzled by the fact that they do not seem to show up on the official Shadowserver pages anymore, or at least, not in the exact same form as before.
Br, Mika ________________________________ From: elsif via IntelMQ-dev intelmq-dev@lists.cert.atmailto:intelmq-dev@lists.cert.at Sent: Tuesday, 1 September 2026 23.51 To: intelmq-dev@lists.cert.atmailto:intelmq-dev@lists.cert.at intelmq-dev@lists.cert.atmailto:intelmq-dev@lists.cert.at Subject: [IntelMQ-dev] Re: report.json, intelmq.json and types.md out of sync with Shadowserver feed offering?
Hello,
They are still there: https://github.com/The-Shadowserver-Foundation/report_schema/blob/main/intel...
population_bgp starts on line 7248
population_ntrip starts on line 7778
scan_imap_vulnerable starts on line 21671
scan_pop3_vulnerable starts on line 26502
We will get the ntrip link restored soon.
Regards,
Jason
On 9/1/26 7:02 AM, Mika Silander via IntelMQ-dev wrote: Hi,
Back from holidays I noticed that it looks like the following Shadowserver feeds have disappeared:
population_bgp - https://www.shadowserver.org/what-we-do/network-reporting/accessible-bgp-ser... population_ntrip - https://www.shadowserver.org/what-we-do/network-reporting/accessible-ntrip-r... scan_imap_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-imap-re... scan_pop3_vulnerable - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-re...
There are no foolproof exact matches when looking for replacements but these appears to come close:
scan_bgp,scan6_bgp - https://www.shadowserver.org/what-we-do/network-reporting/open-bgp-service-r... ??? - https://www.shadowserver.org/what-we-do/network-reporting/info-accessible-nt... NB: this link is broken! scan_imap,scan6_imap - https://www.shadowserver.org/what-we-do/network-reporting/accessible-imap-re... scan_pop3,scan6_pop3 - https://www.shadowserver.org/what-we-do/network-reporting/accessible-pop3-re...
Could someone with the proper rights please update report.json, intelmq.json and types.md under
https://github.com/The-Shadowserver-Foundation/report_schema/
to fix the mismatch? And if I'm mistaken, please let me know why.
Br and thank you, Mika
The information in this email may be confidential and is intended solely for the use of the individual or entity to whom it is intended. If you are not the intended recipient of this message, please delete the message and notify the sender immediately. For information on how we process personal data and our contact information, please see CSC's website: Privacyhttps://csc.fi/en/privacy
Tämän sähköpostin tiedot voivat olla luottamuksellisia ja ne on tarkoitettu yksinomaan sen henkilön tai yhteisön käyttöön, jolle ne on osoitettu. Jos et ole viestissä tarkoitettu vastaanottaja, tuhoa viesti ja ilmoita asiasta välittömästi viestin lähettäjälle. Tietoja henkilötietojen ja yhteystietojen käsittelystä löydät CSC:n verkkosivuilta: Tietosuojahttps://csc.fi/tietosuoja
_______________________________________________ IntelMQ-dev mailing list -- intelmq-dev@lists.cert.atmailto:intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.atmailto:intelmq-dev-leave@lists.cert.at
_______________________________________________ IntelMQ-dev mailing list -- intelmq-dev@lists.cert.atmailto:intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.atmailto:intelmq-dev-leave@lists.cert.at