Reach out to potential users

[jvoisin]

We might want, once #70 if closed, to suggest the use of the IOC to the following entities:

DNS

• AdGuard (here)
  • Add a list to block stalkerware AdguardTeam/HostlistsRegistry#35
• Cisco Umbrella DNS
• NextDNS.
  • Suggested here, please vote for it
• Pi-Hole
  • firebog.net
  • Steven Black
• Quad9
  • Quad9 is already using the quad9_blocklist
• LibreDNS
• AhaDNS
• BlahDNS
• DeCloudUs
• ControlD
• Mullvad

IDS/XTR/…

• Alienvault OTX
• Anomali Match
  • contacted by @jvoisin the 2023-03-02
• Snort
• Proofpoint Emerging Threats OPEN (Used by default by Suricata)
  • Contacted via Twitter by @jvoisin
  • Pinged again the 2023-03-02
• Rapid7
  contacted by @jvoisin the 2023-03-02
• Sekoia
  • contacted by @jvoisin the 2023-03-02
• Zscaler
  • contacted by @jvoisin the 2023-03-02
• RST
  • contacted by @jvoisin the 2023-03-02
• Inquest
  • contacted by @jvoisin the 2023-03-02

MISP-based things:

• DigitalSide
• CIRCL's MISP instance

Forensic tools

• Kaspersky's Tinycheck
• Pithus
• Pirogue Tool Suite
• MVT (STIX compatible format and added to the doc)
• isdi
  • Opened an issue
• hypathia -> Free malware scanner for Android

Threat Intel

• stratosphereips
  • Contacted via their form by @jvoisin the 2023-03-02
• https://surveillancemonitor.org/

(Mobile) anti-viruses

Many anti-viruses are flagging stalkerware

• Malwarebyte @jboursier-mwb
• ClamAV: Used by a lot of open-source anti-spam email machineries
  • The form is here
• https://github.com/divested-mobile/hypatia
  • Divested-Mobile/Hypatia@76d06b5

Others

• Abuse.ch
  • ThreatFox
• Abusix contacted by @jvoisin my email
• SpamHaus
• Check who we could reach to on ATI

[jboursier-mwb]

I just passed the word internally and got confirmation that all of these are detected by Malwarebytes.

[ghost]

Just letting you know that I requested Control D to add your list. They replied saying that it is now added to their Malware list and will be deployed in the next list update.

I did email Mullvad a while ago, but I never got a reply.